hxxps://drive[.]google[.]com/file/d/1DqYJ5h_YtGypvjTWkM6XnyvSLZPOEb7O/view?usp=drive_link, hxxps://drive[.]google[.]com/file/d/1DTi19ol3pdgKI9lNzh6tyAaCW0Z83lbk/view?usp=drive_link

Resubmissions

04-12-2024 18:25

241204-w2tc5avlex 8

Analysis

max time kernel
2099s
max time network
2090s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04-12-2024 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1DqYJ5h_YtGypvjTWkM6XnyvSLZPOEb7O/view?usp=drive_link, https://drive.google.com/file/d/1DTi19ol3pdgKI9lNzh6tyAaCW0Z83lbk/view?usp=drive_link

Score

8^/10

defense_evasion discovery evasion exploit persistence spyware stealer trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Possible privilege escalation attempt 7 IoCs

exploit

pid	Process
4264	takeown.exe
1476	takeown.exe
1636	takeown.exe
1156	takeown.exe
2688	icacls.exe
3368	takeown.exe
2400	takeown.exe

Executes dropped EXE 5 IoCs

pid	Process
3744	explorer.exe
2416	explorer.exe
3172	explorer.exe
968	explorer.exe
1380	Taskmgr.exe

Loads dropped DLL 1 IoCs

pid	Process
2180	Taskmgr.exe

Modifies file permissions 1 TTPs 7 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1636	takeown.exe
1156	takeown.exe
2688	icacls.exe
3368	takeown.exe
2400	takeown.exe
4264	takeown.exe
1476	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
301	drive.google.com
393	drive.google.com
3	drive.google.com
6	drive.google.com
7	drive.google.com
8	drive.google.com
180	drive.google.com
297	drive.google.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	explorer.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\explorer.exe	xcopy.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File created	C:\Windows\explorer.exe	xcopy.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\explorer.exe	xcopy.exe
File created	C:\Windows\explorer.exe\:Zone.Identifier:$DATA	xcopy.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File created	C:\Windows\explorer.exe	xcopy.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Win10Explorer.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Taskmgr.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Enumerates system info in registry 2 TTPs 13 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3876	taskkill.exe

Modifies Control Panel 8 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Control Panel\Desktop\TranscodedImageCount = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Control Panel\Keyboard	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Control Panel\Colors	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Control Panel\Desktop	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Control Panel\Desktop\TranscodedImageCount = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Control Panel\Keyboard	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Control Panel\Colors	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Control Panel\Desktop	explorer.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Internet Explorer\TypedURLs	Taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Internet Explorer\GPU	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Internet Explorer\GPU	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133778103388768019"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1723"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "17336"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7115"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "132"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "6360"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7036"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\SniffedFolderType = "Downloads"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "9448"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "6360"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "9455"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "4158"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8985"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "10187"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3870231897-2573482396-1083937135-1000\{817EE656-691B-4D4F-BCF6-12022C1BF829}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "5680"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "4027"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7095"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "13263"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "9440"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "888"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "8204"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "13221"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3870231897-2573482396-1083937135-1000\{D2C1E3CE-849F-4BC0-8C88-1AC86FF29FD9}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\6\1\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5273"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\ApplicationFrame\windows.immersivecontrolpanel_cw5n1h2txyewy!m = f401000040010000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2101"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3227"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "13777"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "5273"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1723"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "10190"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "15048"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5361"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\6\1\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "12586"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "165"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "13263"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3983"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "3938"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "4125"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133727755365541791"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "10210"	SearchHost.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Win10Explorer.exe:Zone.Identifier	chrome.exe
File created	C:\explorer.exe\Win10Explorer.exe\:Zone.Identifier:$DATA	xcopy.exe
File created	C:\explorer.exe\:Zone.Identifier:$DATA	xcopy.exe
File created	C:\Windows\explorer.exe\:Zone.Identifier:$DATA	xcopy.exe
File opened for modification	C:\Users\Admin\Downloads\Taskmgr.exe:Zone.Identifier	chrome.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
968	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
128	chrome.exe
128	chrome.exe
1416	chrome.exe
1416	chrome.exe
1416	chrome.exe
1416	chrome.exe
388	chrome.exe
388	chrome.exe
388	chrome.exe
388	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
4824	chrome.exe
4824	chrome.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
3172	explorer.exe
3172	explorer.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3172	explorer.exe
968	explorer.exe
2180	Taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe
Token: SeShutdownPrivilege	128	chrome.exe
Token: SeCreatePagefilePrivilege	128	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
4824	chrome.exe
4824	chrome.exe
4824	chrome.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe
2180	Taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
128	chrome.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe
3172	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
3172	explorer.exe
716	SearchHost.exe
4580	StartMenuExperienceHost.exe
968	explorer.exe
2672	SearchHost.exe
2720	StartMenuExperienceHost.exe
968	explorer.exe
968	explorer.exe
968	explorer.exe
968	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 128 wrote to memory of 4696	128	chrome.exe	77
PID 128 wrote to memory of 4696	128	chrome.exe	77
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 2956	128	chrome.exe	78
PID 128 wrote to memory of 4432	128	chrome.exe	79
PID 128 wrote to memory of 4432	128	chrome.exe	79
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80
PID 128 wrote to memory of 2416	128	chrome.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1DqYJ5h_YtGypvjTWkM6XnyvSLZPOEb7O/view?usp=drive_link, https://drive.google.com/file/d/1DTi19ol3pdgKI9lNzh6tyAaCW0Z83lbk/view?usp=drive_link
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d3ffcc40,0x7ff8d3ffcc4c,0x7ff8d3ffcc58
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2036,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2164,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2300 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4416,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4564,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4592 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4304,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5140,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4836,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4784,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5072,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5380,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=2584,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5284,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5424,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5648,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5608,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5604,i,5877518267966085511,4089660835163847051,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:924

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:4940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0x88,0x108,0x7ff8d3ffcc40,0x7ff8d3ffcc4c,0x7ff8d3ffcc58
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1808,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2072,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2160,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2188 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3032,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3040,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4380,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4704,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4236,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4776,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4972,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4956,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4984,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5268,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5248 /prefetch:2
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Windows directory
  PID:3660
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff79a8a4698,0x7ff79a8a46a4,0x7ff79a8a46b0
    3⤵
    - Drops file in Windows directory
    PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5104,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5324,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3536,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4636 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5424,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3448,i,4565408031696402627,5423858273368224210,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2248

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1320

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3756
- C:\Windows\system32\xcopy.exe
  xcopy Win10Explorer.exe C:\explorer.exe
  2⤵
  - NTFS ADS
  PID:796
- C:\Windows\system32\xcopy.exe
  xcopy Win10Explorer.exe C:\explorer.exe
  2⤵
  - NTFS ADS
  PID:2836
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\explorer.exe
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2400
- C:\Windows\system32\xcopy.exe
  xcopy explorer.exe C:\Windows\explorer.exe
  2⤵
  - Drops file in Windows directory
  PID:2092
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  PID:3876
- C:\Windows\system32\xcopy.exe
  xcopy explorer.exe C:\Windows\explorer.exe
  2⤵
  - Drops file in Windows directory
  PID:716
- C:\Windows\system32\takeown.exe
  takeown -f explorer.exe
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4264
- C:\Windows\system32\takeown.exe
  takeown -f explorer.exe
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1476
- C:\Windows\system32\takeown.exe
  takeown -f C:\Windows\explorer.exe
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1636
- C:\Windows\system32\xcopy.exe
  xcopy explorer.exe C:\Windows\explorer.exe
  2⤵
  - Drops file in Windows directory
  PID:3424
- C:\Windows\system32\net.exe
  net user administrator /active:yes
  2⤵
  PID:3508
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user administrator /active:yes
    3⤵
    PID:4676
- C:\Windows\system32\sfc.exe
  sfc /scannow
  2⤵
  PID:2536
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\explorer.exe
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1156
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\explorer.exe /grant Administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2688
- C:\Windows\system32\xcopy.exe
  xcopy explorer.exe C:\Windows\explorer.exe
  2⤵
  - Drops file in Windows directory
  - NTFS ADS
  PID:1984
- C:\explorer.exe
  explorer
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Checks system information in the registry
  PID:3744
- C:\explorer.exe
  explorer.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Checks system information in the registry
  PID:2416
- C:\Windows\system32\Taskmgr.exe
  taskmgr
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:2180
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Checks system information in the registry
    - Checks SCSI registry key(s)
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3172
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\Taskmgr.exe
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3368

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:716

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4420

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3792

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3548

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3016

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates connected drives
- Checks system information in the registry
- Checks SCSI registry key(s)
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:1140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d3ffcc40,0x7ff8d3ffcc4c,0x7ff8d3ffcc58
    3⤵
    PID:4524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1964,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=1960 /prefetch:2
    3⤵
    PID:4528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1748,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=1996 /prefetch:3
    3⤵
    PID:5028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2236,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=2400 /prefetch:8
    3⤵
    PID:1600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3068,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=3104 /prefetch:1
    3⤵
    PID:3980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3112,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=3156 /prefetch:1
    3⤵
    PID:2332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4412,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:3960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3480,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=4552 /prefetch:1
    3⤵
    PID:3352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4720,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:3116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4880,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=4912 /prefetch:8
    3⤵
    PID:3824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4872,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=5048 /prefetch:8
    3⤵
    - Modifies registry class
    PID:856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3660,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4608,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=3096 /prefetch:8
    3⤵
    PID:4332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5052,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=5048 /prefetch:8
    3⤵
    PID:476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4584,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=5080 /prefetch:8
    3⤵
    PID:4072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5668,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=5680 /prefetch:8
    3⤵
    PID:4884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5672,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=5692 /prefetch:8
    3⤵
    PID:3844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4436,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=3440 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:1276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=2964,i,6697584425348736050,4001345193030384654,262144 --variations-seed-version=20241204-050208.777000 --mojo-platform-channel-handle=5072 /prefetch:8
    3⤵
    PID:1344
- - C:\Users\Admin\Downloads\Taskmgr.exe
    "C:\Users\Admin\Downloads\Taskmgr.exe"
    3⤵
    - Executes dropped EXE
    PID:1380

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2720

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2672

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:3688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
46b257e2db3a3cab4fe4e8b36a53c612

SHA1
2327a773bca75530bc9bd7c74ef0ec3acbf99adf

SHA256
e7c310337da9c0b11f73414f116c230092a508f82fe7a57d2fb80a16d1d0973f

SHA512
6c9cdbac647aa323073edce54767cff14c7d54ae4b41034980833ccf8567d05985fb9a148772241f9a070622951af71e0cd943dddc1bbf445dc1c217393855e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
3fb41062ddf135dc6ae99bf14c725d23

SHA1
6ffcfb592a42e22b4ba0d13f78de0d0c045e0be3

SHA256
29715972761c99a13e14fe80467d49779455fb8fe49518d291e2d89f0bedb9f8

SHA512
a7d4698354555d699bdd79de9d603b34ee98686f5d7fe597a7552b47c1d9625358f68bbf582902d09e9b64279d80e2c69b40f9ed1e6ffe78e9519864098918e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
500cc3393fd051943ef96af48dd425c7

SHA1
1a2c3a476f16e06121989a6d8b13a3d28c62024f

SHA256
49d5a4336a236d091e350a2d5a071fb046b04d4674a41a90957bdec39a934b66

SHA512
0815c17068c727df6c4473ad06fc9609cdfb1a09b5ec69476cdc0b7969e8f1b236431382e7de74bc173bc5d61582465cdf4996d0fcc2f614025330ed5aab971a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
53841136143c29ba9e925dc919a139ae

SHA1
a6083ba8d4363f8f813328c57ad151852b7fd345

SHA256
5a5dd94358e380d856c9489616ce0b7df9e9a579e03705e894dfd2e86aba1194

SHA512
e4355246c387822b3eb2365c211146674c198116b9834f1cff867a497c2e3313d957710b9f9f7a36bf216752d5eab3496a53fb973a60e0ea4becebe2eef715d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
b846c8f13007202b4c3ac1aa57338945

SHA1
1fc1bb673cbd9b168c4dac7446b8eb388c0075aa

SHA256
bd0dfbf234d2d868bd4b08656951a544c73ad5bf9805ddb25657d6918797c233

SHA512
441970ab73426cf43bdad50d19597f13140b01c865cdb6180e09f3d86f090a8889079e8c7a08c63016125f4314802f00f9528654e413d328d7b26d9aca81e55a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
821b23813c0873478933c53e42993375

SHA1
712805f024fa65f8f3b6849cf66f87a31bc322b6

SHA256
89841780d56053a195e2532c314360bfecc89d8dc9cef9a86be4c6a91be00645

SHA512
f0659835baa573a592811a87438453fd08ed39160c174565b2a0e00ec303c86844169605d931e981b5d2143cd204b3298a4f96b1d9c40c369a83cac1795f25b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
51KB

MD5
f61f0d4d0f968d5bba39a84c76277e1a

SHA1
aa3693ea140eca418b4b2a30f6a68f6f43b4beb2

SHA256
57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc

SHA512
6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
234KB

MD5
b7cc80cf6cffdcfd6e5a7d09fc08223b

SHA1
eb2edf4b7fa484cadfd423716eb732eccda09c48

SHA256
354f7fd90a28a24d43c7d4fdefc2f19fb23689eaff8bcd5b1bab8e200990364a

SHA512
e19f70694d2749e3a924387a2e4e94feb67a310ccf903bb551bacd2e158b91a2d5505ed0491387de543e3d97a8e90c118e10bf4c3742e30be2dc975b42767dde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
200KB

MD5
82e2d911c80733c861b34bb96c544d00

SHA1
bd465980158f550f09a267e1080e2667160df8dc

SHA256
10752f54f67f407063b15316df3169e96c3f182448e6ab402c915666b4d7d8a1

SHA512
075d9ddb4388a8e1055d80c87cbca57ef02f6d3ea30bf236c98ccfd15d74e8bfeff6bc5016a5053de433e3d823a59c166a3caa4e945924ef4812f331cc379811

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
20KB

MD5
5cee8d6e93e34dced757fefdcaee9a34

SHA1
5524fd22bb858a62ab4e8cb8edf92c9f616e892a

SHA256
f32765a06218e73000fdcc932a1c829850819dca3110a590a76355da8dab6ff5

SHA512
6848a3c0793f06ecf3fb61153cee7da62a5a4ebbd59ae4537bb3a8a36b40e369df8f4ac6f4c7a84ecc43b0d0e45ebb8500695c217f739a447ffd8184adcc046d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

Filesize
83KB

MD5
c76d791a2429e10c1d73ee79f6bd099f

SHA1
150ce19039fdf4ee36faef7cee9f866f6ce5300c

SHA256
107faf51515d39f1644029c70f851c962e1ad2fab3b3dbfde8497d2dc1f92e7e

SHA512
1970aada3f7ed80bb666f729f2ea4409725f0dcee34bc93af77d872c3688b7059216c1506d1a93946bcab1711ea7a33b8a39406a2a359667d76c34db1a19212d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
38KB

MD5
cb5a611c29e54b35700e15ee1b2b2324

SHA1
0ea9a7477f90bb5bdb5be8462ba84bd479cc62da

SHA256
f728e6672ebc5b9c31aba1caa0d93bbebd3e210522d411956e99f24d25e70b7f

SHA512
94e0fba97ebe61f099bf2231459b484f2c358b5a94a4304be70cae6e7be52af007d315f4da191d169e02874ee7624a74c71e0eae879228680e66092e93f5b657

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
69KB

MD5
1a351f75a5102fda72c691050864c3da

SHA1
2847b46711e489089e5bd878744985f806214528

SHA256
0a5b8b14a9d0dbeff306344f9718848158af97f80b8679993812f9264f191b2d

SHA512
799e790abd22182352fb28a6a128557a8f1f788763919829c2fe07d0e736f59363a7a6857347a052997d37f7ba7ea6e9b1862c7a8614bfd4a27c94ed3006880a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

Filesize
38KB

MD5
6d9b75a291598235298cfd81e16dfeeb

SHA1
5416b88cb7e301775e3bafcd77178f037081a94c

SHA256
5c3f13720d81ad23217ac20fe7e94c5b2d43a2e5781d64110323479016d07bf9

SHA512
2abe1df30e8586a78b972778d7e37d6d3967973fc97eb879b7b5b1603387eebd88c97a7701a38ef0faa19b6edf2b512f3e5f92f81600c1671f3158120f4ad00d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
49KB

MD5
f79f2f844ef06af05997235e3248619d

SHA1
32aa08b48d142f29faaff08b6c93b5b66a80cc1f

SHA256
c20139341e758c5b6443b6a8375e6bd8fdb80a188b050544a8cd0e3e7713ce11

SHA512
2dea94563a5a635b91bf65990dd692045c7db92606f971e631603427228288256458f7d8cf4d63b0acfcea62fc3e25907ed2d2ff099a0437881150e6ce0530f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

Filesize
33KB

MD5
1aca735014a6bb648f468ee476680d5b

SHA1
6d28e3ae6e42784769199948211e3aa0806fa62c

SHA256
e563f60814c73c0f4261067bd14c15f2c7f72ed2906670ed4076ebe0d6e9244a

SHA512
808aa9af5a3164f31466af4bac25c8a8c3f19910579cf176033359500c8e26f0a96cdc68ccf8808b65937dc87c121238c1c1b0be296d4306d5d197a1e4c38e86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

Filesize
21KB

MD5
ddae8718b5d50d233dbb99c3a62b77ba

SHA1
ec7ab12dfd2cd2b325e2fa753dc02835582c6969

SHA256
1d7e14c2e4e2acef8137a4deb209f6ff50bf0aad03b845f6fb61b28bde90cf44

SHA512
7ecb12eae48dcf9efdaf6dd9dd3bb55699306f92d28530722ce4922fdc47c140a501bda8a2b141946e191a8f5e03edd9d3bdc5831a976327b94c0255657ac1be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
25KB

MD5
ab77c85aab42e61d0557bfe285bcafc0

SHA1
ac4241859bef658513fee5ae997b08543b8029e8

SHA256
32a74d447d992c99982a6c6979935c3eeffc358bcbcf7b1843ccb8021523f398

SHA512
41aaeb6c514f1ec1e97e213739ee2f4cd731cfa17fc1bd2c0c2d6197eaa487ed4b57c8d359ddaabc8764db4e12d3000eb2e23f884aa5dad0962ee9e0ae1d02b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
189KB

MD5
3d81751f00042ac5937dd738a7725bb2

SHA1
9d77e8a14a281507b14a79b16e592ad10088958e

SHA256
4881bc57ab84f68e9a9685db9231810a4921ff7634dacd1658e56fb58860c419

SHA512
f9a519c164b134410bd34fbeb9ebcecda8a4288bdcb8b967a5e597c7233c293f990e97784776ede534b806665607770fd4a4520461e15cb664cbcdfbedba86a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
278KB

MD5
1be9690eec92f959bea6a8f783411234

SHA1
336f3d93e75dcd3e821962e79d802b2a19a19913

SHA256
b5ae26ec1e93f06bfc2fea5c98e90b643196bfab11a22276d8003b6f5d4b9d19

SHA512
246be670f425dadf36a7e3fbd10cfba7ad693be77eede63eb8a578bbcfae8447ef953ec95024a83c599eb2bd364cdcca46d35a4c25b2197556213dbf48795815

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

Filesize
341KB

MD5
b0d148e201525cd14869f5f09013c10d

SHA1
bbb3acd46e08731c0467842b896f7cbc401a5bf0

SHA256
8b371d0d0d645145ec7a5f0b0ec97acfd3ce72280b17acb1e70c728865f5adae

SHA512
7c3dc409a3d2e04cbfe66c9f4ca69cb09f340910bd938fa4145f5cf56509191102772b73502ff69342575dd6e6827fa21474bd16460c16556156c5c822aa0464

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

Filesize
34KB

MD5
2c2547c6479f003e153d1567467163d5

SHA1
d2206ae38746fd92a667e47ba716f134cf6965e2

SHA256
49cbe891100b065723a5658e26a0fd1b956635d3f0fdf659397656853bbecf1b

SHA512
c241c07b44344c50bda96df09981b1055889c147d19242b8ba827d0b6ffc438819a30de00b4581b0cc98a25ebe07d57fb98ba81550bbd7ba5f8f9d91d087ec61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018

Filesize
219KB

MD5
6ae0877a9d730b79d779bc1615430c5c

SHA1
8c33ebf052309f72ff0027b08d9d0081a08c4fbd

SHA256
189c553e66fd4e11ef7c8d2da298d5f1906999ad722b01e8b804c8826dfcd459

SHA512
fc2425cb767899ae9004cf6f84c590f0ff6fad76b773bd5e598c644665d4f43c036bf95c324bb6e61f5bf6407e2731a974657ef5a195af3013d14d5fe93017c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

Filesize
430KB

MD5
4f2bc80bead26e69e073ac4e5e6e491c

SHA1
513f0497bf80db617bd5276427a3709be4bb9f55

SHA256
f812fe6c720e2f637cdfccc4cedb31523ce21c6581f4c3deaa00cf543039282a

SHA512
4abae803efc83182a5324033b73633a0e1685291c212f46b14f9aec7655b960ba81426b2ecd1c9e12bca5f4b468a6abef8458f749b1a89108ad6b6eb9072b053

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029

Filesize
43KB

MD5
dbe709cd454a295bfa758f6df2915e16

SHA1
e68cec61f6df06a4dbcd57d3c805d1e307fd3749

SHA256
12da5e16473f270e2744790e39f95fbd06aece6e1a2a5d2968823119912de798

SHA512
2b65aff85759cf38be300b7d6715334d2f34f12d4af078f3f42e253b5fcd1fd0237d4134ff1127c9646728e7263035a7561e22691da460fe4178fde677f65b5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000083

Filesize
71KB

MD5
b49d36d6c3a759e3592dcd3fe303bdd6

SHA1
13f70f3619b71a01b26d8a7a31618870994fc53a

SHA256
a2a41811ebeeb81f10ae1f1512e1c1b39b8386f9a9d28510226d638dcb46a6f3

SHA512
a65e1196ec0ca3e3c884fd99aa38a17dde21491b52a94c2cff2a638c81acfe281ea619e39d9de1097cbea085c6eb8748982a50b243842e7b860c08561a83d354

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000084

Filesize
94KB

MD5
aa9c146be637c75a971f458edd0dca88

SHA1
5f672821c958843544731db0f0e89107357a4d73

SHA256
c3a8b1dba5b547303785b61a4f495797775428583e9a98e3f213330f9432d01d

SHA512
269db0bbbc8d45dadd19e0654120538def8a1ffe6b55d9829602f3e29f9cbe631494c06d809f79ca032399620731ea2e0252469fa530ff72e8106cb6a00a8e4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000087

Filesize
228KB

MD5
bf6d838dc0c08863b624258fb1ee53a3

SHA1
92d78cb9f36370ddbda3e0ebc293e43fd56d1f75

SHA256
5b2b444997f03782b9f347a3f9b781ee32b5488790cc38095f67b9ae1e572d92

SHA512
6256a48e77e8dd60788206f79a290e79274c0213ed32c1506a3439f9d6295428905f2c4871e03cd39b7c4dbc5f9cebc9adcd8ecf908be5ecb66dea529020e415

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
281896be026aac1a241e5a3618e00eac

SHA1
12e80e8d0311f9ca1a03eb8b1950984d3ac3c3c2

SHA256
79cc66f03a6e432699dcc7cea959c6ed6349160296c87c8c0a0720732c8d7678

SHA512
1942933cd275f86e786cdd50c7e04217c9c3b88eebcc87654d103ee21dd14d194753ad8d5d83dd758ff7e150b04d4fe20bbe34f25a4edf503cff04aa68f54226

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
ef931079bff4296ecdde921e7317da0e

SHA1
68104d08c7e65e6985f634ca5f3920c30f5b7aad

SHA256
c2986030752ec25089bbbe6a4986b100c72ef0de7ec1a26fcb0d49a1d27fb477

SHA512
e84f3682327f04bbbe0897fbe7c4bd49b8b1931e46b5265e97a84766454fe9eeed32d2b9c6fc28ec7ef3f9c8ff3b74e1c8251364c9c341cadf6d009946b7f8b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d204a07c9eae9eaa9de5323aade7f128

SHA1
d35ef07c96913f558fd44eed4faf75c72915be8d

SHA256
07dec04c5c4d50a0e3371639b219603b71af372b5a8a802f8fed6943a9ef04c2

SHA512
da438c9b4999d504daa9e11b3af2020f8f87320d3b83041d781519a6ad9df015204c0ffcb313850a99b1b3340c882e21c88ab87dc27a944524e82e6efc8f4057

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
e8243c10f52a561149520583ea308e41

SHA1
560ef65fb83d723ddc5c8da3048fd709bbbc25dd

SHA256
8fc1312348f1992998d01d2d334d317a11e94bd8272c7e84d80f5c4624becad3

SHA512
ba0683cdf226f8ef12d959137a019b498bb5684d520d0de579d44c8506676a668ce713a3c49738af48f30e30053ceb4d217284e8dc3b5d2720ce96b0fdc4be49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
6fc602402d76fcb8ee13450abb39b602

SHA1
4bce045a54607b1e8baaca7eb624fdb64d5f49db

SHA256
2fbf5c1b0148ffe9261d0ba374767e45c574a49d15620fbfd4d18b7a9334b3ab

SHA512
d693415d341c60b5b8e7c1caf26a60ab4964048aef17a037bf285f270b2027069b8bb0e1aec4704012cd3b8ed6989a28a0ee1750b7d1f92ae0d4ce7d109bf81c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
3d128167d2761eda23e164377451ca50

SHA1
9b2a103e1dfc8780d4d1c5c968ed792d6d68c798

SHA256
86a82636caf5399f08974a784992fa01515d4a1fcf7decd65fb0715a24ccf12d

SHA512
64c199c1752fbb4584bece7be577ac07bdc2dd33d252135ec853dbb9abada640ca3c190ded05240df5991ff5e2f796860e4d0e14cac4fd89284ae1933f37f6a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\page_embed_script.js

Filesize
291B

MD5
3ab0cd0f493b1b185b42ad38ae2dd572

SHA1
079b79c2ed6f67b5a5bd9bc8c85801f96b1b0f4b

SHA256
73e3888ccbc8e0425c3d2f8d1e6a7211f7910800eede7b1e23ad43d3b21173f7

SHA512
32f9db54654f29f39d49f7a24a1fc800dbc0d4a8a1bab2369c6f9799bc6ade54962eff6010ef6d6419ae51d5b53ec4b26b6e2cdd98def7cc0d2adc3a865f37d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons

Filesize
60KB

MD5
967f45c2406e8637a0316b6c18e2378a

SHA1
724068b9fc2dbc158b1addca37948018a41b4499

SHA256
1da46d635d06261a85ac1d9db246bd11514b972bae77b842438a0f9ce89486d5

SHA512
1a048d1227d195ed7016f1522385cdc7ecf74119b00ea9ac087a10bcf359a99c6a5bcb84529c6cedac38ae4e6353857b14bacef847712c2bdb6a180b33a324b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
256KB

MD5
fff14e1966f87240061a18df6ebe0a96

SHA1
0862fd89b9e92357eea2d3745ca27e9b525d15b4

SHA256
b53ae992490e49f97fa9ef884fc17fa187658c7c689fcf19f2383b6155d5d2b5

SHA512
0c0adb4fc845cb5a94281d7039f7d59a558747ba4cfc561c6eb6f4429b409712a4d9c94f25544f3e667115069a9c4ba31fd5687b9478e637ddf14c7884b0eb65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_docs.google.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_drive.google.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
56d041a2a951441b6f4b9fca47f78ab8

SHA1
26648082921d65c1d099b48ef8563a804cb5cbe7

SHA256
2b8fc47434d5858c0ce808acf0d3b3e3f71bfd286d7453afd560c4b4fb33bd42

SHA512
383aa1cacdb8c6a38ea3072451c2d5408d7b34896e780244ab3c284c9d50e30d503413f5a4c0bad013d74a3028def2765a539569252880b9bd19596b59ba1f1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
12KB

MD5
b1d820ee84034280433ce5300fbf594c

SHA1
1702119edd49b8d233217d04dc6d8037f403afbe

SHA256
c01d1ed2c389e4751429f61e6e70e664e131c4156ee4b19decb0ef101c64ce2d

SHA512
ef6df9b4b0db87e72f0c09fae70b47331825eb0dfe4029f2fd071c69d8e1627ac78c10efb2203f7124c254999f6f14184b585383d63c2bf3ad6d7aff5030a1f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
12KB

MD5
145c720b32b184d65bcd7831cf97eeed

SHA1
1d8ba57a2553bb1038b8ae312318bf6c116c6bca

SHA256
1d9b64d8995d402466a9f16addb46778b3d15ca5dde18a97551610caf6649c58

SHA512
70c77468494656538f4d083d1b5ce026948d7749db9c28d12b9382df9e6f5618c8a2e11d2f3b180a849cd9ff0dde348ed1585a32a39bdebc79655351e9b653d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
95adde1086ce2f6e800ed53c126519b1

SHA1
38755ba78f1530e6f0157e49dc00565e018a231d

SHA256
4a6227913d994a54609d284edf42a0616484bf130a99392762f86b0ef00a401c

SHA512
ea3c7bbcf00cad3ce724ea4465a250dcfe4da62428ff06eda84344368cfdd9e5ca7fd5a1d28db5d57c211530e45071abe07e697dd817819b15c4345a3e422179

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
d86b875ff897ebc4749a8d544e329e31

SHA1
fcc5225919e8fe6d77758c907541b3871d282639

SHA256
f5733f1d55fa67ca4ab93478fe7ef76ff2bdf40617d3472455d1e2143a373c8c

SHA512
9746bcc2c7c4a94f0e9718284cbed675ce00739fa7b61cdb79c2773ef34f8fb326fefdec304cf0d008b055762ebf3795a23dfb0452b26bf5c19ecbe2767b47ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
f5b2c2d7b9a284db8b1d13f4669703d8

SHA1
ecb7fb04e8cddee27c131806b2ec80a25d37bbd4

SHA256
9e7744540940b413e4bd858406783f19af807a54dfdbf03b9ec4bb6c8c079526

SHA512
598c704e2e5841b60f8e1e905464724f8349ce1791a84f333a63ba8f0cf00424378185c9eabd732151af455dd24d12b38d2325b616665dae192945834b7ebc84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
10KB

MD5
37f9c9abab1748e8936eedf0d408e2e6

SHA1
0c0e2bcf8c28677795001352ef420e132b474014

SHA256
13b6bd76298b5ad540c8269de467d1bc5f5ff3366d65be5d5678cff684ccb100

SHA512
b78601d3f25214dd8af2c70fc8b3d14eabbd28685493cec00611af6baa36690a1b620002db15937f934e6526514c80f8211e65549105cbc3920feb1662fe3dc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
132444b3dd2271627eb2603e549ae200

SHA1
a4ded301dd9b355ff204b769eedbe5f5862392ee

SHA256
4c57d7a0e7442c692029062219938d39ca784d543c375aafcc81841247696670

SHA512
0a7e6d388cabda21b89b85c6fe312c79f42665cd5c0629cecdd11b8746ff1c0bf97971c0d89d756112504b514c85fbdb573aef96edd95cf9e0dcc08e1d7ef3ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
6b9a73ba8c78f9ee053b52131a2414f7

SHA1
0c168c4a4bacf15d7aa50c875ee2751a7b08a356

SHA256
c7243f74f773d8e0369c4d5777718f9ba193e47f69d0958773325fb83b5299dd

SHA512
946d444a986fd7fb93742132bc32f390934e5ae736c3ff28dd7f3a867c377ec45ad20c41f6a26a07f117482026b7f63f46410f359ff60fd3ef0c757493513847

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
b7363fecead8364f4a9488209d989781

SHA1
efd203d7f3292ff1e6058d485f9109432899b443

SHA256
a214892bd989edcb754ce20493b3d8c3bb8fc31b76241bd1f00758cc4f222622

SHA512
8b32a48df44ab8bf7b97b44174a2db14e4809474c19c3db4f3b53635689326035d7474796d14bf3de392701c11780c646f374d2552863758fd234506d1aa85eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
e9a85612c361d91fa31acb652cb36904

SHA1
f88ced4ac8a6d873a65e6faa22e2c93f6b44b978

SHA256
ab32ca08efbbc80de6232bba825705237590fef9ed58528432a6bf5bc45ccfd5

SHA512
0d41cf62a4fece00250a96e6904e64b11a466191145aa0513064b72f89cfcb49e5b698e55422d0dad12a7d3bf77bde81e5c9a86e31e610c4e97a3d571acc03ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
44b239893013c5be96e719cef939ce56

SHA1
3cd1ccf8d7b3a6d7bb2298d5f9284e0f10bffe16

SHA256
0ee99c5698bad82b39ed3cd2c1cd7a7311fe98c0b9289417c2b428fd7fa9ca66

SHA512
2c4d29e0e6461ddcb14f7718feebd3ad12627c0383003b66dfa2a1695aeaa87b64f87fcb98034db2ed71e0673277aee80404a2eb660992c4e654c8f5997f386f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
c355d29e83adf6db398eb39863aa2853

SHA1
76490af2bc3b1bb699fdfe1bbd00af605d12926e

SHA256
ad16fd406d83c68d1410a92f363c075759be2c998dbc590d61720929a9292d00

SHA512
10b5f75a68686415e269cbef4308b4bd1c57b2248f6f956eb22b2f4b9d0620ca495ccf5f0c5de3f204237637bb83607f4948e19485f7dd292785f3817c64c3e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
64dcc233f319a513f438ab82bf657c64

SHA1
5560ab4fbd73352d38087d51599a5ae6e04f0347

SHA256
16f038e15ca267da657ad61e60e0ee3f5a517b715a6a1cd0195cae1cdb48dd8a

SHA512
3d9dde4560cbba2c6fd562e008a198bd9fe760177fbc6a0e0121fab274fd6bd381bac39e4347b1ba7da64b630e3e92c7c3a427ee4490cc6ae36ebb872d92f6b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
bc76d0bdae2bad308b7d4c004cb03e79

SHA1
0e705bf5a10088290d90e37446dd4e206b55d317

SHA256
b66cffc79b7e62832ec4889a3c61ef37b96c152533dc5ac212c25e6a9013902c

SHA512
30427bf0f3d94df45e44ea5b1526bab3fbfb6a7fbb4db11591a7296d13e8ec6250408aa82a21555bf1eb0ff8086350e7739a61bc7a65522bc9b0009c24d1bf93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
6392f101e4c544711395ad8f14a83f16

SHA1
29a15b24b7380d11767adac84bd76d7d3b2ea503

SHA256
deaedfd0f3d8f6f806c0a6f35b75d7f1d7487dc3ecb0c3a115c56392d4c5f926

SHA512
96213ce51ebdf47d89254565ffa4b11cc1645f36b52f685d02b8d49be7c2703625266523fe96c0aedaef37c54e257f7d9b966cd5a4a98011fa08461545f796dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
6344f6048765d9cce70efa047684d1ba

SHA1
7d18a99db197ea45d08c0169ecabd52e0e8c9596

SHA256
a819f2b03be8144598593c09f0a958261bd4ff39604ecd82c2508b853649e5bc

SHA512
eb7b1663b532156a8d9a830fd2849067a9a364f5c66f801c43b53c0bfe287d4057ec1f16b3710ebda02c839339deca4d7b1734b074a291ed12d9a7ec4b0c7327

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
d9eb6a52ef11cd86a574f9a6f083f69e

SHA1
69cd67defc3fc6047f31ab919711edc3b080c8c2

SHA256
56c8385b9df0c251aca04d18a698b1d60f5610d3e4bda7e2ec4d6ef6f98cab7f

SHA512
0bc6c3efb663d47e89e5219e9bbd29032382a8e6f1c4520296c3b5f01d71a7eb58e667eaebe849e44aa91f3aeaaad2c5e47f8d0a75468d18d06f0b1d59a712a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ad6bfa4b74a8dcfaf2efe03fec98d59a

SHA1
854f31f157275f03d36b9e45b3e92088a7fa3d77

SHA256
cc40a83802a960dd613eb8fccca9ab6cfaf91b52b31de6733692d9dc2c95a40e

SHA512
0c4f6d0a070a64f32707dce587542f0b9fd16f66bca1dfc88614d2f12f53c503220c16c9209465617fea6baa20d67097e5a105e45f993fbd2143a1eda5ecc666

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
7500157f03a09b0b6183104b265a7080

SHA1
97063022e72b4cdaa1bcfa56ded58003ec6c8016

SHA256
964296547869f94bf1b72bda467652c951329c6b0dd1322bd10a242ccb6fe921

SHA512
b11cd82ecd834a65c0148e008249fd0c43ec20d90717a6795b5a5d8cf03bbffa642a3d06b236a9cc1aacc07efec5f2be68e856e7567da37cfbf77a7bbc9ddd6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
36e02ed62cdde354b1c77e33a5afb38e

SHA1
24610d05d28b0c859fd5155ff81b27ddf00455f1

SHA256
85ea567f18acaa2421d35a9a11a2c667184ad851946f0c331a79377787e97a90

SHA512
b8e4f491957d011c29e6bda73ee1ca5276a83614d470fd13b05d9ad6f01e5ec3f26d7cf44921bd54cf9509510eb9f437531d93179c3f41131a1382f75858fcee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
23bb70aefb59dddb08fce70bd4710480

SHA1
5d5b5fcfda8a3950869914b59db3a298fb3645d0

SHA256
c4869194f41805fcb4f75e3e9558396b7ddf1a39408e0c99deadd0dfdb49d1be

SHA512
2a18bf22381726c7b236574923867a944ac12f5da5165138a5eeab797c24f3410795e8b4be1b5bd54005e444be8b0d2253c56d59fe8ff911e326e9dc7aa82a06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
07601c8b505d12e55a74bee9c417fab5

SHA1
0b6c03fae2041caaf137cb33fd3e20fca8c4dd16

SHA256
5ba0986dfbfc50e73184116d9c0f6f17035512580148bfbb3c91268f3422ef88

SHA512
7cb9fadc91c4111eff811501befca99c523a2d22d4ae2a970202d03fcd70b2fd8ed7b394e47d2bf7a425e1b07983aa5402b4aed44fbc0e2996e653648cd2c23b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a7de5d617febf23ba9ab16af6d7b1c71

SHA1
25a32446d5d0d0aa17a74724776eacae21bf809a

SHA256
665231900109845d65603d9ea40fb2aa0fd9500bfe5caa68f31b9a79cbeb35ad

SHA512
0ffbeb5912df8dbe50e5902a19e89a5b40fb8d0051c373b8fa01521aeda2c021ac287aaeff344764d8fd757071367789f41bdeaa2d0dafb13359bfa17e9bd4c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
9c2954b659bddd6a7b8b5c81d3d29edd

SHA1
96b212cf0cf2e27373bee20eb3deab2793b0498b

SHA256
727670dbd4546e27eef3819381178fb9ffdac8fca89ec045f7e8c2ed4ad06669

SHA512
965ae07423aa47f7f5b2c0fd0a7021cd6c9a0d088f9e35c51a5fe28a28845dadb47e13f670802c61a4049645dfe032453184fca85d66381c726cb5c42434417f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
ea409bdf89efe92a79371a12f12ebf3d

SHA1
9a0aaeb330d59d35a60bd4e8281286046590d2e5

SHA256
4b9a43f8699a0d1f48f42a80073d58e813fd75f47ca8a3745f22499d26126b33

SHA512
8ec138c38a95ade124b3c165a9bcd1b3cd1a63ad46bdc965ae2050b5bdf2193aed3b27a9fb896d475ebad6a786fa8efafd79c8fab2a6a41ac0025ddca722e5d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
5efea6ea8267dda58e8d3afe89400f47

SHA1
a119ed7c0dd45a76909fa830e4b1746deb650b9b

SHA256
ecb51cfdd31e57a86e59329d95bdd9ca55b171e3c3aec72eda35889d12de5bcd

SHA512
0fb90a8f11ea01aa3eab23c90427906f7fa51c240ce68e524c10d5d769e0d0559715418609e1ab34edb032877fe1f9effeee948daa7ee6ee4a0b6eeef22c9eb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
b8082fd0e3bc00a684dab4fbeb4df5b8

SHA1
c002d97fbff044bc22cb4e561a7cd3344ded2ccb

SHA256
12a589f3da37cb827ba6b5463c081d70867622479dc89058c683ee5f302aaf42

SHA512
59a266a0937927c491214aaab8616cab8bc16465f423092a42988376d9c3a60a6a678bc9dce3e1d2bb77bdc1b19acf37b5559ab0da3c9ab6e19eb2593cd4b32a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
49c4aae20bfef1b92bcb1c208046bc65

SHA1
64459a0e9ab30763267330b89c0a90bee21e8985

SHA256
4cff2e5bfdd033f50822c907d6e6716b0f45cd29c4b3a733b7dcdcd59b4b0f47

SHA512
b656950291625e428b50d5b0ca0c160266709c9ed84f1f69a0fe4c0d255e5085fbf1c8e3cb5354ecc1e8f92ed44dccf98f32ff421d9fdc48c34d0c059dd7f194

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
1d5c5920b65700c139b0d2195546aff5

SHA1
2c53aa5e957106fb0c3be6ab89ab498049b33865

SHA256
c671224650310fdf07b62e27d0a0f671842fea0da6747398f6b53f365131a83b

SHA512
bd21ae459924917e4a4cb9050fba95bbab5aae3e1cea5e92dd9a3ee10bba28cf1a722ccd55720535e8237bc6203d4b309f6bdb788774d4218cc22a2478b6f68d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
847044fffe5566ebd23754f1f2a985b0

SHA1
f4cc4276d91e1fab0c61c77f49735a721222025c

SHA256
c63b44cdba92561e7970a22742eb83a4071331835c8b4261396650971a5b3205

SHA512
76c8ce2674b992b79d2ca668558a824190dac5012911968a291822c67f4b79a77d8404adc6ff054aa3527c09f663e0a6b4d573d8608e667b4de4f599a1e55d7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
6912b774dbfcf83197626431eb9b4826

SHA1
d4392a9bf2dd4ddcd59c99c040e35cc77c4fb03d

SHA256
867954d81c8cce18ce40f3196824d7c18e23af5cc8738fc64fbd4ebd90550db1

SHA512
c8a956c24c7bb25750e01310590ce6c19ee4937cb7b2d1c41186981e3d434d34aa896c7adc1b3d87c8d019b113ef18e2be24c6cb750354f133a17cbd7933a509

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
ac4d8aae1826fe29b615084abe75f95b

SHA1
2dacc904ea6a08abb1ad7bdb9662d37839c193f0

SHA256
882aa378a16172e07643e57002c9817ec5b666a0f2cb540b217528344146a83e

SHA512
17949564eaa8c6e38105fe50cbc65343a6d2d4557c756d205fea3f62ab362c4d57e2924fb262c5734b26850762a60d07f8a415cb63ced1e87a7ae005f137705e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
7a380e0e31e35b5e21149a6d5a546f2e

SHA1
359fcbd01f0866d9b0f1e739ed9e0f7c31562d88

SHA256
e6808f7e4bf1a8210f1147ed0539fd3a39d81620f9f718fa7eb6fcc142d9d0e2

SHA512
ddc302394f007df858d8f7f711fe47fbaf9f907a56a3711736db44f4b45b6b66652809b8cbcce349866dea6e19c66fb4ae636988dfbb4a19daa0e907d03443ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
2f87ea912d360491ce0db72828e95789

SHA1
b75771c2c1757318fa0fce1670960de49d3b9d5c

SHA256
2dbf8abadf9ca11fca8df030f0f921660636cd6121dd1ecaae424eacc4ab42d3

SHA512
08aaead51739009bbc0f3ebf00c5aa5bb97cd5ddbce5ff4138eaa44f1a115fdb651ee5fbfcc22300a24503b8d33144daef94e11c0fe7aa282f8632f8a44005bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
cd1489cc737bb8f280bec72563cc23be

SHA1
07dfbb3bcab11f2d4079a66dee16583c5dc2a473

SHA256
b75bb9a8e8da5e53fae9e0c9e3cda426104d4ca2aa08f5302521cf91e70d8bfa

SHA512
347100ba5ba960fc86c8561f935d55744ff4efaae0d3e0e0f2a7dde4917ab16f02fb3beb13293f491fb66389deba4b79ecd0e7ec9b01cb4fee6753c921903caa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
cf0ad568638712136087e4fc02640c6f

SHA1
8c465fad08ae200c402c071415807de597672f53

SHA256
f7cc7c72755b6bf5181ef58da1a653fe8392f1cbf2a9cce1c0034b55be673d53

SHA512
33ef4df866e40c8c9dcedc762b36adfe26fa9d30725d9d1b57dfe91c4467837cc040e26422ab47359c06435f90b2f0a9ffbf40b38b26f6cb1745a06c6f3c47c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
f6ea47d35b1cab1ca3da8e32a29bca8f

SHA1
1b1dd4d9b3b91ad85278d4954583518715a2a847

SHA256
a74254e9caa2a05bc9283db3514caf54df92933a3d868fb5e2d33cc2e340cb90

SHA512
e3ce020eb881082143e5955f624da55b5492e36ce9d825c1f232c0b739479b095bca4e3e54bb0c25a99230ccac7524b9b33346e771a482fa45aae90d68240fdc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
1acb43154b9fcba221f6db457d8195d2

SHA1
0992a636fcf5a759d782d52d0f6804062ec48892

SHA256
b2f7e0438c3f898660d69f104ae55e5c48b4bb84fd8ab377921817bf550529c3

SHA512
e9106a25781c94963d0ee7395339fbf66a35dfa1ee57f6d014799c1183f875c662341e86b3c1596200d1bedd1178982aa199564179372ca028bc90584ea9092e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
bc4d89e08bb452f2930af044e77cf92a

SHA1
560ef874920c19ed5326c957594d8a2d69cf1693

SHA256
fdb1b2db90d39ee60aff2bc44cce43a0f3653f6ca47205495a6492f0a819ac03

SHA512
69f3e90c945836bb56be811f4535e3c398c793a3096d41d21512e6fe85779ec87a1d1045e829444d1f6e5f1e28027bbb2f402fe575ee1238e6b362028c0e4f26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
f5a1014eb5cf71de0fb6106856ade58e

SHA1
b65ec5482ce8c8de84a2ea762e4f538889d4e5d9

SHA256
e3ed0286c6e7813fc4422b9e49500b9189ef10db2c405fe8feaedd9742763f14

SHA512
fe440b1fab6b6a95dd3d833e69352a900e7ccc9474d0b03d6af7d69e938696b26417c32dc01d19757137ae9b0038c7c822b7d6ac1f6f8aba007df87f01cd8690

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
7e27858193278acb6516a4a89ae4d793

SHA1
727d5a9f9874d16ccfe0f0d0444fb4cb31514e44

SHA256
a5e6efa24346bb9b3fcae3bb9d53be702019a810c0d568b6e58273a78475a974

SHA512
02d3928fdd3e383fd6dafe9bd44b94162d4f53f5c3c71b175ee2b2e2c4368ef195803ff61c6f8855185adf9e5db3cf6615dad2c89d4ad3b5e9ebc2debd010605

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
e7e1787b30850c0c9256212c4d5d18c4

SHA1
6189b80138e03c71e32cb33f6c807a7714c367a0

SHA256
a0c8ec4c998f7332ae4891593918bf44665fe08c695a6e66c194e6fba412d0c1

SHA512
8fdbaef342f8597e36d74ccaaa57fc4053d0b9403fc18e13d1e865a5f001e5f1b0e767548631a4004d0c25d6b61e482c7864a3b9946366de4e0f9811c2e7c033

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
670ecdb7c86dd935cae4c8e43c9a7333

SHA1
2100b72e31ce312ac1df3430727a93ebab930337

SHA256
03cc5f0b93cd723608a30b02649c5cf773c09bbced096a50487709387fc3f6d9

SHA512
d225a99d808684db08c20c692e18d23ebdb3cc70d4eaf310ba13fb75685ee1876cb6c6eb57c2f39b493048933d85f0a2e93d21db4d8816fc39c6cb9b4feee99b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
f108adfc7aa3726360e9d713c65fd2fc

SHA1
c9f65cf7ca1e3488aa7105f2f2ca88fe8cd635b7

SHA256
e96a67b06cc06eaa00a72cd232ce8fa28ae7e0d2cf174ee14e5f7d32b7756466

SHA512
d2921b7e21c0f3c030a3773442741b910420d567ab42fb4d88a4cdb070292f7a23cb9e191b3056e0ac6d56737926b15578b9ed1ac418a6dfab21b9e644da5a63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
7294940b71a4882e0171d814170eaf25

SHA1
2bd233927279ea92df4e521bd6c64a9f1d4b021e

SHA256
49b8fec9db5a309eef064d124b0414828f51aafccfa0e90ca407045cfbee7f1d

SHA512
d41639dd3b257c4b48d1dfd32e5c26872676367a60bc7e7923e469d83de47ac4265d19ab9ee7cf5c6baa2bc4c1159158c00787664bc84283e9d6d54dc1e81c59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
e513e4816a409eea4be390c82c214846

SHA1
a0bbbd2e1d2b92fd81b86164b5226c8e2bc98cb6

SHA256
1c6d348137e4df2ecae77c1c72c2766946a9312500f7c96c063b56a153510755

SHA512
f98032d7360b18eca7f84ba7c0466a87897e544fe57d5dec6d5fcc0a018181eba1155080210a2b15e567a1cdfe7ab3eedadca11ec5f7fdc4b1ed0bb74364d92c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
aedef9e209e9dd78a9b3e11c711072d7

SHA1
ff22da9ab50dc3415dd622c97b88bd1b4ec22b5d

SHA256
7f35c73f76f6b6b6a0ad47b680f58103f3b34e1467f45970607357f709aa1a98

SHA512
7dcad876837a2321965f9059815697827fbcaab6e06d66dc4388790fff408ea27153842ecd1dd99caca0c538a45161dfdacb5cba98bf72982c8c965300e99fac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
6850ca55dbc0fae8379fcb2c3c1ac536

SHA1
1132a951586ebf88fc7a6869009373032b1dab2f

SHA256
e48b8d2d850ec60e02b45c35c7b612de2558da7237f4f7b00bae535d087cb3fd

SHA512
5bcae2b8ef2c808b73658403a20cd4958cb0bbcab052d30ff45bc8ae9720bdca2417ade91b8f02e1ac2a56d7953672f3cb79e092bf28ac0cf5636826d8394948

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
48a4c81c2e79ac63eebaa6a5beac3878

SHA1
53b71487da6a704b494ec7b22c47932d86644e4a

SHA256
7ade65a10680417f0384b420af4d813d41e337a8741576b390518c96667d2d3f

SHA512
f62735068696070f98fbffdae8058c6ad487d1b78dca954ffe64cf7b1994d26ba467c9f7e7eebb168513478554bc403c6254918a90ff6a790df34204ae73213b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
e6de4040e06c33ba9c018122d169c6f1

SHA1
b988255734dc4c63a0ce8914f126588acec60e79

SHA256
6565ee60dc4ae01d4106566539fe2000f495cf33e5fd07b54e467e7217b2a4be

SHA512
1f8cd31e577a683b1374138602caf398a4520c4da7d80aeaf251621ec14f63e12984b32875bd10f3d89ffe15d0d61889dbd8fe068d3cf2492c71d75041770099

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c9c7ea150869d1db784b750ed9e1c6ca

SHA1
b3a692b8eb0d54775f38e7ba93f6368e789d1412

SHA256
a44fc64389f55e48925f656e64fc76aabecc87836bda810a3a28c662115405d3

SHA512
b719db2521d5d6f64882dd0d76e098edd58d552fcea19fa79019e2e29d9c5e6c6f373e19f845cf6822dfa9511a15300fbd76a8798a6c9b39af44e7c6b452348a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
073d5db36de1b002c06883619297d737

SHA1
6f7a8467292db13f6d5288467bb43f9a0f4da147

SHA256
4a47181d32584454f03c491a3bce001664faed7eb4225f7d535c51ecc5ad25b7

SHA512
5636db942a652785f3df598e743a5d479c09e04b0ba11d6be6b28d3eaec9dc529228dc03c08ade8e5e6b4772a5ca4813ce23270bdaa531a384ec2b1a9deefd38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
3d60737181ada4ddb075de6d8f2fe1f4

SHA1
6acbfb8e98f0a35136ff8e78e02d461d1e5bd1bc

SHA256
02fd831472e29e563f6667cbe4f5dc4077132eba90e4d71983b62192b1442033

SHA512
4bffde1916029b715bb87fe1e0b075bcee0f2da95c4a19da406d0089fd13cfb9b19b713253444872a2223e2fa4caf1c02abb01f3cde05725fa16f8a738c350c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
b427c614701578582c84b897ecb406ba

SHA1
059332110e5b3ca44694f1eaa1d683673dd4168f

SHA256
8821f7bf152888c6e45615e7ea1f4e2199cba5e7b92fb73c9da70a246c00f717

SHA512
150b8efe33314ae6015dfa0fefca414db5d623ec94d979214180ca92bf6e9854f97d3cb640313c2292be9bbadf6dba104ee1a87651b8606f7904d5bf9490cea3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c1fe6a05639fd7f37cc59148077bb224

SHA1
7ab8b622a80bb8e5fd236138e3d2f85556dfd51d

SHA256
8e57c9aab4b43e3a0a8b4635df4978f96535d86167272e2f14f1fc80693d6b1f

SHA512
4ccea528d0f5c35761846e355647269de14aec7cf2556e5b6de23ee4f9e576a56341dc24c3479ad1164d673a139cb0d0507660c5e4b355ebeabff4e22f766e6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
a329e792e480548433b74ac69f2a0435

SHA1
3e82b24e6c3308f909e8bb303c7204d1a7500cf6

SHA256
43b72d9d7755d22f060b678ba3ef9cc0fbbeced1c0a40af86272cbab36e20f9b

SHA512
9cca0d93c81adce7b632fa4382b46ffcae88554b3a1fc0025ee58f4aeaa2c543d5b0d4c9cbdc598100177261cfcb9dc904473127eb83d5069fae74b61a461d61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
41dc42bdc2bfccb46ccdf5e33b12f5e0

SHA1
2506fd10089c2ecbef134cf245612e872e5aa842

SHA256
b5cb2f458b9b6510a0d32f3bbd629a4be8fdfb9667c27552a38a24da01305194

SHA512
96752dde8e13d0b8f2cc78f1228b636ae62845ad6e548fdd01ec12f6fb1790fe7685c7e8ae053405cb51c2f7f8faf328470c6d17964d54ab0f8fe9460dea8a2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
6eecaed35ee32e325b86d79dcd28cdde

SHA1
ac56b4fd1b61d2d20c6d07b6ad3cc634ac2406c5

SHA256
71e85f2ba8ccd18572c152aeee4cfd1a5dd3bca1099afb32965d6b7ded95e310

SHA512
7d450659cac7ca7a85e36b28fd21d89eee72524b822a2d6ee3fa0e4c22ac415bc3398199e054aa0cded1d3565d422425e5b58e7ae0621b6eba769e81c87f9145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
1732b8c0538b0b3a4a873a19b5cb187a

SHA1
28ed649957b4162cdcc62a6b0d575f051a8b5907

SHA256
f6ec8609d0e60cb830a154805ad554d0a36fbf3ec88ed56960b27ee367eacebb

SHA512
e09c642005853e7ee1261361b1c46b69093f341901211b6eb4b7eb6860364e75b20abb94862f82faf907b6ca153a6bde5f7b8d6386d84405c2da925b65fb6a9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
de4f07d636b544a3226d53a233195da8

SHA1
199802866fc8de510f495cd04f67f8ea1edb8bd7

SHA256
59e6faa7a37a2e480e5ff2824a73b89aa1ed4776559c842bf3246de89f280d81

SHA512
0fd17700b7905e19fc56e59b93b94647e94a633bb308ccadff211d47b3bd46e0d6307182f8026695490fb38c84f2e76a7a7e1db702218939729d70cd1830772a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
c7211e5257da869a58d6e29a5fd6d819

SHA1
4e63f1a77d411fd2d2d60417c748d8d1aefca590

SHA256
28d42fdf1be8f73231119e15dd7788c4ee0b735b1efbff29f76ef624b6e930c8

SHA512
b7c1e62b2318aea45e3e1a6d8c9f6d5f7f3f7c465ef39a6ed0d2b9de95209826d38ff14327f09db0ab957030d87f0578ed0c2223cddbecdb25a3cba0fe2a701a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
a7c14ca3b89d3afcc0adc0dda1570e7c

SHA1
60e68bccd650e4b55eeb1fe7f207c22446cfe73d

SHA256
76d06d1a8b183667dcaea42f71dc922a911a4b68a5b81781a2ee191d8c075d0c

SHA512
2a0ad34601c32ea9916afc81665d58064300ec02f02475e1ea7fdd0205e6a8079824d6b45e7affc957901ba043ea40d41738bf33b927ac3a77361c91ef50f057

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
f32cbaf34290219f852f3170d11d7811

SHA1
bebffc1d5c502fd25a451a4fe587e558b7548493

SHA256
31a894f55fe7524962f6ba13087ce3959b0602f81ffb84ea60801c7d37051d0e

SHA512
4c2b6083f6183281b8ca9f30dc6f404a20414fd9fc0c8924a1810827365482f9bb1f733b9fcb6016c8ed07fe9e551b7fb1d63661dace9dd4494c1c306ffcdf97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
9af59c6e05de9262c56a0c8ace235e18

SHA1
f5d4a4dc132a621e76870d0c7edc955b759928f3

SHA256
ca0a46f0e81d2f4871eb1fe082d84bdd819045756c134aaf440f8d67e3e6d0fb

SHA512
28e89c1ec334736bcd59176178d378d90be92cc10a180a13b6ea305cc01c66367acb180c2dbc886617e8e1755ee8302f6964bd02a06469c918de087a1ba131f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
d0b9d8577d0a82c1e6e7bc942370738e

SHA1
8361e7c3986eedb2e3ca66d20ec9909cbeadff26

SHA256
09bf1fd3043d5c0798debe70f7c42563e87a9eafbd00a3c5e011780f85b45d91

SHA512
f5b60145eab5da3f421b19002507c4329dbb08e373dbc4971afbc720d32318e5df0914a72a72bc73d3742ddaa14f9f06fcf0a6325303047cccdf60cc263067c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
3dbab6495a6cee69d18fe9f2da99ed51

SHA1
a25760ad7256c60c25c2c0c2f8e65d50c1ca1dda

SHA256
3d36bc682c875f3158c58f9d20424350df49cce5554ea48222c243b86276de32

SHA512
ef9ddcec5cf163156be9dafbbffe83d50b09076e453bc8cab16492b84c6dff910d4c56babdae7e6af13173690dbc561834f4388433312c5e4f05b3a2711745d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
fc87067f583f7aa827d1dd2b53767998

SHA1
70a78e30ba45054c249d3e60d0d3c9a463fadd18

SHA256
e7398d0e8244cf3de0455e1941e73a08fecd4f1d1b7243443ffe233b352d5f61

SHA512
7bf2ecb2f5c12a9073508511c0c89173b353c08b48ee06e7e17ff8ab5401b8b673fdc096eb8fb7ae5688f650bbf893a51edfc6d84036fcc22f3537f41d9975a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
76a3ba55ada7744cd6b682eefc8ab79a

SHA1
90e34539ceed33feb5044b420a45ed75ee890bae

SHA256
5a4d31654004503bbe332ff27623a6cff5a58ec4b0d9c9c29c3591d5669e9035

SHA512
277f1b8a7307ae803b53830ce03f8d1f4e61ec2bc6b5eef5b473f1da4c304c3a36181be7cb8087c3a133c7c0c973dc3d4418b5502d2a1ed78f34d90ff290ecde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
a4cb99ae87fec20a21b9dd839ffca19f

SHA1
eb1ef08b231623036cde61cc19ace8ceb634aa7d

SHA256
95878ee4714ab45ec7bce0332561784973e8abf6b8757de499ea619eaed23145

SHA512
8e89ccdfab494de880c1660e06ca742297d8a9ec3e5e57457d9645f2c82b879e174671b6634065fa62f6dd2d355e315df5859a8efa70aa0a8da044623034b65e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
b3f4f6e6acead2278d652dbdafd3235c

SHA1
50ccd3b913421a817a3537535b7fa1dfc3bdb42f

SHA256
45b6d08bfc0052e5fa36bfb4e79bb05fd7d6e7c0be049f1b833857c963278218

SHA512
18683497d6beeb35f0c1c2e14e8edadfb80aab096f64259ed4bf2baef97ea7d8c646961ec6fd16c4deca6df9164090422f333708b2c326e96e5cc173fedb7700

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
e990563cab74d14daf8fdfe24cc61b89

SHA1
6a470ba27ce9c1ad949cb6ff212cb7163c50aea4

SHA256
22ab496034a8dfa1f6a0793191b646c32fda70e9623329ed19f43b2b48d1d076

SHA512
65fbaa6536603f5e361fcbba5ca3b1e9def8f1c0477a3c776058db990bfb1b61bde8d887284f7461ed788edaf440cf5704f3c6a36418cc0028dca86b300e41c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
b88f3bbf06e88051aa695d4b3ad03944

SHA1
1bee6223010e8a383c0aca7fedca19dd10a7bce9

SHA256
e76135cceefc3eff07f2b2dbab2e3fea45c8b73eea489f873e99d3d95209ac0e

SHA512
6676f26c179eab88a1c7593e0901bdb0785d75c22ab570e3344f56c5ac3a74ece7877ce206aefe0177ce10cfac2832991f3bd448c59828f2b618caac13b8a0f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4b5bbfd8e2dfbd85638c3cee25e84098

SHA1
288fcd1c0db2e5b1f949b930187b43a42136c89b

SHA256
24a8d249e0a9d62fe8ca6a30a8c87c42c6c0d490f7a11b18005e44b69a79aca2

SHA512
e1b6e5dd91f76cdd75a9aa4366f6e2f7c4a1535d22bf0db95873feddc4dc274d56ba52b82ffce20241d0d274228893352163d17f0278c35d728a6ef9d4d81242

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
e784e1bfe4a0eb8ca8a1e7f7e412eb9c

SHA1
8006159ae0d0f5620dfe25eb6a00cdc197ee0237

SHA256
aebcc27e10faae36a9c3875a534d7637eede8f5f2efc3e9c1dd379b45268a495

SHA512
6837d55609c1d3e395ca442038acc764478309b00f98cb17f9e9fd871a7818584b76fc2901c8f99945a98dc67256f01a8105dc5f08b93f67918e513d7635f8d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
a1d5af4a47e56411bfea56b322fa3a0f

SHA1
3d66d1b81fdaf052fd401036d03eca926961259f

SHA256
3c96af87b736d3cf1e93a9029e56b2a238db1b37f7089d97c5363a958fafe5b0

SHA512
7c11c32657fbbc64e1515e430b2a543294821ad59b6654b10edc531fea790faff214546736df35fcd32d883ea1c62f039d14724f2d6c9b06e246249871a8ca4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
dd4f2fd87606c36817e488ca0c3ddd45

SHA1
6e02015d7fc2dd54f2d9206a002660c299e49b07

SHA256
cdc13453f657cb6be1ecb0cb26490713077a8d7a2c76a2ef1b7a0277ec21df18

SHA512
d73ab5dddc16ab25ae912ea5f6f041529379b249684c92a27702d286297ff16679abccdf2734d360a2578f321faf4d6adf4d4e31d4d30e23ade626a4c18eb606

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
1d14858369b914d556847d9217923e7f

SHA1
6db0a04a9a933c040769fcfbb565efcfe86d15f7

SHA256
2e1c202ec6472d52f23e410d24765ddc133e9f8348265c565080dc35955c1097

SHA512
fd1e092bcc994556a3236316f14c0d1970951a5c3a1a94d197e5a5c112457222cafe60c01a28ea8ad15b764c465db7cd5270b78805ea88bfd49a7c6db4134fc2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9497a3aad49820d3638064d94faede34

SHA1
77eac8d63d1b3338176941ee08068be38853f745

SHA256
e490731b06fb53ffa2d98b1cba30029c049679ed17c116af68fdf4f956c0fa4f

SHA512
a02c2edecffcb9cf97e5b8473bdb532c520dd460ef1d450dd8c108f855c331ba64a8a301e62c9696c9a7c9afc009a0b80d2189dfe4ed06c8442674e20452fcea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
f4161a20d9c0116de8367a23da80f62c

SHA1
90cd173a0dfac8f4eaf4db56353bdf56a24cf5c7

SHA256
c733a4466cf797fb13f4dd81641975b3709e2cdefec8c08ba050066e10c41aee

SHA512
848e5a1f24b9ff26eec3cd78f66736f84eaa34c72c60574bad2d37b0b550d323428d0f1961b1923dcd20829230e181c80a9ffbc7f82c1eb0b951d58767436204

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG

Filesize
333B

MD5
0d59b36205a0e2821ec8920620d8f762

SHA1
41e14cc364d6d42ebaba0350b9760e128c586223

SHA256
d5fe4712135ecff692ebec7e2f7aebfb91ce07fd27083eb9137d320f6950dba8

SHA512
19b0df212f63dc88bea9a974ea289cee0df2efac4903044aac3261fb07dc27591ab3cce1d2e536b77b86b0cf32da47261838aeed0024d7189997bea9c16232bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
4b0c21e7c80068b272bd11faae83aa6f

SHA1
1e9b3c5d929192f0a461ff042e02a6ff225c965b

SHA256
3599579bd8962970559bdb44b0c9c49c29f3927de4969810f195046137b93612

SHA512
0c243e88f929d5ca2f3aa83b8fb5334c3607b223a944286e763f76bed4640394c43869b7648dd13a8a6cba234b7caf8f85c241554ee042c8015668d2fd12f016

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log

Filesize
4KB

MD5
8c848fad2a36941810ce02247e1c8d16

SHA1
61fd31cadf822ac72c6d3c101973bcdc2e074321

SHA256
ca111d68131137744c53485db60fe97db7575f20c7e1c06c6e54d082269a3d21

SHA512
7c55c361c96f1265f67a29597396370836cc2c3d4aba990da65b7dc442e13edc41db9e6a4dba967032f0b53093f8ae947ae4f88ff0488b0b29a368bf460a6070

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
321B

MD5
7e8d9afd35e5272fcf67e14afd167e32

SHA1
986ed17660a666b6bfe96ec14deca394fba7e938

SHA256
6fea9f32dce3196f5b5c48f40b8f7df704ed39f9721047ed2bdc5b85023bf8ed

SHA512
2a59bd43b262ad3da111cf1113cdb1d75dc2eb43d640426a8661689633c57b5efa5659c2b474b74b88ed2939fa1620d21a6875437efda219736f7215cfdf4487

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links

Filesize
128KB

MD5
a01435b03cec961fb9ee210da400733a

SHA1
5091581dfd0ece3a4c2a0f8bb3d31d6c0a3e9003

SHA256
33db323b7907302e2e74064e5a7de249e932aaddc4ca1a1665a0eb450c515ada

SHA512
cf04574850dac54c86c7d1e142ad054195780ab39225ddb02c05ac58972b1e79437f21a9691c59ed90dd57061be7226ce64e00f3214f59749df050692019adab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir128_2007712578\Icons\128.png

Filesize
7KB

MD5
8eec20e27dd654525e8f611ffcab2802

SHA1
557ba23b84213121f7746d013b91fe6c1fc0d52a

SHA256
dc4598a0e6de95fae32161fd8d4794d8ee3233ab31ba5818dfbe57f4f2253103

SHA512
b19d628a7d92a6ec026e972f690bf60f45cbab18fc3e6ab54a379d8f338da95e2964ecdc5e2bb76713f5d3ab2ced96766921e3b517036e832148d1fe5fe8aa6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

Filesize
114KB

MD5
51c178e96c84831f717c4e6695c39e76

SHA1
19d17662ce26eb4d8ceb0e57ec98e01bcd10b0e1

SHA256
d1965558d057349157f850b2d55e942a5b6889279f9c3fc406ee5da6be545780

SHA512
ca18f76b340d2b436d03e5201d3734779c0122fa8788537dde6c892275416683bf93d8acd68db4c7a7a350d81041a77559df7a90a05f313e2e4d853a727c6b4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
ef48733031b712ca7027624fff3ab208

SHA1
da4f3812e6afc4b90d2185f4709dfbb6b47714fa

SHA256
c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99

SHA512
ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
217ecce3785b9f4dfa0c490ca5a08233

SHA1
d2ee193657a1111a724596b77fac79dbc861e1b8

SHA256
ab33ae8ddb082a8417cdb3885d978592daa8e58c0ec0787a5f336b6105192ba8

SHA512
13b2d192218e085a0ff8fb08434b355d244b895bd4a1e9ed2ddac775a0191dedeeaee524f6b63f21303746d97a68b382a6fc63b3af656ef7e2b75b565dedb1e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
b1731a3200cfdcbcc8b5d2351cb03e72

SHA1
deb76f392dee2e438723da93fb7a5cbed52acfd1

SHA256
2bace116fd36a8d8529cab44a19f464334b547b0ada40189424986bbd319bfac

SHA512
707912842fdfceefc38745f9c1f0e2232cdbdf5c936aa8d4bff360297f00aeec79887fcbaa34317373ed8a499550fedabce737d816090946482ec7e5518b7e02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
b684c206ae5c8e509af47690083090b7

SHA1
7a700c5a7f14dea50b32ac5b6ea44e5691f0eb4f

SHA256
c47da10d083716899378d6adc1dbe73b765a1f5b575bbdba711f8c2aef966a53

SHA512
977e28f153052ded8b744350efd0a23f98f96e0961f3cf661ab0eef04539b5633c37a531a3c2753fa832d52ee67847e318c98104bd75b11d37462c84dd3ac661

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
71cbb9535761d78248144f990c240023

SHA1
d21d4eb0e8f5069ccfbfab87bedaf244d66aa623

SHA256
5b0258346ecdbef1e1c4e47211fc61a6f80377dfa90ebd9bd5a51cb2bcc7a411

SHA512
9051083731e704cd8f576de1588c2c7d107a3067664eac92088ccafbc120add6dc3aeff82046a7b8988c32c18a0b216eb4da88ec3774a1de05a3f387a46bb6ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
c7f00ede56edbefc295acd1d680233b2

SHA1
2fa0f1e5a5a3faae928239601eb8661f6070ea59

SHA256
30e19076a9bd3f5728efc2b6275f82efad19efdedfdb4c2d3207562a28251a0a

SHA512
ae4f069f213d86e2846a1a80c3929b65a228143cb4af7bc0b408c15a736ec18b19fde4e92e3c0d81fc22785382c285bdb9e17652142c7f21cf5877569bc07c68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
a0d23ddeeafffc16b8a0d3fbc791af04

SHA1
bedcb8911eae2f80b8b29e380fec920e9de4f673

SHA256
ea6af0b3a19e4248d57ff732f1c8ec3dd0736e2e72a697c1df941f9ce8fb6096

SHA512
11004b607f891cec398b17838c337e6d5197c8a8f7e4d2108773890f5794b0e546b0115cf91cc691f5a42bd3de933a744fbd9e469f1bdb8d937992f15687f29c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
121KB

MD5
578696579b38237ff8eb55a32ea40333

SHA1
fdf7a7ea3442c6191ba89afa5e9c560e32274dcf

SHA256
648eb7dfc164cfefa9841e48a9e50e116c4f899834b9c7134e5ec926ef8795b1

SHA512
752514cacddc2ed6d991bf02366e673494364df117c95806de6f1cf4f527f695ca973716d3d13e888cf0f8d0ed5957d185cf8bc7d79913254edde68dd5014d94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
a89442f86438aa72b933bef83ed2e64b

SHA1
64099d802c9c1e7799bf8fc35714071023264e8b

SHA256
7f5d0f06d9ea416abbe1cc27a4979f3abbfaef7f7c0efa7688ca17bf747a6b0c

SHA512
19a36a1b4a4d88b82cc03fa12555fa08c464ff891f2ead105189bc40acab860d8404effd7e0da7c5373c5e30692666b1eef922c2d55687dad5e2441dd2d6393a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
3e53aed18b176a4e8d54e877730b3a79

SHA1
d3ec38b3df4e2ef1f1c765c4a7f6cded8e2f51b9

SHA256
7d3819a0e458a3d0c42924e63fc8df96eb6c7b8969cb3ec508b9a7fd9db8c0ac

SHA512
75dfd4d8bdb84509ba0b79ba588c381400c7fc78cfc68cf5f96bc32ed017eafdbe6949f9ef53baaab219c6a13a6a061a74d1b0ddbb9fae236f5cebbc284ca4b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db

Filesize
40KB

MD5
700a223910adc47eab5130ad3f2eb85f

SHA1
d3e2da1c83673239a720d0ece72198b52363d790

SHA256
05ba9a7fd0dc62ae59d201e13aba3caff70c535e7a939bf7ba167e2822af7cfb

SHA512
12217a584db39318522ecb999d37eeed2d619d6517ae7c6b6686ef871fdccf34679e458d1c6de0990f7a9c519ff000b1f6b11e6ccd94c329064dce2db0b679d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db-journal

Filesize
24KB

MD5
e7fa5ff44a796a680ff01a0c1cd33701

SHA1
094fd63885196a853b5d39dd4f65f907a7d6058f

SHA256
76865da372ece1935c690dfa3b21405f1c99377bbf1cbc7fafb1e22c11989ca9

SHA512
44fa20281817b8704665df6af6ed2300f8a9946bf2ecd37e382af0425d84dad7d977e85e89ab76e398ee0f552ea0864fb579430f6f13ca3d6d87b71e3095a1ae

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\990f6d8b-390d-4815-bce5-92dca2514250.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\INetCache\SC3NQU43\trans[2].gif

Filesize
43B

MD5
325472601571f31e1bf00674c368d335

SHA1
2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a

SHA256
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

SHA512
717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6CGRGUCT\www.bing[1].xml

Filesize
328B

MD5
71235c9cda5e016e476997e0b3820caa

SHA1
edc1693ac4ee72cc57aeb13e155400e27fa8aa11

SHA256
cca45c5bc48f1d667df644cd07c1f746d9c0bff79747481fcb69dd72c8d21740

SHA512
f1731dc147dd106ee8eb2b642791fb5bd0f8f5702317063853c41a6f3787c91ad1857216920118ddac4b4ee88dc90bf81167c455d0dc0f8a6322c544d5352e0e

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6CGRGUCT\www.bing[1].xml

Filesize
17KB

MD5
a5c4d237fa1783444edcd024fb22c5ad

SHA1
cfa5cf659cff4545bdc44727fa40b46580ac75a0

SHA256
0bdf91a2d36bf2c4dc84c9d91400e2b83ff5a9f016de93156fa1a87d985f1927

SHA512
aa9a0e53ba3ff141eb0f0d4b54903f3fda821747673f901ccce49ea84e180487542a80819844c34d809be3126da291dc56a9c0a3e0876bbaedd9f5ee94c7eafc

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6CGRGUCT\www.bing[1].xml

Filesize
15KB

MD5
737aa4ee0644e796e89d29e8054d42a9

SHA1
671c5daf5f7cbb23f600fcfe6f4e3ad8230b693a

SHA256
2cb8e8bb044c8c8a75010bdc7feac1e059e7979fc8b90eaccdf8d017ca74e832

SHA512
ce68ea4ef3470c494422ee261943b474612afed8acd3e534621dd068e334e468e57d95ae1b523587f39437dc508f32057c8637bf4db0a869f9ea0975c611d1fc

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6CGRGUCT\www.bing[1].xml

Filesize
8KB

MD5
a3dbb9b2fdd40a33e3b93dc1b0d2f786

SHA1
d2408e026c8471d6ba8f90595f8ed8c3644002d9

SHA256
676f36e070068fae5d275fd984e1f1cc31cdf60f77fcd40a10fedaef4e952b8d

SHA512
307e02ec42682a07260582e19633171b9ba3d3b5a409b463fbae1ea47b2c1d31d2651bd09d09c7d64ea1b865a900feb0995679e8b928ec31cae49a0ad14cf483

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6CGRGUCT\www.bing[1].xml

Filesize
2KB

MD5
b9fcc2c78533737b924283c6fa61a5e3

SHA1
93121babcee3daf066e2301787d23de249bc5d34

SHA256
76de679cf3dde25e88bee7cbacce8194e88e0cb2a887529df1e18b096004af36

SHA512
20ce954f46aaf0f1c2713e434ac1aaa9ce7e506ec7bede8c8ea4f67d10bff4595ff248df8b1a7f7a4d3711d55039a4671ab7bb26892241573995aaa3977dfb41

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6CGRGUCT\www.bing[1].xml

Filesize
18KB

MD5
b61f1742d49f9d78e018bba073fa1c2b

SHA1
21224a23fff5023c4578120dfdb5db83e7b5b9f9

SHA256
c01e2a661ab22d31373924532f0f51589a42f50402bab59e7fc60b451a8d0751

SHA512
a9af040990c1b2d3c897be6d7a5c075e6ce618cdd688f18cd8480e2384258daa30b93675705bd4fffc137e83e59df4b42cc73022a2b633f8759c5791fb142541

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6CGRGUCT\www.bing[1].xml

Filesize
18KB

MD5
718af3b092a5f346e53b260210ff79c5

SHA1
e505c5effe957d0785c94a40e4aee603d0319e86

SHA256
1ab5b6a649a5a96244b10e3c82529f2aa963f2d97bf89641029dffb16f1315a0

SHA512
c460a8c7dc037cdc08d3e51ae7eae7033a36bc8dfb3ee514cbab1405a97d24ce3ebf29c9cc490acc8d1dbe28979512a6da3c7a960bd04c3571249aac48ce455f

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6CGRGUCT\www.bing[1].xml

Filesize
11KB

MD5
3c066cc141777a184d58610881158b1f

SHA1
12dfd2c6cd09e74bb848ece7a8f3c032aa508d39

SHA256
2cce3574385c5c1c18e927eb66fdfb02b28927442c872fe2e5cb6f2de4d3cfbe

SHA512
444a3b92ca9b1126ddba05999b36560370f128ff041e36f61324e55b8a5aa2ecf0b84e64d0d7b20ccf96c1796fda0f4df154ac18270feb09334e0476fe1b25a0

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6CGRGUCT\www.bing[1].xml

Filesize
11KB

MD5
245bd035674f5da43a863d5e5bc20a8a

SHA1
26430ede554ee5f8ad75c3afd3f95c0d715dd006

SHA256
ff47cfbb8710cdc007317707609ee002fb6ff0070fd707a57eb85ce461e1a1fe

SHA512
b95b06dbd4bd83953ba290c1c1ef48d22781b6162388b21b2d8166e227548380351b114070ce9473327ceb52adf0fd6694ad3c051d91fdf1ac798c61b41e1d80

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6CGRGUCT\www.bing[1].xml

Filesize
28KB

MD5
ae3c3e86380480b4392516c21bc0d672

SHA1
be4e9ddae57562fe3ebe5c2d49a10621c316659a

SHA256
ae98e194b7bbd6ae9062395a45daa54bdd08d776ba581b43946b593b08fa858d

SHA512
6418c1ca633b3e5158acc738509cee9ec707d235f9e06192a64993cb348507361374b9c4b318dbc35f6bc0762c757f396e0f5f7264d7c70c946de0faf6f368ae

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6CGRGUCT\www.bing[1].xml

Filesize
8KB

MD5
f7e1957e93409a64133ea8b062bd1d62

SHA1
30e50ee2633b9711016aa6bdd241284ee3918f66

SHA256
46ddb4266dbf986c0a05dd7afc6830981a5f203ad42171d78e9ac2b3485ce130

SHA512
1965cdf07eaa0df9cf29f1d3883df8e71d8bf857589ceb5511230a2001829d2a2f8d8ead6b7f6c0e5fdf47b0256eb5c04123d642886222da8a87d80498ba49f8

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6CGRGUCT\www.bing[1].xml

Filesize
27KB

MD5
7aa889bd5d23ffcc8608345c33e38265

SHA1
5991c3d30ea95ff8d613d3adf685b254cc2ceefa

SHA256
dbfbdba20c959d9e88bc8ce93a8f49d7f30af7765e487b60a8a0f5505d847ee2

SHA512
f482a3d2656dd238949adbeab22ff07f5d221353467cc20dcf9752f02e6df14cd02acd330daf6b6ded87a3b5a2e77da051e86a7390668c24548cd61256e3c6fe

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133778119475003379.txt

Filesize
67KB

MD5
80e55d5643d4305dedcb2686764fd662

SHA1
d2e14e1ff9514d87eafd408f1b827ce04133b821

SHA256
a5e0e7f7ebe310c812ebc160364ea3f78a36d5363109ce8d4a88ea5c0b84bda2

SHA512
381ab3774c400d9370c3e993d799a48e9ea51d0503fdf2fdecb241afafc82b17dc1722d0b69f1d6f1bbb1ed79b2d9a1a038035689f20b50172abaa68aeeb5664

Download Submit
C:\Users\Admin\AppData\Local\Temp\38b0718b-388c-44fc-8c10-1445f6c12702.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4824_707887920\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4824_707887920\fcbb2b37-0ac6-4824-aca3-e044c792653a.tmp

Filesize
135KB

MD5
3f6f93c3dccd4a91c4eb25c7f6feb1c1

SHA1
9b73f46adfa1f4464929b408407e73d4535c6827

SHA256
19f05352cb4c6e231c1c000b6c8b7e9edcc1e8082caf46fff16b239d32aa7c9e

SHA512
d488fa67e3a29d0147e9eaf2eabc74d9a255f8470cf79a4aea60e3b3b5e48a3fcbc4fc3e9ce58dff8d7d0caa8ae749295f221e1fe1ba5d20deb2d97544a12ba4

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 739504.crdownload

Filesize
5.2MB

MD5
344b297e1977e17f293630a8002c97cf

SHA1
6e60934a413e84de0628078f028e6bc09d4bc5c2

SHA256
3036098a4d55511da842cd00de13c92d9c6a50bdb52edf3cdc34b774647fce8c

SHA512
269f95a757fc999874738155c42c1fe76f70ede8843d6f2277ba3fb50df4e8b4eecfcfde8317213ea0ad3f47ce7220983e49ebcbf63a235ec36ad5caf7471a49

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 810980.crdownload

Filesize
5.4MB

MD5
72fb77bb072a933db7a344a529882c6c

SHA1
c6b9e98f0cb17b45f67a2ef0f1e003c42673c555

SHA256
a7c7fd5f9cec332554ca7cdb29afb5bd37af4dc43af78e55b14ca8b8c951c6a0

SHA512
920272fffa508bda872d6c79da41227b1ed57a3a149829eb2034f82fc612409247b74fe17da1e9e2c3255720482d10e45babb02a4d844b98da3f65b558ef1d9a

Download Submit
C:\Users\Admin\Downloads\Win10Explorer.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/716-2105-0x00000220C8770000-0x00000220C8870000-memory.dmp

Filesize
1024KB

Download
memory/716-2015-0x00000220C4B20000-0x00000220C4B40000-memory.dmp

Filesize
128KB

Download
memory/716-1998-0x00000220C4D20000-0x00000220C4E20000-memory.dmp

Filesize
1024KB

Download
memory/716-1997-0x00000220C4BA0000-0x00000220C4BC0000-memory.dmp

Filesize
128KB

Download
memory/716-1971-0x00000220C3200000-0x00000220C3300000-memory.dmp

Filesize
1024KB

Download
memory/716-1889-0x000002208FF00000-0x0000022090000000-memory.dmp

Filesize
1024KB

Download
memory/716-1888-0x000002208FF00000-0x0000022090000000-memory.dmp

Filesize
1024KB

Download
memory/968-2526-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/2180-1861-0x000001505D200000-0x000001505D201000-memory.dmp

Filesize
4KB

Download
memory/2180-1863-0x000001505D200000-0x000001505D201000-memory.dmp

Filesize
4KB

Download
memory/2180-1868-0x000001505D200000-0x000001505D201000-memory.dmp

Filesize
4KB

Download
memory/2180-1869-0x000001505D200000-0x000001505D201000-memory.dmp

Filesize
4KB

Download
memory/2180-1870-0x000001505D200000-0x000001505D201000-memory.dmp

Filesize
4KB

Download
memory/2180-1871-0x000001505D200000-0x000001505D201000-memory.dmp

Filesize
4KB

Download
memory/2180-1862-0x000001505D200000-0x000001505D201000-memory.dmp

Filesize
4KB

Download
memory/2180-1872-0x000001505D200000-0x000001505D201000-memory.dmp

Filesize
4KB

Download
memory/2180-1867-0x000001505D200000-0x000001505D201000-memory.dmp

Filesize
4KB

Download
memory/2672-3747-0x000001E0CF840000-0x000001E0CF860000-memory.dmp

Filesize
128KB

Download
memory/2672-2588-0x000001E0E1910000-0x000001E0E1A10000-memory.dmp

Filesize
1024KB

Download
memory/2672-2587-0x000001E0E02E0000-0x000001E0E0300000-memory.dmp

Filesize
128KB

Download
memory/2672-2589-0x000001E0E1750000-0x000001E0E1770000-memory.dmp

Filesize
128KB

Download
memory/2672-2819-0x000001E0BDE80000-0x000001E0BDF80000-memory.dmp

Filesize
1024KB

Download
memory/2672-2824-0x000001E0E2DC0000-0x000001E0E2DE0000-memory.dmp

Filesize
128KB

Download
memory/2672-2934-0x000001E0E2E20000-0x000001E0E2E40000-memory.dmp

Filesize
128KB

Download
memory/3172-1884-0x00000000035F0000-0x00000000035F1000-memory.dmp

Filesize
4KB

Download
memory/3744-1859-0x0000000003440000-0x0000000003441000-memory.dmp

Filesize
4KB

Download