vidar | edf2f2b1325eff120bef7a2414e367cd60efcc8d4256ba884d753cda39b1f381

Analysis

max time kernel
228s
max time network
429s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
10-11-2024 13:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Unlock_Tool_v2.5.6.rar
Size

49.7MB
MD5

720f68e1a57f1881b0dcbfecdfc0b3bf
SHA1

7662d996406bbd32ea2baa20ae469321bc87ee2d
SHA256

edf2f2b1325eff120bef7a2414e367cd60efcc8d4256ba884d753cda39b1f381
SHA512

9e58a26de7fffe731bba8625529b811475a03b60860e705e4cbb51eb9ba7fa060731e93d8fee271adda12e6d7a370277ede27dd7afaf449f06d99795d3a46cd1
SSDEEP

1572864:7aM2esxP+a3sRkaLwu/0WBJAZ229eBddBe7EDfNMAG:eMna8Pwa0m222Sd26vG

Score

10^/10

vidar bootkit credential_access defense_evasion discovery persistence spyware stealer

Malware Config

Extracted

Family

vidar

https://t.me/gos90t

https://steamcommunity.com/profiles/76561199800374635

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Signatures

Detect Vidar Stealer 40 IoCs

stealer

resource	yara_rule
behavioral1/memory/4768-624-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-627-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-629-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-649-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-650-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-657-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-658-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-1080-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-1081-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-1088-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-1113-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-1125-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-1140-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-1320-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-1604-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-1611-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-1634-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-1664-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-1665-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-1677-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/4768-1678-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-4792-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-4830-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-4851-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-5004-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-5953-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-5969-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-5967-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-5978-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-5977-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-5986-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-5992-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-5997-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-6051-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-6068-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-6069-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-6078-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-6142-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-6154-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1892-6173-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 20 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5108	msedge.exe
3920	msedge.exe
5468	msedge.exe
2148	msedge.exe
3740	msedge.exe
5168	chrome.exe
1228	msedge.exe
7000	msedge.exe
4708	chrome.exe
2112	chrome.exe
1788	chrome.exe
3272	chrome.exe
1248	msedge.exe
5360	msedge.exe
2516	chrome.exe
3116	msedge.exe
428	chrome.exe
1260	msedge.exe
644	chrome.exe
5992	msedge.exe

Executes dropped EXE 10 IoCs

pid	Process
3488	Unlock_Tool_v2.5.6.exe
1464	Unlock_Tool_v2.5.6.exe
4768	Unlock_Tool_v2.5.6.exe
3420	wps_lid.lid-e8mnec4AFpLB.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
2268	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
5980	Unlock_Tool_v2.5.6.exe
1892	Unlock_Tool_v2.5.6.exe
4520	Unlock_Tool_v2.5.6.exe
952	Unlock_Tool_v2.5.6.exe

Loads dropped DLL 19 IoCs

pid	Process
4768	Unlock_Tool_v2.5.6.exe
4768	Unlock_Tool_v2.5.6.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	wps_lid.lid-e8mnec4AFpLB.exe
File opened for modification	\??\PhysicalDrive0	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
File opened for modification	\??\PhysicalDrive0	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3488 set thread context of 4768	3488	Unlock_Tool_v2.5.6.exe	89
PID 5980 set thread context of 1892	5980	Unlock_Tool_v2.5.6.exe	185
PID 4520 set thread context of 952	4520	Unlock_Tool_v2.5.6.exe	191

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\wps_lid.lid-e8mnec4AFpLB.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
3000	3488	WerFault.exe	84
6044	5980	WerFault.exe	183
6000	4520	WerFault.exe	189
3352	1644	WerFault.exe	194
5888	256	WerFault.exe	201
5984	5912	WerFault.exe	208
7092	6696	WerFault.exe	295

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_v2.5.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_v2.5.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_v2.5.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wps_lid.lid-e8mnec4AFpLB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Unlock_Tool_v2.5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Unlock_Tool_v2.5.6.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
5432	timeout.exe
5416	timeout.exe
3736	timeout.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133757181711283804"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe

Modifies system certificate store 2 TTPs 64 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\FlightRoot	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TestSignRoot	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\OemEsim	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TrustedDevices	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TrustedDevices	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TestSignRoot	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TrustedDevices	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TestSignRoot	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\FlightRoot	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\OemEsim	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	wps_lid.lid-e8mnec4AFpLB.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\FlightRoot	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\wps_lid.lid-e8mnec4AFpLB.exe:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
4768	Unlock_Tool_v2.5.6.exe
4768	Unlock_Tool_v2.5.6.exe
4768	Unlock_Tool_v2.5.6.exe
4768	Unlock_Tool_v2.5.6.exe
4708	chrome.exe
4708	chrome.exe
4768	Unlock_Tool_v2.5.6.exe
4768	Unlock_Tool_v2.5.6.exe
4920	chrome.exe
4920	chrome.exe
4768	Unlock_Tool_v2.5.6.exe
4768	Unlock_Tool_v2.5.6.exe
1104	msedge.exe
1104	msedge.exe
1260	msedge.exe
1260	msedge.exe
4768	Unlock_Tool_v2.5.6.exe
4768	Unlock_Tool_v2.5.6.exe
4768	Unlock_Tool_v2.5.6.exe
4768	Unlock_Tool_v2.5.6.exe
3420	wps_lid.lid-e8mnec4AFpLB.exe
3420	wps_lid.lid-e8mnec4AFpLB.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
2972	chrome.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
2268	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
2268	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
2268	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
2268	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
2268	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
2268	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3776	7zFM.exe
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3776	7zFM.exe
Token: 35	3776	7zFM.exe
Token: SeSecurityPrivilege	3776	7zFM.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe
Token: SeCreatePagefilePrivilege	4920	chrome.exe
Token: SeShutdownPrivilege	4920	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3776	7zFM.exe
3776	7zFM.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe
4920	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1672	060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 1464	3488	Unlock_Tool_v2.5.6.exe	88
PID 3488 wrote to memory of 1464	3488	Unlock_Tool_v2.5.6.exe	88
PID 3488 wrote to memory of 1464	3488	Unlock_Tool_v2.5.6.exe	88
PID 3488 wrote to memory of 4768	3488	Unlock_Tool_v2.5.6.exe	89
PID 3488 wrote to memory of 4768	3488	Unlock_Tool_v2.5.6.exe	89
PID 3488 wrote to memory of 4768	3488	Unlock_Tool_v2.5.6.exe	89
PID 3488 wrote to memory of 4768	3488	Unlock_Tool_v2.5.6.exe	89
PID 3488 wrote to memory of 4768	3488	Unlock_Tool_v2.5.6.exe	89
PID 3488 wrote to memory of 4768	3488	Unlock_Tool_v2.5.6.exe	89
PID 3488 wrote to memory of 4768	3488	Unlock_Tool_v2.5.6.exe	89
PID 3488 wrote to memory of 4768	3488	Unlock_Tool_v2.5.6.exe	89
PID 3488 wrote to memory of 4768	3488	Unlock_Tool_v2.5.6.exe	89
PID 3488 wrote to memory of 4768	3488	Unlock_Tool_v2.5.6.exe	89
PID 4768 wrote to memory of 4708	4768	Unlock_Tool_v2.5.6.exe	94
PID 4768 wrote to memory of 4708	4768	Unlock_Tool_v2.5.6.exe	94
PID 4708 wrote to memory of 1032	4708	chrome.exe	95
PID 4708 wrote to memory of 1032	4708	chrome.exe	95
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3260	4708	chrome.exe	96
PID 4708 wrote to memory of 3048	4708	chrome.exe	97
PID 4708 wrote to memory of 3048	4708	chrome.exe	97
PID 4708 wrote to memory of 3392	4708	chrome.exe	98
PID 4708 wrote to memory of 3392	4708	chrome.exe	98
PID 4708 wrote to memory of 3392	4708	chrome.exe	98
PID 4708 wrote to memory of 3392	4708	chrome.exe	98
PID 4708 wrote to memory of 3392	4708	chrome.exe	98
PID 4708 wrote to memory of 3392	4708	chrome.exe	98
PID 4708 wrote to memory of 3392	4708	chrome.exe	98
PID 4708 wrote to memory of 3392	4708	chrome.exe	98
PID 4708 wrote to memory of 3392	4708	chrome.exe	98
PID 4708 wrote to memory of 3392	4708	chrome.exe	98
PID 4708 wrote to memory of 3392	4708	chrome.exe	98
PID 4708 wrote to memory of 3392	4708	chrome.exe	98
PID 4708 wrote to memory of 3392	4708	chrome.exe	98
PID 4708 wrote to memory of 3392	4708	chrome.exe	98
PID 4708 wrote to memory of 3392	4708	chrome.exe	98

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Unlock_Tool_v2.5.6.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3776

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2044

C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
"C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
  "C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
  "C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa502ccc40,0x7ffa502ccc4c,0x7ffa502ccc58
      4⤵
      PID:1032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,5636665801167530020,14536772015335768015,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1860 /prefetch:2
      4⤵
      PID:3260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1976,i,5636665801167530020,14536772015335768015,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2084 /prefetch:3
      4⤵
      PID:3048
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,5636665801167530020,14536772015335768015,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2524 /prefetch:8
      4⤵
      PID:3392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,5636665801167530020,14536772015335768015,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3268,i,5636665801167530020,14536772015335768015,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1788
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4324,i,5636665801167530020,14536772015335768015,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4548 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3272
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4608,i,5636665801167530020,14536772015335768015,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4592 /prefetch:8
      4⤵
      PID:2480
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4640,i,5636665801167530020,14536772015335768015,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4508 /prefetch:8
      4⤵
      PID:4304
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4320,i,5636665801167530020,14536772015335768015,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4948 /prefetch:8
      4⤵
      PID:484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4612,i,5636665801167530020,14536772015335768015,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4636 /prefetch:8
      4⤵
      PID:556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4820,i,5636665801167530020,14536772015335768015,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4848 /prefetch:8
      4⤵
      PID:3316
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4656,i,5636665801167530020,14536772015335768015,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4984 /prefetch:8
      4⤵
      PID:716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5008,i,5636665801167530020,14536772015335768015,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5016 /prefetch:8
      4⤵
      PID:1260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4968,i,5636665801167530020,14536772015335768015,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5304 /prefetch:8
      4⤵
      PID:1140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5056,i,5636665801167530020,14536772015335768015,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4664 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa4cd03cb8,0x7ffa4cd03cc8,0x7ffa4cd03cd8
      4⤵
      PID:844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,16024359991367587637,11299405348796643251,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
      4⤵
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,16024359991367587637,11299405348796643251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,16024359991367587637,11299405348796643251,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1872,16024359991367587637,11299405348796643251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1872,16024359991367587637,11299405348796643251,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,16024359991367587637,11299405348796643251,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:2
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,16024359991367587637,11299405348796643251,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2288 /prefetch:2
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,16024359991367587637,11299405348796643251,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:2236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,16024359991367587637,11299405348796643251,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1876 /prefetch:2
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,16024359991367587637,11299405348796643251,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2272 /prefetch:2
      4⤵
      PID:964
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 964 -s 320
        5⤵
        
        PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1872,16024359991367587637,11299405348796643251,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1872,16024359991367587637,11299405348796643251,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3920
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HCAEGCBFHJDG" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5388
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 324
  2⤵
  - Program crash
  PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3488 -ip 3488
1⤵
PID:3344

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa502ccc40,0x7ffa502ccc4c,0x7ffa502ccc58
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1852,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2076,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2228 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4440,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4584,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4604,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4944,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4960,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Windows directory
  PID:2044
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6ee084698,0x7ff6ee0846a4,0x7ff6ee0846b0
    3⤵
    - Drops file in Windows directory
    PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4800,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4968,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4640,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4684 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3796,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5136,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4752 /prefetch:2
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5252,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5060,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3752,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=3424,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5536,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5548,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5428,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:6088
- C:\Users\Admin\Downloads\wps_lid.lid-e8mnec4AFpLB.exe
  "C:\Users\Admin\Downloads\wps_lid.lid-e8mnec4AFpLB.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:3420
- - C:\Users\Admin\Downloads\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
    C:\Users\Admin\Downloads\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -curlangofinstalledproduct=en_US -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps -enableSetupMuiPkg -appdata="C:\Users\Admin\AppData\Roaming"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1672
  - - C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe
      "C:\Program Files (x86)\Kingsoft\office6\wpscloudsvr.exe" InstallService
      4⤵
      PID:6688
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -regmtfont
      4⤵
      PID:1360
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\\office6\ksomisc.exe" -setappcap
      4⤵
      PID:6252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4884,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=4888,i,1060412790940625401,2834201271628508209,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:5780

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2756

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:376

C:\Users\Admin\Downloads\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe
"C:\Users\Admin\Downloads\wps_download\060656cfd1a6402a9035e6288b01ca4d-15_setup_XA_mui_Free.exe.600.1002.exe" -downpower -installCallByOnlineSetup -defaultOpen -defaultOpenPdf -asso_pic_setup -createIcons -curlangofinstalledproduct="en_US" -D="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -notautostartwps="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -enableSetupMuiPkg="C:\Users\Admin\AppData\Local\Kingsoft\WPS Office" -appdata="C:\Users\Admin\AppData\Roaming" -msgwndname=wpssetup_message_E5B1B45 -curinstalltemppath=C:\Users\Admin\AppData\Local\Temp\wps\~e5b179b\
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2268
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -setlng en_US
  2⤵
  PID:5864
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -getonlineparam 00600.00001002 -forceperusermode
  2⤵
  PID:3088
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -getabtest -forceperusermode
  2⤵
  PID:4436
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -setservers
  2⤵
  PID:6836
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -register
  2⤵
  PID:7144
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\kmso2pdfplugins.dll"
    3⤵
    PID:4152
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\kmso2pdfplugins64.dll"
    3⤵
    PID:6328
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\kmso2pdfplugins64.dll"
      4⤵
      PID:6312
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -assoword
  2⤵
  PID:1832
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -assoexcel
  2⤵
  PID:6640
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -assopowerpnt
  2⤵
  PID:2768
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -compatiblemso -source=1
  2⤵
  PID:6372
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -checkcompatiblemso
  2⤵
  PID:1260
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -saveas_mso
  2⤵
  PID:4428
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -distsrc 00600.00001002
  2⤵
  PID:5620
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -sendinstalldyn 5
  2⤵
  PID:5636
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -updatetaskbarpin 2097152 -forceperusermode
  2⤵
  PID:2376
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -externaltask create -forceperusermode
  2⤵
  PID:2124
- - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\wps.exe
    "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\wps.exe" Run "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\ktaskschdtool\ktaskschdtool.dll" /task=wpsexternal /createtask
    3⤵
    PID:5340
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\wps.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\wps.exe" CheckService
      4⤵
      PID:4648
  - - C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\wps.exe
      "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\wps.exe" Run -User=Admin -Entry=EntryPoint "C:/Users/Admin/AppData/Local/Kingsoft/WPS Office/12.2.0.18607/office6/addons/ktaskschdtool/ktaskschdtool.dll" /user=Admin /task=wpsexternal /cleantask /pid=5340 /prv
      4⤵
      PID:6164
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -createsubmodulelink startmenu prometheus
  2⤵
  PID:7004
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -createsubmodulelink startmenu pdf
  2⤵
  PID:6672
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -createsubmodulelink desktop pdf
  2⤵
  PID:2328
- C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe
  "C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ksomisc.exe" -createsubmodulelink desktop prometheus
  2⤵
  PID:7116

C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
"C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5980
- C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
  "C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    PID:428
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa502ccc40,0x7ffa502ccc4c,0x7ffa502ccc58
      4⤵
      PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffa502d3cb8,0x7ffa502d3cc8,0x7ffa502d3cd8
      4⤵
      PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,9203753546728639282,12337108990214917477,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1984 /prefetch:2
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,9203753546728639282,12337108990214917477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 /prefetch:3
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,9203753546728639282,12337108990214917477,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:8
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1972,9203753546728639282,12337108990214917477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1972,9203753546728639282,12337108990214917477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,9203753546728639282,12337108990214917477,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1976 /prefetch:2
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1972,9203753546728639282,12337108990214917477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1972,9203753546728639282,12337108990214917477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3740
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HIIIDAKKJJJK" & exit
    3⤵
    PID:3824
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      Delays execution with timeout.exe
      PID:5416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 276
  2⤵
  - Program crash
  PID:6044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5980 -ip 5980
1⤵
PID:4036

C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
"C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4520
- C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
  "C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 276
  2⤵
  - Program crash
  PID:6000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4520 -ip 4520
1⤵
PID:1136

C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
"C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
1⤵
PID:1644
- C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
  "C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
  2⤵
  PID:4412
- C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
  "C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
  2⤵
  PID:5632
- C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
  "C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
  2⤵
  PID:1224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 288
  2⤵
  - Program crash
  PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1644 -ip 1644
1⤵
PID:5948

C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
"C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
1⤵
PID:256
- C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
  "C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
  2⤵
  PID:5784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    PID:5168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa4f2ecc40,0x7ffa4f2ecc4c,0x7ffa4f2ecc58
      4⤵
      PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa502d3cb8,0x7ffa502d3cc8,0x7ffa502d3cd8
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,17189652675436663368,12776345039997616480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 /prefetch:3
      4⤵
      PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 256 -s 276
  2⤵
  - Program crash
  PID:5888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 256 -ip 256
1⤵
PID:4576

C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
"C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
1⤵
PID:5912
- C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
  "C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
  2⤵
  PID:4624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    PID:644
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4f2ecc40,0x7ffa4f2ecc4c,0x7ffa4f2ecc58
      4⤵
      PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    PID:7000
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\EHDGIJJDGCBK" & exit
    3⤵
    PID:4040
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      Delays execution with timeout.exe
      PID:3736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 276
  2⤵
  - Program crash
  PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5912 -ip 5912
1⤵
PID:5348

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1216
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1904 -parentBuildID 20240401114208 -prefsHandle 1832 -prefMapHandle 1820 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5c27895-774e-44e9-aa0f-f6786197a739} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" gpu
    3⤵
    PID:5668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2360 -parentBuildID 20240401114208 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4255a36-08a3-40bb-a252-f68987537196} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" socket
    3⤵
    PID:5128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3080 -childID 1 -isForBrowser -prefsHandle 2672 -prefMapHandle 2772 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b77ee86-f071-4339-8849-fafe0012b46e} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" tab
    3⤵
    PID:6756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3540 -childID 2 -isForBrowser -prefsHandle 3556 -prefMapHandle 2696 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f79b1c94-89e2-43cd-9365-fe5a369a867b} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" tab
    3⤵
    PID:2804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4896 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4828 -prefMapHandle 3792 -prefsLen 29276 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {605a5c73-180e-4be7-b2f0-38607cac83d4} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" utility
    3⤵
    PID:6876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4928 -childID 3 -isForBrowser -prefsHandle 2568 -prefMapHandle 3552 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f178bc3-b317-423a-a910-28d1dcb551d9} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" tab
    3⤵
    PID:6896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5340 -childID 4 -isForBrowser -prefsHandle 5332 -prefMapHandle 5328 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f102535-0656-43cd-acd4-fcc94fc943e5} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" tab
    3⤵
    PID:7120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5492 -childID 5 -isForBrowser -prefsHandle 5164 -prefMapHandle 5220 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d867dd2a-dfd5-40ef-b380-81369e419c9e} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" tab
    3⤵
    PID:1168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x90,0x100,0x104,0xdc,0x108,0x7ffa4f2ecc40,0x7ffa4f2ecc4c,0x7ffa4f2ecc58
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2192,i,17347188250971786958,1539100944545892513,262144 --variations-seed-version=20241108-130108.678000 --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1648,i,17347188250971786958,1539100944545892513,262144 --variations-seed-version=20241108-130108.678000 --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1912,i,17347188250971786958,1539100944545892513,262144 --variations-seed-version=20241108-130108.678000 --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,17347188250971786958,1539100944545892513,262144 --variations-seed-version=20241108-130108.678000 --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,17347188250971786958,1539100944545892513,262144 --variations-seed-version=20241108-130108.678000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4444,i,17347188250971786958,1539100944545892513,262144 --variations-seed-version=20241108-130108.678000 --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4416,i,17347188250971786958,1539100944545892513,262144 --variations-seed-version=20241108-130108.678000 --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4612,i,17347188250971786958,1539100944545892513,262144 --variations-seed-version=20241108-130108.678000 --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3292,i,17347188250971786958,1539100944545892513,262144 --variations-seed-version=20241108-130108.678000 --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5064,i,17347188250971786958,1539100944545892513,262144 --variations-seed-version=20241108-130108.678000 --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5112,i,17347188250971786958,1539100944545892513,262144 --variations-seed-version=20241108-130108.678000 --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4768,i,17347188250971786958,1539100944545892513,262144 --variations-seed-version=20241108-130108.678000 --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4696,i,17347188250971786958,1539100944545892513,262144 --variations-seed-version=20241108-130108.678000 --mojo-platform-channel-handle=4684 /prefetch:8
  2⤵
  PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa502d3cb8,0x7ffa502d3cc8,0x7ffa502d3cd8
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,4791322391295339088,12626912034179771280,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1852,4791322391295339088,12626912034179771280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1760 /prefetch:3
  2⤵
  PID:3044

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:6040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4f2ecc40,0x7ffa4f2ecc4c,0x7ffa4f2ecc58
  2⤵
  PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa502d3cb8,0x7ffa502d3cc8,0x7ffa502d3cd8
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1772,847895267999060116,5976277287243491908,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:6456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1772,847895267999060116,5976277287243491908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1772,847895267999060116,5976277287243491908,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,847895267999060116,5976277287243491908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,847895267999060116,5976277287243491908,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,847895267999060116,5976277287243491908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,847895267999060116,5976277287243491908,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
  2⤵
  PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6376

C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
"C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
1⤵
PID:6696
- C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe
  "C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe"
  2⤵
  PID:7012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6696 -s 212
  2⤵
  - Program crash
  PID:7092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6696 -ip 6696
1⤵
PID:7116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AEBGIEGCFHCF\IDBKFH

Filesize
114KB

MD5
bbf101a8aa29972c41bf1b34f9423639

SHA1
66bca70ec93401916d78001ba17fd23fd8fd1ffe

SHA256
d343d702902a1a662ddc8da8d4f55d078798a7c515da2a885bcf8cebb3cd3b04

SHA512
2b8936abaa03233901f337791181187e65d3e29569c0d999a72ccedc06b348b72d65096d90e1ea06c3719f4f3e0e5d7865269f93da5e29d02a5f8aa24c48d147

Download Submit
C:\ProgramData\EHDGIJJDGCBK\AAFIDG

Filesize
5.0MB

MD5
9a785393c10d91908073762a30c8ddce

SHA1
4fba6810b203d61861f1991c3f8d1eb096d50cb9

SHA256
dd63338addbf6cb85444b0ac874c92715fabbd009918d95e643582eb82a1873d

SHA512
5e8b265221cf8e228f6621b5def20c44a3e226d8190f2c59376e9eb9a38bce7d16a61005fa2a250ffb9dabf6dc2a9784ecdd34d238fefac0f0699f2666894da9

Download Submit
C:\ProgramData\EHDGIJJDGCBK\BKEBFHIJE

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\ProgramData\EHDGIJJDGCBK\CAKKKJ

Filesize
160KB

MD5
42657b8f82bb8135ccd83d374c9a35ec

SHA1
9938d7799016b858eb17818c6da417e9dc0257b5

SHA256
71b477ca24a0cff0d03078d59c5824535a2d5014c8c3ed5a073f4174434efc22

SHA512
6f8d33278da73a69c03b808de8c52c0a5cc84339321db323fab461668260a442c1cfc6631e04370a55ca3607a829b9f5fbc02644cec8586f4ae773cc36889851

Download Submit
C:\ProgramData\EHDGIJJDGCBK\DHCBAE

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
C:\ProgramData\EHDGIJJDGCBK\GHDHDGHJE

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\ProgramData\HIIIDAKKJJJK\DAEBKK

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\ProgramData\HIIIDAKKJJJK\FCAAEH

Filesize
116KB

MD5
4e2922249bf476fb3067795f2fa5e794

SHA1
d2db6b2759d9e650ae031eb62247d457ccaa57d2

SHA256
c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

SHA512
8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

Download Submit
C:\ProgramData\HIIIDAKKJJJK\GIEGHJ

Filesize
10KB

MD5
392abfc3c3a83c121686d99ecc86e48b

SHA1
1e2da2c1efae8691330262fe2ed2f4536e49ee00

SHA256
721d29d032b907a5ccc8b7928193ef5ac91447721905e93ff5dde6f9f8ff3bf9

SHA512
3af345aec99adf70e633887ff52ac8364db86fbccc71452f71370ceb0334e11b8a82cf6b5d3e5a626d3fd9a346b2cd64b274f5cd5d127852593bcb8319cc9287

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
98bb667fc7d700c6b6144094a975d080

SHA1
ea1dfb79b1db7e3973a14a32085445fc21531386

SHA256
ff23a8c24c462246355cd95d7be8ec577adfa213f5394990f7312090cbc08224

SHA512
473c734953eff7ed5e371c5b6db90e4ddebd0c0ddc67da0b4196dd7bc61c683908dc2b0fc90b324190377e8ad52c67e35b2d5752ea0744f77f18ad77df34a8ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
79c00ec94bab7a1c46ed2c16e5bad45e

SHA1
0f23086e255bbeb8e10dad4de365f5a2ef10306a

SHA256
cc07aa436cf88a4eaed7e893f7e31364ac2131cd00c659a82ef7ee78a1f9dc09

SHA512
57cef7d84a29442deb5a411dd3c5d3303fdd17ce23283ae2a7b1ed2a5e293f880994ed0963783f49dda4860fee25c9d7c05be0bc6eec8ea6d0e25095df8a89e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
95397550e1b707bb3b2bfcd1dc3bd252

SHA1
7c07d5509d07f3a2a052e6dc0424931c3b7dd797

SHA256
313cf7c07e80f2d54ac48b59bc898d2af77409079453ddb0b80666f22d1c0016

SHA512
0cab85844e17cc33149a878120ec1c805ba28335353917aca3859e28abcb56f0273e88eb03da08514358b04f8178c75017e45121219ff8c3d007a346611a6448

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
6dcfe66bc69f0cb93516717d6934c966

SHA1
decff62c573b9311d62466edba4d12c63909ee51

SHA256
fb907ae97d8f26046ca537a2a2f44b8540a8c4664c672e4b144b8b31c6793781

SHA512
88d8ddb44096d762474a7b6f5d7b535b1cc4ceaef36bb6e47af0b577e6477100bbfefa7843f56b48579e509b45c6f84ae98c7c38c369284ad09750f5b09fe245

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
cf217d712c4bf0982f5b4cbae6ddde5a

SHA1
ea362dc171ac45038fb7771d2182c72d368d93fb

SHA256
47bae565499a3df35910a66663b3a138ccf93dd55a23f65def59614c3e425467

SHA512
961f9a710a18919decae3530b1b53b0ca7816712cb9ad4277b00ef49de0066d49003a2696754519fbd577f82f7b05d1c0859e8a5215793c909a9abac4b362442

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
010a53dd792b7b01da7016c7b08be0b3

SHA1
bb3cfb8a161bad0affb79b1ae522422b1215fe5a

SHA256
da75d0661dfc723d624d272940b94c7b137e6b92a8e66f8443f108bc3db551d4

SHA512
25a7c2e766a4d550f059787386afc583183a5bb93fcc0c08c088f257c37722dbdc2e34a436fb0e6d3f35d89b34465100e884928d9da7a61648206e399934af8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
36KB

MD5
a921cc6a670260f490019ac52b292a3e

SHA1
66e6b044a40595f6619b192ad3b2444383a2e622

SHA256
f2e0507770281d219fae5da7a37421a022f83f20bedcc1a853d9e2fe0b37fce5

SHA512
620b41a030c7c3e2830429034d6e8966831e7668ac3b513bb66601b0deb8b2e0539de25f0471a6972c270df6a09a18fb1e03acfee5c98a8021427474aa7dae49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
62KB

MD5
24393e2ccc4e7a164f062df993d27335

SHA1
c8f960244677439e72295d499440f295ae5be7c5

SHA256
3ecbdf289749ebf07b749a91eb3db3d1f8fc338e5cae2dae22730fb893736130

SHA512
a675af57b19197f17a1be1351c3cee6a291f23dc2614081bd7bd71adbe5eb0d191c4d50b295d43b3a002d48454a24ef9e4dc52510f2db54dcfe0c8e71948d10c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
38KB

MD5
d4586933fabd5754ef925c6e940472f4

SHA1
a77f36a596ef86e1ad10444b2679e1531995b553

SHA256
6e1c3edffec71a01e11e30aa359952213ac2f297c5014f36027f308a18df75d2

SHA512
6ce33a8da7730035fb6b67ed59f32029c3a94b0a5d7dc5aa58c9583820bb01ef59dd55c1c142f392e02da86c8699b2294aff2d7c0e4c3a59fce5f792c749c5ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
c8cb6f1b997dabe2b71ddd8641669e34

SHA1
a9366cdf22f4097b07ed536da4ba8ddd750d7e32

SHA256
dfb6ca2df25fb3a2f7057c998dbee8995b7764e0f5364efa3b833529c4f696c4

SHA512
5fc3c0f303c1a09d165135af737251ca335f15a0d1ee31e1aeb1707c34d97b2ae919c2a825e71b7e58677def3ae7f9f19d5621ae7e4ffe9b792e77d87dda970d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
912B

MD5
e9b04520de46fccf3668240e9fe569c6

SHA1
1135c570ac8c7a4a7c66d3bb9ec9f1ff1c57e148

SHA256
a4ddbb8aa88b7e6eeba12875db8a1f90f5298498e7a4f0018ccab14223ecffcc

SHA512
1d6b1275194ddd8c04f941eee968c46df20b295211b327d6962e7ace174c7071b4316e34240ae98704fb4c116d1b20657b34f1a29449395433a4640108b59295

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
888B

MD5
70165dea2b36e4b5ad1de2dbd9aeca73

SHA1
f201d6b2b33d8a6867ffa666beeb5e3becacb6c6

SHA256
bcd676e0ee89a03c97e598e20480877b39f262d6d0f9908a12334974fb66fb00

SHA512
8505fc3df2b3a85e155bc58a07eea9756c10b5bb045a3b6855e3095ea53c74d1d3c7cceeec8b722d0613498475557d27259c2fdadf4439ab87df26039c9aad28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

Filesize
399B

MD5
a15ac2782bb6b4407d11979316f678fd

SHA1
b64eaf0810e180d99b83bba8e366b2e3416c5881

SHA256
55f8fa21c3f0d42c973aedf538f1ade32563ae4a1e7107c939ab82b4a4d7859a

SHA512
370b43c7e434c6cc9328d266c1c9db327621e2c95ad13d953c4d63457a141fbf2be0b35072de96becc29048224d3646535a149229fc2ba367c7903d3e3e79bdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

Filesize
317B

MD5
8c9ddd495427202dfbb3956fea6334ba

SHA1
cef0e059799a1b769c62119e84e3426443356af8

SHA256
0ad2911cb4892c3c6f85140b9248d5c2a4c8e3e3afb75c01c32d6103bb912454

SHA512
bcdbf11012d2b5b55074fb12619ade04e1c819a17b05435cce67d328eeec9ba5c222b451ef191c7aae737b8daf77276c9788707658aab1c685117bac80a3306a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_1\_locales\en_US\messages.json

Filesize
1KB

MD5
578215fbb8c12cb7e6cd73fbd16ec994

SHA1
9471d71fa6d82ce1863b74e24237ad4fd9477187

SHA256
102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1

SHA512
e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_1\manifest.json

Filesize
2KB

MD5
35068e2550395a8a3e74558f2f4658da

SHA1
bd6620054059bfb7a27a4fff86b9966727f2c2b9

SHA256
e2f418c816895e830541f48c0406b9398805e88b61a4ec816244154cd793743c

SHA512
4bcb971d7353648abf25aca7a4a4771f62bbb76f8fc13bde886f29826d9314f5101942492004fc719493604d317958b63a95cf5173f8180214f27d6bea303f97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_1\service_worker_bin_prod.js

Filesize
102KB

MD5
4e0c47897bf98deac56f800942e150c4

SHA1
7903d30e0acee273724bdaa67446d9fd4e8460a5

SHA256
fe76ea0c2f81e6140f38f4143b40be85014b93ff80737600cfb39aeb5c8c6537

SHA512
8b31463fc683439bab5d4aefe2be0f6a9f5b695c2d95aff3f842bfc74b10ae3d386d288121161506f74a08fb86d25c1096da4177b768254bf84e83983982640f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0

Filesize
44KB

MD5
196963ea71439af493420e0d951e3882

SHA1
3bdc82921aa9cdeb349f111718d3dec87fa7aca4

SHA256
2c25f8468108075f6e03e14b5b3f35f36b662e2342041fe02a567a53ba634269

SHA512
79ae6a94051ee24d7461f889f4795dd3f677bddfb0d1a8f1aa44ab3b8f7929c368d8fee08138eca77945cba7d73907b23de53fa1fd1f356a1d01963b6b6fc1b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
e60dee94571425b5821a5a6f845de27f

SHA1
6188491ff7221d2fefe78442c523e7136fcdbb85

SHA256
b31bbbaa92907f3ea954258daefae530cce6d14acc099700c13e3338f6dad352

SHA512
abceaf0fc2c81418540a38229183fd39b415c75c33a3e3f8256cbedc8c8bb6a4cb830b239720d6fe1bcd326df4ca6af2fb38cbe7bc3fb5d5c0b2a970c0ea240e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2

Filesize
1.0MB

MD5
52bb6b1a8d9db924fcb2ddb45668fa72

SHA1
12996023e66ef0ae44d4e8a36c5d6f1ec78a85e8

SHA256
ae324698ce5ffcd56026f3de4c29ed754e9706f1ae1029a0409b4a3998128b52

SHA512
944d29fee61a718410e5a45bb55008dd2a7b9107380def625768c849b31c325c9592795c53b7d5818e883c791d7c6e271c1691ae0805c557ab9f1d0c2f9c36f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3

Filesize
4.0MB

MD5
cfa172a650b84b3abdbcc47097ea7b57

SHA1
5b45943b506c37225942826c102fcca6bb743847

SHA256
74581baa80a130006b3dd5628aa4845b20089bb80a5c5710c459e2708c95b038

SHA512
fd8626ec91e0b48a17bfe1bbf51ff8419717f631109ea2ca39b908dbc06d7628b4ff5d861bee7bc2070685c59a63c9c3759db1cb589299a0cf430a7d3b5dabfe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

Filesize
329B

MD5
289fc31aef98887cb7878a5e5df4a98d

SHA1
b66b9f25625a34f39194c58146feb5783357d201

SHA256
8a8940ec0a7210e051eaa57beba8dc69bd3b5cb076b9ec022ae486f837f0db62

SHA512
da60df1c45ad151d68819124cc178de68db680d33c6683404554ba652e3d540dc94a76d1754e16b9ca87d777e75425daf2545346e566d44d05ae2881a3997bfb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
9183ede44a9469df0673473aba0edcde

SHA1
3187b482de54bca373dc0ffefa529f4b31bdf97e

SHA256
2c52812276ee4918262c27222f681c72a3394062cade07d1c8ea040e3c44e405

SHA512
02282ca53e6775e719606fa39f7eadab6225e8f7b6fe7175440ab8e4d4028042f33fa854bb1bee362666fee2a271acffa882d639321baa140c7bed564fe5e9fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
e2ab7b6ed468c4fa27c204fed4239538

SHA1
2947117c12fc8b89a013c7f476c90d19e220f58d

SHA256
45905eb2c935a363d25f4909352f9d01fe48e278386b0efe6dff0b13e96ff3f1

SHA512
0917a16ef0fb7f9b71f456c598d56c8e222dbe1f580a57d69b68bc594eb31c771cdf5cb4b2e18a5615d54920e2f5b374f28539c05fe7c25f378c9aecfe416485

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
690B

MD5
5ffd4dd7f20a40913baca9d0e0baacdc

SHA1
7b282309b7b2d2dd39d9431faa5b4c86c17db76d

SHA256
2d041d7232a12077ed404d7751a49846f2446e8cc37e64aff703289a83b4fd47

SHA512
1fa09c37392c0e7b77bffe4a2906a8d3e6ce8013483e47dc4596f67a77488ee03afe853c35a893a6958b48e895a970152b8e9a176f56f7c36e214e21107f6135

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
5225293497b66abe3dcdcb05c22b0bef

SHA1
023b26f334cd22ea4c17e7f45c8dc4de3e22b73b

SHA256
6f6ca38fe7a64b67df4120673c58798399bff609a87050044e636cb78bca82a4

SHA512
e12e0d2f83ea59372a9c2b8907dd848dd56101d061ae6ad7c09313231f6ceeb875a88ed56619b4767579c936cfe76eb15bd2172f661616605d7944f3c50a1e73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG

Filesize
331B

MD5
0638d37f73c968c1e33c2cad46046670

SHA1
3c45d1068f927997c8b797f2f16c59d805724d7e

SHA256
30956bc75a96636307f6c93cc70d670c247c5acfc03c3e90b23cad0efec14305

SHA512
c3b83549926b0514ea72d2a9daf32811b8f77c2d68d08d8cc40e3e6cb53ba3afa0e28c9e1a4a17f095f5eedffdf27441181053c2abb45e573b9c3074eefa4d29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4e0dd66b7b11af441e32b3785d85ef13

SHA1
205af1d5afb2047334ce465c6965526f98752287

SHA256
99069645f6b5bf079ba585ded6e45590d362557f760ff0d0bf68c6506c04ea67

SHA512
8b15df54535e97b86a96864b5ddf8a1d637a0b6b538e606fde123d0638dcfbe47c1362e8be850c96dcee304780095560cfb1a8a1cae7f4fd4a6a3484b3bf3906

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a15b5561d026cb9245daa31333d1ee60

SHA1
5b110036742cd3c68bfe27435251e21c0971ac90

SHA256
265c6f15c15000786d69507a9f4a7e2928d31c8e69162f711699f35346c0c076

SHA512
ead07b7a3e41921a0c962f2726403a71025368291e64f47dd0e478a8e518f1a26c978b74205ccb00887c7b8c1d6359ace4c40de1070488221c348ff0f621b7ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a0052ca9e27f8d8dfdaac371dc71b55d

SHA1
12f912afaf2d3a920c930fcd4fdf28eede8360fd

SHA256
4fae937a15fb0acf7206cc4d8a389b8c2df9b075ca0627bdc448eb828fb4d04e

SHA512
ba126a1d6a903c0b701f69d7012ef9865555a77eedb8d11c3e9469b89d2593014c327906a81527f86a58784faa37b5ab962aa8fe0ac6c0104c08eb4a7abd6aff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
afca3ad638da5701f26cfbce350374fd

SHA1
064ebb3a5a3b24efaa5045045f91e30c82553b27

SHA256
bab8522599a0d0fedeaaa32e55140911e1edf4ce225ba5491ac8bfcac74156e9

SHA512
972f4fe0300459b416eb9dcebbb51bb97160476caca41e5ae476125b81c1a9a3598620c8dda341648826309c781ddbe660cc0532c285df1ae936346c6fb6efe3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ae9427796e39c221798645bf0cc37707

SHA1
6313336f3d31fb6c411ea5fc92c9ef71ed5d797a

SHA256
25fa16adbb36edab9a2392a729ee0b6018f99911e12afc5fb5744461aa3d26a0

SHA512
fc8f814c0b7d0a5b56c4f6a84284720b65dacf8f9b752ce61894c8c16aeae6703c4082ecf0d523f3714108f530baa4d158829d621d84e9a7aeb439a204af66de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
20461eaf0964a5ca11334c268576c831

SHA1
69a892c0bbed3403bc8c8a8f55abc5f17bad9b1c

SHA256
50e23267198d809f65760fe1a315eb17e40857b6bd4270e780d7fc7496b4aaeb

SHA512
614fda222f28c466a0357211b1a3f0028783a3336c7e094f075bcfd4f0605778f76d70e9b0c9279cb963b43dc5f9b429102a0bc3c083d0455de8d2f1b4d93606

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
12a10e0c4a89eae92a092a667fd878ce

SHA1
e15333b04a174e733f4c4c3d6cd42b755a8e864d

SHA256
5d6b47048557c818b839fda8e015233eded31a4081bf8b038af1e0682f112f53

SHA512
126c80e489b153da41a46384e8a9dee392645a64941f1c479c0ca878fc7bc4eded51a99e8d35d7a72b9ac55c766b947b0449c2907f3479a9907cf412f0b42c90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
732672f157c532aa4abe49ab31a4b41e

SHA1
4a3bdbc567da2d1dd6e1031ce77b71e9fe0d42d5

SHA256
7371b10453626b3e541270b5867b7c80e1594ce45833ed6439df9e93a7a33681

SHA512
31d5a1c41837f80c0e7986ee0c90144bebaa5c79b92707763ee662f5dd5515bcd69ef4e9886ac7a1c698796c27576683e2b9d4dda8b1089c567fb9fd1daedc08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
6b82ab1ddb6238265fec4b2ed9c21ee0

SHA1
4bcb72ac9e9d9242ecfa8e750a27e4e1e75794e9

SHA256
68de7493302cb11fa0df3b5bb82defe2a0d7f178df95bb1b6e4d4980a9fd08cf

SHA512
64bd95b253c5508bb252570821abd33ce90edf6c1c72886fac0926df869999875a97f7bbe977655afce394e4be06c154acd7c7bbc217ac2ef9b2424533039c39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b77573ca26e083e239f0eb020be4d382

SHA1
3c619b3bba461c76b8d96d52633901f6d82a2832

SHA256
e000a9cf733842129f0a6f3f1d4646853087c8cb2daa2cfea97fcddaf205059f

SHA512
5e470a89ae5f8397cf59ea2d6a23922beac1d7e2382a95a4ca567babeaeec864b5f237666a52f0f79c9916a80a951ddc29fe042b93ae2dcca236cdd3af044f95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
36e7af712d925695be92369c0d3a971d

SHA1
7f0e9db21cb19425ed343c9b0ec717606b0019a1

SHA256
3f66f39c60a0adcca6a90a542e06e9ce014803f24272faab2c9cb53ff062c654

SHA512
ded82772edcc08172228a228eb50765193cc72f7f1b56076b9ae40a6b9670dfe9d6b28277ff044db9c0fc75c5f3335d4adcc3bc767c54a4631e4a0d56a3520cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\b98637bb7ae2171a737905d5907291f63b4218a2\5cc516ad-48bd-4bb3-994e-bd00aff5591a\index-dir\the-real-index

Filesize
96B

MD5
e42456514b4023f95904f9a55d063dc8

SHA1
565990db873214293a8c290a59d5748ac05cb34a

SHA256
81d493b1516296cf43a633e6008e7a12aed83aea2e25c581d755e500395e4b10

SHA512
4e848a634862c7628507bdf1bc2d8531dd049d92952e4e01b89270395ce36de7b16c700551659c7370606473786720ce61f9ee6a5e6f8a8887d129d0a5d43d3e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\b98637bb7ae2171a737905d5907291f63b4218a2\5cc516ad-48bd-4bb3-994e-bd00aff5591a\index-dir\the-real-index~RFe5993ab.TMP

Filesize
48B

MD5
6ed33ff2c7be8812d48608039195684b

SHA1
4acad5f12199c6fae458519530b3fe5a7e2d0c3b

SHA256
659b1893769b4b7e3be7747a79643fd2e325d5eaba41792acce98ca264299846

SHA512
ef0e72b4f70aa5785e75f26d6ff6e4df65213a615c2c909d2842bab68cd32dc9fabc1557f94cb76f6831d6d8f0b5d6948403c4463313ab1e91c5a630d811aabb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\b98637bb7ae2171a737905d5907291f63b4218a2\index.txt

Filesize
104B

MD5
f8650ae0d0ff204630e1d48392af1dc0

SHA1
7a8bb11c2d6204090b6c905533d328288b16d6b3

SHA256
2334bf19c426f79dc0f0ae63b4f5ff9ad15f8aa3baf75087fecec95fc660f626

SHA512
fac04526eb8de6088c7d0a938d06e68260f28afa23d0e2f5d959c0bf38136d3a27fdbf5c6bf1fce67b46b192c7a144275bf26b9ad332ab5f1c03950b0b04da6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\b98637bb7ae2171a737905d5907291f63b4218a2\index.txt~RFe5993e9.TMP

Filesize
110B

MD5
92ae4ec3562a638c93d9cbfeeca8deeb

SHA1
3ea07c455bb529fe4c65c1a18ecd04df020fdbaf

SHA256
afcd6d1dea5bc603bba13a3425e206e189aa1079caf57acec01d32a80ce4d6b5

SHA512
57bae93454eebf9cd8379ee489f5d776a25f90220bdadf46820d5077d8d1dba50c92228d78ecfb293261e2fdca9a029b02fd79a84a2b34a3c40d552f07849ed8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log

Filesize
3KB

MD5
d00b738e616629c277b1f0491b964e63

SHA1
a02bef1098e5a527a88dbd134542539a196c0b2c

SHA256
3e742808a4a2239529d89b964d25b67bb05858a0820c5ecbcc83fe4afd76a74f

SHA512
cf952113f04e7a546497d45174849d3ee79d59477ddae5b7756c1400faf9829eac5c9f007be6ff0a74ef2e0adef10725d007670e131441ab543e75cb8119e955

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG

Filesize
336B

MD5
10832b5e54d985f56bb7475c9871ca73

SHA1
fde5c619c7b01072f282113e9b3a2ec894af6a27

SHA256
afb2036e66937edea224cb9cd8b0acf60cb73d66d2a19c8338906f58ea6aa306

SHA512
2e98f4c8afa0969f1c7cef169c4dd06aaa0b6365c97cb82e5592e21a6f8838c0bf2a05fa7b8feba18f83a83ad9da693b9a4365a5dcdff1755d40047c59c8b6b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
2ccf1dbd864e13d7ae66a529124a0f4a

SHA1
8e3862fabc262b4b3e20ea07689b55fab360b218

SHA256
45236fd896b22de020ac045b4956ec89f334c272f34e6998759f3ec558bf5210

SHA512
65c0c8c21f7f516e62475aa37b17070c1d0b2348bbb5c9d26a4a6bdd4461365d9ea40fccaa26ab80287faf3787bd8889475dc123da5593aa87c4dade5513c250

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5992e0.TMP

Filesize
72B

MD5
f93fe346fef581e72c8ae52378c96e59

SHA1
870d0ca8890c5c282a6a05124cd3b33d839e2ce9

SHA256
2bbd7b6bb49a216ca540b262c5d627161f347c4aa3834cbb41a74d05dedaae9a

SHA512
eb58a15fc5ffb971b4098d70ba3e41ced3461fe36d2c1ef39bae43b7ef766c74adae88ce344053d5570e9300e3a2de2eb5fded2eb893214b384a34e2b2b4fc37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Filesize
308B

MD5
4e7982b86b3d7d916b7722aa3b3f0669

SHA1
ce4e874903cb71d9012cc7654ca7a6ba5e4f7efd

SHA256
cbee1100a2c9add47776b7e416b58a809f6feb9fe458bef8185b0c176b5db340

SHA512
c4dda8b36e90a327061dab901730f47fc23cca129b02a157f1ed0c566a1d6dddf272a4e74d3acbf14eb3a7fac0820387a584db9e19ca299724ed7f3030f891bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG

Filesize
317B

MD5
c11dec54499cce4eedc683f6e867fc84

SHA1
88a7bc5c83f650eb4f0f2143ca371f5e773fb312

SHA256
5370fd6efd3e77369cc2c33ef6a885ae761ced24ff41a9b585a1cfa3367cb419

SHA512
f829780a4d9a2efe255a6d4fb03ec6001e8bdcffcdd3797d32cbc0acd10df6aacd54fe733fffee67d34f0d2b87971a79809bb63c47b24001659ef6c6af0b9fca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13375718169735416

Filesize
2KB

MD5
df7d1a0c7065dcef1632c6d6cdf1975d

SHA1
62485307781ed125156f33b88c1dfbc91dc4f270

SHA256
4eba8f5b354c29c5e4818b10dfd1bb3a4eec7cbe96cf802c74c1b4b0132ccad4

SHA512
6abae5692b7318cba3963fd1747da4840cb516284a3c40572d2cb7b9ce1ab2c6c513cbd7b84cbb4d35a84525b91e058d454401c32706bdfe887cfee6312c5672

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
345B

MD5
cd88bbcc93fb63662a44c617c908d335

SHA1
fcd17e2ce134d71e3fae128df7ebdaa822fa1eb7

SHA256
25555b7517e23a9746288efd7ca0d7a6010628e1c9a72ed924e548b77cf893ad

SHA512
b7334a150207a4027cffe5e417244bcf76d43f95bb4cd2ce4e694fd1d6c24e607fd335ed7375b8dcb154cbd994483784c43cdad6a431711eaf5cf910237ec362

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
321B

MD5
64db2ab3e6fabff07f4dd2658f1b8ea7

SHA1
06020c6a3beb9bcfdca0c86b7561ef6c5cc017a0

SHA256
3d2d86ddae5de56a1277cab40f9a05bd77daa3cea0fe6100826e8a2b39c6c8c1

SHA512
4d329e6ed459106fa0a97800b3610e479339bba97666da3dda9e956cecc7fdc83ae9694dfc8a14a91a9a3007b5b5745d0d855d086efbcc399e59a93f13df5420

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal

Filesize
12KB

MD5
3cb5640a1d92da6b343d51185f76bfd2

SHA1
8da5f85f59caf3404942ad83e1eab9eb0906a360

SHA256
1ed6869cce490a023dbdbe38849ac030bab66e6f33cb2d2f847741e1447120a0

SHA512
3a916fcb85d8a2b0f5f6cb9a37563a2ef7d971ae97982e8e5f72a66ac1519163b3a021e81aecfbbf800d76a8bb6ba3814a900154ed99abcbc0e1899c79aca582

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a17cf494-4d96-4faf-a21e-dae45d37bf9e.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b20a16e2-c8a6-4189-a8c7-97dcb29a9178.tmp

Filesize
11KB

MD5
d070a7fb7a0838960740f86b6a2adbbe

SHA1
8e568dac302283e13f1429d968c059ea04376671

SHA256
9336c812f911055ef13dcba01a8f110d2ae3add1e8b786011eb91c695a7e2418

SHA512
4dc5e094985967e45508998c7a47bcdef903e235a0a5321cde8c8d2054d017a350778efccd25883c66bf5079b222fd64c8e73b2759c181d03b1a44ca9fdbc96b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Filesize
18KB

MD5
c32eebecc23eb572a2a8a270e9b6ac10

SHA1
6570908b22114603952b7ed5a6e271069d68d3d5

SHA256
cd5c3d6f3de0af3a876bf9f812aa0f279962fcc7c63c2ab54b960cb541897245

SHA512
59cbbfc106f0962e6b94c34b0aa1dd47fea8f4281a7ad6be5e1789576a486c6c4b3ffa86e7d2c1da8d4417cf54806d28f17c155575e62c652a85d631a89e6da4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

Filesize
317B

MD5
91a2b4f530e2eef935611e374e1957a6

SHA1
41f515524aaf744198b45d9be7b609b3f0ccf054

SHA256
da9472890dd1c1a803f8a4ecc40bfacb672a712377c02f31865b37cc2e537cb6

SHA512
a35baa4652b20a9f8a9183b92f3c7056919adeced55b6994c354ea55123e55419a09114dab6157a579b42804b8fbc52e651a5bcf9187532621cee396e367ca18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
1c73044b7d0b11bbc8ab3e311ef51a90

SHA1
63444f0ea09aa3593e5b819c60604e68c0fb2183

SHA256
caf3d21edbf22d0669d76b284eef223b3258ccb5acaaa27515d29744a30d9b69

SHA512
c677e987df806c3bfbdaf5edadc0909b8d388faa60e3027130d8511416e8fc078c4e4b718735701b9d5a1f5e0d6d1c2fda49358591102fe1e5f57e7ab5414e59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

Filesize
335B

MD5
880c3fd792bbeb63924ae17ab1d2305a

SHA1
0189c979f572ea8594f3910c82fcf378038ea6f2

SHA256
8227e1a27b444b352c223d80eb13befbbec71a43542e3300c528a761cb136500

SHA512
9ed3049a51f3b48dffa4e7beaf7955724ed5e310f3141592f78a2a69567de9fa121d20994e33d32ab3ff891944160ce580bd5ffb8e0a19c9fc4ea42d9322c538

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
290c273d3a89f5b687e6df429299f2ca

SHA1
e2f7022490075b5494c3773c4b856bb344e07b40

SHA256
ac98ed1ec138c5f1c50b98ebe97d4cf0ccd94a3da53cf74f43a743532efe3506

SHA512
21d07763e01dffcbdaf985740c3120cb7de709504fa2e559efdcee4eda6642108c7bcc23ae24113ba249c289e316afc32e0bbbf1b227f7fc738b118e670707ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
0ed98ff09be575c74d21346339b5cd66

SHA1
4c857ada4e3fdf941738ea22b3e4d91141da5849

SHA256
61b15266ea047bf45205f0d3878cae89555bedc54a556d4048c6d94a0f4804cd

SHA512
b70fad02851cb31ae1220877b92323b4cb6204afada0a30912d5fad1088829e709ff56d410f1fdb95db298ee6326247de077e8175505227f04dd0300955afa53

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
1c7fc78ee3296a925bdd683de26c4cd3

SHA1
9a5a7cccaa47a0e7dfe4154f72a050d5edd0f754

SHA256
44b7e64315ee54a6786bd257d080b752961fb131757b84678b5c5c26c48c3852

SHA512
3596a48e04af43bd59b6b80581df6032b84d351d3eaa2d2461c21d67fd5bb455246b8d517144e7bf4b1e4966dcd43bb44aa852dfd0e311d63bdd0b20cb19b74b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
ef48733031b712ca7027624fff3ab208

SHA1
da4f3812e6afc4b90d2185f4709dfbb6b47714fa

SHA256
c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99

SHA512
ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
e090b93081c4c09598bdfee5c044ae4f

SHA1
867a1bf6dbb79d0c351ed5ce9db6aeb548fb1412

SHA256
2a64c5d564e5104d85534ca71a072ba48bda224e04e204029e3eddf7ed9bfa0d

SHA512
8f09bcc865a5d71378c1f613f3fd8eb85fafe95f72e32e2f2f1efedef4b6273d1e582a92be23229f568abb3b43b30dead52ddf4a3ff622a8bf366c96722c3dfd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
120KB

MD5
9438e4f537450c1f65daef23d2692393

SHA1
090b0e4997dd86cc72005b2450cd5c346b38ce4a

SHA256
51852526e6208e0b5f67562cb2bab967f00010bca09721557d29796e173707b7

SHA512
7b7956e1d3ec3d20a861c8f484e9d04f920fc34dc111e52d2beaed5b0990b20e29f7d0167dc35559a8e084abd46156f551a0906e35c1f9b80d02a6988718a2a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
ced5d7a72df6d48aef513716e83812e5

SHA1
d3557f66026dd33ab205c5dd9b4e7c9048566756

SHA256
b47c0869995d00696bdaaa5b6d4611b7e5e77b362693af970e57f8a150f8c41a

SHA512
1eb422c633c1115eba646354a9cdacc5769e4aafaa30f4c1b42e7e9bb957bbee3c12f67657640ef658ca29c47284485cc2b4077e71c2dd4267185bddf1342b94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\Qt5WidgetsKso.dll

Filesize
4.5MB

MD5
a7d93abf2841afe86a08230fb2fc14db

SHA1
5b8874f7922f42dae7a9214370aef691e51d837a

SHA256
98fd11afcad50d9ecf17f02b00947c73a88a3a8929c33bc7ee04f5a0da9dba2b

SHA512
508c1725a3040353fa910743bb7d7f60b2f89171aa15bd0e0b7929db324a4256e9c7f001ac35d972ec77dcc642da8a36740c1cfbd7e4a4b421e0452024585af9

Download Submit
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\kodfconverthelper_xa\mui\pt_BR\kodfconverthelper.qm

Filesize
334B

MD5
2b42be10ddde43a0b6c2e461beae293a

SHA1
53888c4798bc04fdfc5a266587b8dc1c4e0103f3

SHA256
984ebeef80f6f50907afb92e5b5ae72df49fce045552c118a77a8887cc98e19b

SHA512
be3ebd02d37de367200696351fb5f9cd0ec4c206c3a33f281cb8b62386457a30a899322798c63a0d495577393e47258994feb7f8e2445645f552c2b7a2de6778

Download Submit
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\addons\qing\mui\default_xa\res\clouddiskhomepage\static\js\pt_PT\history.js

Filesize
198KB

MD5
b4b4c703bf5c6c0b5e9c57f05012d234

SHA1
929aee49e800e88b4b01f4a449fa86715d882e42

SHA256
910eada285d4900ea8e36faf305f731cfb200b317ea866839f5f4864a9dfc09b

SHA512
2afa881ee2f47e97249904b506cf88d68a34c166d9dc0a603f68369e640336f2c0b424ecb7b23d4631a96e175b965478bfa4ebc0224b0410551e55ac4c8ad0ec

Download Submit
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\cfgs\setup.cfg

Filesize
434B

MD5
e6c8b146640faf4ce794d6acef69ae92

SHA1
7545235bc328a49b1304b8c6ee5663d43a53cf0f

SHA256
cc8027d21cf0750014fdcd5660349999c6a17db4d0449ba81ced2c04269ef6ba

SHA512
f13246c250235672fb76f1f41484e81865ede4de8f1a8d8476506b865d5a647a252f9a8fb7bd4c5561710f2f3a98291cbd22aee49c0025c77677774b32068853

Download Submit
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\msvcp140.dll

Filesize
427KB

MD5
db1e9807b717b91ac6df6262141bd99f

SHA1
f55b0a6b2142c210bbfeebf1bac78134acc383b2

SHA256
5a6dfa5e1ffb6c1e7fc76bd121c6c91305e10dd75fc2124f79fee291a9dd9e86

SHA512
f0621977d20989d21ae14b66c1a7a6c752bfd6d7ccc2c4c4ec1c70ba6756e642fb7f9b1c6a94afadd0f8a05d3c377792e4aa4c1a771d833c40a6f46b90cbe7c3

Download Submit
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\mui\ja_JP\resource\splash\hdpi\2x\ent_background_2019_wpsoffice.png

Filesize
236KB

MD5
c5ad1903526a9ca4c2f55cfea1e22778

SHA1
9c7b9ba9100a919cad272fb85ff95c4cde45de9f

SHA256
5e7ba996d2331f37b9799767c0fa806cab9a39fea434796ab08dcaf39096e334

SHA512
e482142e81fbe71666b40f7a2c53702b4278436a0240e0f56200443cf4235d9942cccc3545cc01486d53a0972be553cbf93442e8b05de7b4fcd1fe8a4ec16bb4

Download Submit
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\qt\plugins\iconengines\qsvgicon.dll

Filesize
61KB

MD5
9d355f89a89d7837a03716b1d45dc5cc

SHA1
6affa5368018a5ad1ab4a68c512ed8db527dd3b4

SHA256
167c8e0ac2c160c1eaf140e985efa3a8f809e49049e03ba3b50809d6139ca492

SHA512
76009be1aca4aaf21ef0978d4cc3694a9ad50f1d4fabdcfb5313391aae3a5fc4ad4994f58ec77e54a879dd64c773417186f3f038f8cb7905a3607495c067a678

Download Submit
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\qt\plugins\imageformats\qsvg.dll

Filesize
41KB

MD5
10adbd3c3de885e0383a97626a71af34

SHA1
392329c20383249c3632dba0e42fc017a62bc081

SHA256
c95bd95f1505e53eef32cf4581d20bc3c48621b1ccf876ee4bf7297f6581e58a

SHA512
e10cca89f19021a7d3b91090d3878b89b550e6587f9c255f67cfe19b171f438a23473cfaf20b4026c060b420fb7d812dcf4783864a124ce55c9b8d9676ad926b

Download Submit
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\qt\plugins\platforms\qdirect2d.dll

Filesize
1.4MB

MD5
bd5884a7c9cc473a229b953154a52c52

SHA1
28bfe5cc3a0e162a1b3a4bd19896c2ccfe2846da

SHA256
d3a8df4594ccdf7d7c27cb06b7a04bc929675cf184193d9ef8a50cddf07978bb

SHA512
5c47db9249d6568d37f82410a7009a8a92c2f5b1509d7545b4d3ebb21d9d9718a3eb392c4a1ecbf4a4e0e594e0c593df2ac0589288d846c0a7e485b85902a0df

Download Submit
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\qt\plugins\platforms\qwindows.dll

Filesize
1.3MB

MD5
bc21f4d77a75822b27c3d1a598e8e29e

SHA1
4ca0afce4ee376041058e3791c10c2309ca7eddc

SHA256
69af5d323506398ce6b7c1d7a776e7bc19aff52c3745865d4e8041f23deea668

SHA512
0de597f55ff5ec22b4783e3d607c4d5b3a9f8cb1ebaa2fbb24da37da31d5d99404e92b34af13487bcf802729960ff3dbbf26e409a2c27b8d31324e43ac51317a

Download Submit
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\qt\plugins\styles\qwindowsvistastyle.dll

Filesize
145KB

MD5
a8492f295b92be062e26542af4d516b7

SHA1
2fef9e287ab6eaad60c5711f5e294cf83844399d

SHA256
4c50353d5b4595c8702a069e4ffd9325c9c24999e95e4e68f09fe71fff0f6597

SHA512
5667d0c94e9725a5254b32fa5235795127e78da6879e24c7024783a84259579213c1d2629230eaf43eda5adeb760982675167218508db24613dbd28776e4bf9a

Download Submit
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\ucrtbase.dll

Filesize
1.1MB

MD5
2040cdcd779bbebad36d36035c675d99

SHA1
918bc19f55e656f6d6b1e4713604483eb997ea15

SHA256
2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359

SHA512
83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f

Download Submit
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\vcruntime140.dll

Filesize
75KB

MD5
8fdb26199d64ae926509f5606460f573

SHA1
7d7d8849e7c77af3042a6f54bdf2bb303d7cd678

SHA256
f1fd5f6ec1cfe0cc3b66b5322ac97568bc63b19c1e415b99aad7c69ddbafa33c

SHA512
f56bf11d4259dbf5d4d1f9fc2ad60ff609cddb21278999e9fa55fe5d74552e8a01ddc55cfdc9bf4b09b3e3130a1356142a24a7db8ec5ea19344de617dc9fa99f

Download Submit
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\office6\wpscloudsvr.exe

Filesize
904KB

MD5
93319d7add53c7c8c364012d5b61f3c6

SHA1
b78f3c6e393b029a1596ad4c9671e2ec9c9a4f39

SHA256
9d053f657250bc0705d84644a3d05eb9d008f75a52d360b772140eea5e271c66

SHA512
f2b638483bc29c6a766041c434b79a574f34e1ddcd3cc2b5ac6bf4f970a74af919f531fd1868e0ac28dcc1eeb88646f9ee428d6f916a1beacf174e11e08f2361

Download Submit
C:\Users\Admin\AppData\Local\Kingsoft\WPS Office\12.2.0.18607\utility\install.ini

Filesize
499B

MD5
183330feb3b9701fec096dcbfd8e67e4

SHA1
2f43379fefa868319a2baae7998cc62dc2fc201d

SHA256
ac4f26a184114522200169c5f57a0af4498a20d19b7ec6def14dd2c6413eb475

SHA512
643cc197456f15da6ddd6eb904f2b25ad4236a24310d575958c0c8e457a33167e748d21184162502a295fa466c031a837511d4d5348fd67499ede1b60065c471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\58d2a87b-eba8-48e3-b03f-b537dc92043c.tmp

Filesize
8KB

MD5
2b88b944bdad07474e503225937c869c

SHA1
3f365ca3b9537c714b7907579b7b12e1585c7ef1

SHA256
6fbdd0795ff0254dc38cc7e4c9af11b73299f0bf3cff8e8985d5c7bd2118c1b0

SHA512
e16ecbdb7029a443ed9b2c6386cd744128dc5764261574cc3f5fb0ea946ff6b8e610b4431e223ac00eca3264ed4facef06009ab36d091410f4611ad54e478492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3bf4e4f87d6a129471faa1a09aa4459f

SHA1
d08b67acef4dac1e6d8d674aadfd1e1652c92893

SHA256
2eeaca9dc6c87358c522a67a6ef0b0e89d5ff7915dcf3603e0190a3702ab5e83

SHA512
c715ce74fb97dfd550e18d12d37a7407874e5de33fca47b96aab779d945cd4d27222f7b84d916a63f9063e931ccf3e2274d295711dad4275ea4ad06cc6827a17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
63ca66084d55ee7b369472a13e1070eb

SHA1
a954fbbc98a4990d22d2c9ee26d98c4679b92f89

SHA256
f3ebfa72f75a969a483eb620ebab70111d40da6ea1e84a48aa8fe19999f176d8

SHA512
8d8da0fb916cea93b869afaf3cec52d3001f7d2c451ad46488da1cf2de7fd02ee957ed515c3ff7a086fb528f3a42f77d59a1aa17f75e7b334b0ce19c3498a3b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bc6af98aa12b19c47d7782c01663dad2

SHA1
a844881530ca9325dc32ef8f8cc4ec8f7e897b0c

SHA256
aa3a5a35c2ac827dea4d04159808d362533e2f3de52e0b4ed39fe7c9f2ebdae0

SHA512
813e67152f1be4d200b41450f83292d8049d8e7d10464deafbd6eabc1107de18226bd0f4c75777922f69513f0f51a19877ca435835dea1595783ec32b5e41313

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
683bea2b3f60ed318113d6147af4b3c0

SHA1
61417979a95ed026d457db8f079228a20d89191e

SHA256
6bf317d94188b65fbf3744f33dc9033276af47f4d26aa6ba8e4e6f10be98de3c

SHA512
72d36079f63da02869c5d4f329fc2b5b83da83b0cca51b6857d2b5ae9da3fbfb0cc6402681ea7aaf2be6d8b2c33130d2c1e893fe74e4cf7730b631e76501d1a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jj59r4xg.default-release\activity-stream.discovery_stream.json.tmp

Filesize
19KB

MD5
41c5f5c4fd3f837cef370d8ac92f9455

SHA1
41293f4b7e155a92cab37241260dc22a1e0f142a

SHA256
b22ae240940bfe19fc2a73bb3e27e73973ff431de16244d5b373bdd16945adc0

SHA512
9880b965e21b175729ba9a53bda980be20d9e3fc351375957e20efccbe592f0019d519bef8c58ded107b63dd2fd7e30237b163984e59eeee1f7126e73ec88903

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jj59r4xg.default-release\startupCache\webext.sc.lz4

Filesize
108KB

MD5
9718e5b1aeaf7799e7928375766aabc7

SHA1
8fc6b2fd3fca6bcfa6c6db244fdc1e891b9dfc47

SHA256
c9e135eb20bedd4582a49039f898e93aafd142c594a23e340e7fb0c47c974e46

SHA512
4ac55f34e764476c6bca424e1d15dcf860bb010b0b081ab9070fe739d7152628034d20c11430f728869826b5dc8f395d8fbc246015b14f9472db8da7532eb697

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\54310f7e-97ea-459b-b3bd-96bc542776c0.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE0CE81768\locales\resources\Data\level4.resS

Filesize
128KB

MD5
64d183ad524dfcd10a7c816fbca3333d

SHA1
5a180d5c1f42a0deaf475b7390755b3c0ecc951c

SHA256
5a666340f42f0f985772024d90a83d15c9a241a68d58205cd4afbb1a31f1621a

SHA512
3cab59dff09981f49d1070fba06a781439bb1ea2dae0cfcb937d9875bbe9e866be2c951cfc6a3ca4a92aea79dd3e9c4792a765f5a06f230a57dabcab2f0b3c1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kingsoft\WPS Office.lnk

Filesize
2KB

MD5
05ed58a76761380f8531346221cd314e

SHA1
f985f1a15c32670f599e55c0265ec7ca9bac6c2d

SHA256
c72ff0039ecc803adb454e3ec63e8bdc6002fea7e6c123840b58a9937404863b

SHA512
305571dfa1ec172301ceb1eb91770c06975e766e6f8ff86372c3e18521678bf66dee3841267221a2da3d605b32591935b6f8dd5acec546a859c7dc051ea1c194

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4708_756700303\4096d773-3a2c-4e00-8bc8-f3e12c2cda82.tmp

Filesize
132KB

MD5
da75bb05d10acc967eecaac040d3d733

SHA1
95c08e067df713af8992db113f7e9aec84f17181

SHA256
33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

SHA512
56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4708_756700303\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4920_1339049222\CRX_INSTALL\_locales\en_US\messages.json

Filesize
1KB

MD5
64eaeb92cb15bf128429c2354ef22977

SHA1
45ec549acaa1fda7c664d3906835ced6295ee752

SHA256
4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c

SHA512
f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4920_1339049222\CRX_INSTALL\manifest.json

Filesize
1KB

MD5
2d15a6576d5d85222f9f367c286205d5

SHA1
a51fccba42570f45a57b3e3951da75eb553eeb81

SHA256
31e923ef15ac783399d5a4ca5c67e96342cf7f18437843e2a3f55b551c6dbce6

SHA512
92217626f79111b1329a3c91ac4923354aa8fc31fd7ba7428a256e9acb35825d6ea28fde02b4ae44914adf359b3dd11d16f274040dd8e675f2aba66139b52661

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wps\~e5b179b\CONTROL\office6\Qt5CoreKso.dll

Filesize
5.0MB

MD5
7fc37c5552ada776f404d3679b9b0c4c

SHA1
9fba9ce4f16c935c5b8fbef62102cc7693b05f7c

SHA256
6f681003b8e6c880891e082ee68ae18e3efa8da2ecf1707145f9ae3e3d4100cf

SHA512
d2007abf0cc8c01eda7db4614ea5a05114ebdc39b5afbb0f20c5ab75c1f9a799a52a6e86cf7dc4a5a38132bd88d7692fece16ffcd36a895aa1c81f135fee134e

Download Submit
C:\Users\Admin\AppData\Local\Temp\wps\~e5b179b\CONTROL\office6\Qt5GuiKso.dll

Filesize
5.3MB

MD5
be1f6ac2ccea42961c970aec7c496922

SHA1
913e98b3d882bafd5d3ad33f06dccb33297c8668

SHA256
30079d48f5baed9d2bf588bc87a114bbb6fb27ea5ef47c2b5f70f06b85eab463

SHA512
d650a0f95be6314f2bfecdea66e529bce6ed379ddadff658f57fe650d457f1e3dced583cd5ff4d5e15735b0880200b5f1b50388b709d2019ed139e3c985285d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\wps\~e5b179b\CONTROL\office6\Qt5SvgKso.dll

Filesize
392KB

MD5
70cee47ff4ea3ebf85f954fd9e827592

SHA1
4de5401139f3ac3fc6e633a5dc98c3c8ccfc8cc0

SHA256
dcce40b45fde63f7333d2bcce1a763f1e482652912e38e18207313d39ea3a422

SHA512
7c1bfe80f9ee1959c9f727e7ce0bcf29b0e65f490f7024cdd46f1a10d5d15be70d452857050c18993f881e066c9b34d0b0fda716ee89be0a36ebb98f37c70a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wps\~e5b179b\CONTROL\office6\Qt5WinExtrasKso.dll

Filesize
217KB

MD5
0e15f2a1c22a7d0147ab6df139797a62

SHA1
0f8207e8a1c1ff692a70c1668b2bafd566ba1718

SHA256
6740b78526c22f1e8ea26c90d5a93436f8f2081f5f6da1c7f0e877937635977f

SHA512
981946ea220caf0c237ad2b751aa0fd11a71cb7e1502dd74a3ffac1a6ae72981d8f8910b182a8cadc7404ccbb223b2c71a9bcdf00c01efe25f7aa8e1361f5d26

Download Submit
C:\Users\Admin\AppData\Local\Temp\wps\~e5b179b\CONTROL\office6\dbghelp.dll

Filesize
1.2MB

MD5
56d017aef6a7c74cd136f2390b8ea6d3

SHA1
46cc837c64abe4e757e66a24ece56e3f975e9ef6

SHA256
900da3e0ea1b4f94773689b41d3f00b28b0fad0f6390da3aec3a9f84a3f85920

SHA512
7b5573461693c6125df7ff9040afb6f4fa818a68add9073071a3317767216dd9a6cf25704f3189f3923ead36751fa830e9899eb79f9b6cad3be405262bf53f49

Download Submit
C:\Users\Admin\AppData\Local\Temp\wps\~e5b179b\CONTROL\office6\qt\plugins\printsupport\windowsprintersupport.dll

Filesize
71KB

MD5
bf10e0c48251234d831ffcd8cca82344

SHA1
955d9cfa4e8dccff444a1f1ef505ccd41a75cd22

SHA256
1a96c89fd3eb51bfc46d36b3ab4f46f070c30e9aa5f2a16a5d3c2984ea71d617

SHA512
15d76a106a1630ac193a9429c7da666bf29816500fab0b029405bf414810d1a3def3f55cb3f09a3aefeeb9be299045958d1c219e4d60eb2b1f3d53911d6464b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\wps\~e5b179b\CONTROL\pl_PL\style.xml

Filesize
3KB

MD5
034f37e6536c1430d55f64168b7e9f05

SHA1
dd08c0ef0d086dfbe59797990a74dab14fc850e2

SHA256
183a140011774d955e9de189e7a1d53cb4128d6abed61c7bfd5994268ee5f384

SHA512
0e1911c882152a4e1059a3ce1880d7fb2aed1e1e36cbd37055de2e2a1333acb2a0233ba2a4d969ccebbef1e77809aa5e78807aa9239545beae8c548c0f8f35c0

Download Submit
C:\Users\Admin\AppData\Local\tempinstall.ini

Filesize
387B

MD5
c38481658f9149eba0b9b8fcbcb16708

SHA1
f16a40af74c0a04a331f7833251e3958d033d4da

SHA256
d0d73f49bc21b62fe05c47024d69406a3227da0f6b4ffe237726e6a031f188d2

SHA512
8f98d62f88442b8ef94aa10074e35aa8d9494f3c76ce8b143ca0bf7fa0d917f3175212fbcd6e7b0597fd0ec0e1b2827f157135512fb01c88218d36e2f7dd73ce

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\AlternateServices.bin

Filesize
6KB

MD5
6cbd9a623d1dde18276d2299739e0498

SHA1
2b6b573da943bf2f180088fef449f455f3b92517

SHA256
d5479b9d9cc2264d51759e9fd22182ddd9bf7ecf3a06c0c375733fe87f326c9f

SHA512
a00afac6acd6593440cd4cbefb9ffec22c867be46304b64d7b1c64773445a56075898c1f1dde83c1b07866f80e5b2e64e53970bc151acc5beecacc458090bd47

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\AlternateServices.bin

Filesize
8KB

MD5
06eae2c5690687e807d1fceb2940d111

SHA1
922d67fdf2abb3fbac502ecc984a082fddbfaf79

SHA256
70b63c38eb9429b0d96073cbdb3e69490501a37e55f4710cd064098d1a0c1a7d

SHA512
e49a40929c011e47b4e9a1c89491d811b917ce57013fc0a249206bd5831f3ff931899d271c12cfcc579e9480bbb2fee0c94df100b9bc6944be566aa87467d820

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
34df2c2b53385669ac10e9f59de9acb6

SHA1
e32545f29a6084d34b7a2fffdddac73b44c514a4

SHA256
804609245b7d3eb233ecf4c4c57a9fd13e7be69e5ba88224e53dee217d9cd972

SHA512
13e299a00cdf90f4d5fc12f5958a76ace66f1a192a93dda84d83ef1cb0ff26868c1018cfe8076b09a83b16452c30e11142bc34edb8dfe5d1a754a3921741aa6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
801fc4f83c265d8bc9da9ef2d641334c

SHA1
179199708fcba527c79fffd99977cb5e8157783e

SHA256
a6b2664f62562c052b83e4706c24ff1a9d580f4a38d120fcfa4854549a4aedab

SHA512
bf19168594ef044bec3a9fb2ac97e54c5a53a31c2949ee0f9f0ef737155b27dc62d05c57722ad0078c4c18f58ccad3f56f92af8bf4baadb0ecf84b35a09c1716

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\pending_pings\20e30b72-4f08-4f7f-9e0b-4ea9a5d0e7fb

Filesize
982B

MD5
038ffb157ebed5182396488611e39a71

SHA1
e0946f6163f227d15b97df632d09ebbc55a0f273

SHA256
fdaa256f74aabf8055231450378d7ed846bce173ec9ddb28b52fe5588d58646e

SHA512
a61621ffd24bda50e4c4a82b9f56b359d5df6992fc214065af6c751f22247b3c3781855e2580cb18ad9f068b78d22bd3f34db680ff0e3ba34d479f02e5bc9443

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\pending_pings\39a5c045-544d-4dd9-b77f-f8dbb26f1d2e

Filesize
24KB

MD5
af0c07058d86ae5cdbee90316cfbf727

SHA1
7f68e558a79b1bd9c9baa6c07d0b74d60c1f0878

SHA256
b4ce6d0d9b40541a49d40b89624eb4ade8b11efad5f3fb9e98081514e2efa935

SHA512
cd0eea4a9bd5501ed4aac13478b0a96860072f082784d5e566b53beff6c2b49223987b30f2531675a2f340f3470ee124e0aeef5bcc059ccb85f0f40835e52e78

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\pending_pings\a6119ab8-090b-4236-b9f0-05683cc40e4a

Filesize
671B

MD5
30ac87c9df144ba12b4af6fb975c611d

SHA1
7e12354ceb1437d27b6c9a8371b23ddd9f735e79

SHA256
1734288ed0cc7ec7d40175703916f86205a04de299451fd020c86158d8540c0c

SHA512
10ca8068166d81252b3ed54bb46fff1cf7d82b8579cc710d3e83c9d00755411e3d4b54527ba3ad997a312910a338106dc3b880362bdee685e84f6a775dd809ae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\prefs-1.js

Filesize
10KB

MD5
f695432b86067f41b51c2ee57e535dc5

SHA1
fc502c19d04c779d6cb2a26b2151feee32b66b41

SHA256
e75366f2111a97ece5ce0351a05ed6faa3f0d1a51c83104cc519e322b9434dd6

SHA512
13ac8e2c79d7481a29d3b03f1d01f35c6b4211a6f52340d6232f7299d5250caa6bcdd89ad04fdc1d8f8c1b9790125d3ebceeabd63f6acb2ee9a06dcccb11457e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\prefs-1.js

Filesize
10KB

MD5
063b4d7e56d27ec5a7e0f8d3a8c0a8d0

SHA1
a28912a4492f18c331dc0d5703b3933b7b2ae335

SHA256
e6c795522a86a20161627dd02dddedaffcc2c12c57bea00597fe1e1831303a7d

SHA512
66626d61575d969caf7e6dad0c158bf5549807789d99f7d4b2f8e76a94b5e055b8bde04a96205da80a3a89442cdbb7eb13e80adea4f5f686aabfdb9c87756279

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\prefs-1.js

Filesize
11KB

MD5
5b41c61d63b356c343dfc080770b3375

SHA1
eb0ddb78b10321f56ee66e435cd5ec67e9c67f5e

SHA256
765135c285bf2469cb80d10dcc47bd9fa18998ce4bd6cd8b7fb1752d2321bb9f

SHA512
912c0426e2a36bd070977ae9b120afa186aa32c73cfdc31a924ee77109fd1e8ad692328f4d8cfd705d0cc6d989bf317b0f1d002ce3a932f06791c88b6956d4c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
484312ede4d9d1786043ebac4c29a4a3

SHA1
d2983bada07aee6ea1379d0e7df7156161625133

SHA256
1a5b8db90aa5ee727635a16f6306d9ab4ee028da7131f4b1ae0c32a0c9dbfeaa

SHA512
28d7ede0f7e95dc9d75dbe18136cda206bed5bad477366f278ad6ea709029f33199d8aa23e27b43f4ac6b502b9b4a16200a0edf1b0585ae3b9da83954aa3a7e2

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\office6\cfg\onlineconfig.data

Filesize
100KB

MD5
da401a186201a5478add30b0d14bea27

SHA1
fd9c7e11bbce567240e79785ce144389a6d3bf3f

SHA256
7b0b71f9b3d68a8d9a8a9b37caf95d0eecd8cdf50090d99e0ab5cb53d63b78e0

SHA512
499dea78975eb0ebbbff637cc2d7f192999cafdb0deec7353e249f1c50eaecf04f774001ff291f35461c701c4c5f10bfc02c45968cc09b2f6004ce53a30d6560

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\office6\configs\configure2

Filesize
208B

MD5
27fadba34a70fd134fe60cd6eb3a14ed

SHA1
4b85d68866024d267440e065d08415fcbaebf94b

SHA256
201c23d5022f9369c2079a259ebc05fb77a69d88effe72170883fc2b829cd6c2

SHA512
d752eaee0bee9a5af3cbcc765a98c573849fbdc464b18d8cde503de8b5c5b787df5a694ccf94c7bebd2a44389eddebbc7ee12b9592be7e5399dfedf5e702f58d

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\ksomisc\ksomisc_2024_11_10.log

Filesize
5KB

MD5
66fbc14b3bcd2f432eea52988b2c1530

SHA1
fed961ba165d492cbb858545d5b75f0c3fbce864

SHA256
bfd5453633b1b47e0929fd3821ae912adabe5cabb8658ddc1300cf563f5a5310

SHA512
ffe620d23aa98a64953c047ecaef4eb1dab528329ac1adb58dff305ba2327464f5e3f6ec1a4c13163f8b6f0d71e2c82b94d42b8a572f6524f837b3e2485a8b27

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.log

Filesize
12KB

MD5
7f868daa352f8fb8557d181a50938d1b

SHA1
e197397e85bbf2ba9b3dbbf7bacac738a9ab6717

SHA256
4a506fd64f373e415be8ee352be9a8c3fd11f2255bd401b2ade4d0d9ba702423

SHA512
d31f9f555cfbcd5753f334a9f60036fce7204c51d3bcd9f48e06f1029abbc0ebc671cb9349a78940a20c6ce092368736423ff2dec3bcead05e30503f6f2129c1

Download Submit
C:\Users\Admin\AppData\Roaming\kingsoft\wps\addons\data\win-i386\kconfigcenter\kccsdkdb\kccsdkpriortydb\mdbx.dat

Filesize
64KB

MD5
da96e0db76a3648edc621719c79bc728

SHA1
81dd8b51395caf48619a2b6feef894f44861aa92

SHA256
26ddce70b884c4a4d1b62366d31371d49fd8533e5ccf049719bafad954cd5422

SHA512
3d238379aba1abc4db464d8b2ab4860a7e352338dd80a98e402e2b69a3714560fc941320474685c9290d7f54332503eb06648baf69d41f6712cd9b600fa9f643

Download Submit
C:\Users\Admin\Desktop\WPS\Unlock_Tool_v2.5.6.exe

Filesize
1.1MB

MD5
b067c29195a13494802f2eab3a9106d3

SHA1
adca61f35491b5eb7d85daaa917f96d666e9d612

SHA256
40592e02eec664b6c7358d2c44eaf1b019ff171755a9b824f0cf180e4f4251c9

SHA512
5c49e56265ce8df8b89b783d8d1e5468abf50348376fabe290e00d766c9e1d72f05c46b78fec6506f3e55ebe7f19b3afe8381cf91de036aa200f124f9eb902ea

Download Submit
memory/1892-5004-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-6069-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-6142-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-4792-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-4830-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-4851-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-4845-0x000000001A040000-0x000000001A29F000-memory.dmp

Filesize
2.4MB

Download
memory/1892-6173-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-5967-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-6078-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-5953-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-5978-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-6068-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-6154-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-6051-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-5997-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-5992-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-5986-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-5977-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1892-5969-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/3488-622-0x0000000001029000-0x000000000102A000-memory.dmp

Filesize
4KB

Download
memory/4768-1125-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-1140-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-658-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-1665-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-649-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-629-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-627-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-1664-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-624-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-1634-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-1611-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-1604-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-1113-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-1677-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-1678-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-657-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-1080-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-1320-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-651-0x000000001C790000-0x000000001C9EF000-memory.dmp

Filesize
2.4MB

Download
memory/4768-1081-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-650-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/4768-1088-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download