9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b

Resubmissions

19/12/2024, 13:09

241219-qdzx4stlfy 10

18/12/2024, 23:58

18/12/2024, 23:03

18/12/2024, 22:59

18/12/2024, 22:44

18/12/2024, 22:36

18/12/2024, 22:31

Analysis

max time kernel
1050s
max time network
1040s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
18/12/2024, 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

node-v22.11.0-x64.msi
Size

28.9MB
MD5

fa9e1f3064a66913362e9bff7097cef5
SHA1

b34f1f9a9f6242c54486a4bc453a9336840b4425
SHA256

9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b
SHA512

ad3e9469326dccac6b49185b5b2814ba700b5d83b4b3ce17f85a9adc5f90bdebf54d79800b253ed5c371ab82d27304841f86ab1a8a3c7ffade8a2d78e55dc99f
SSDEEP

786432:EtShU+9S49htlhk3tKuiU9IsO9IP1/lBMS8k4:EAUK/U9IN961/l

Score

7^/10

discovery persistence phishing privilege_escalation

Malware Config

Signatures

A potential corporate email address has been identified in the URL: currency-file@1
phishing

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	3656	msiexec.exe
3	3656	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
296	pastebin.com
4	pastebin.com
18	pastebin.com
19	pastebin.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\npx.ps1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-publish.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\installed-package-contents\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\cacache\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\unpack.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\minipass\index.mjs	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\cliui\node_modules\emoji-regex\LICENSE-MIT.txt	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\debug\src\browser.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-audit.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\esm\ignore.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\esm\processor.d.ts.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\isexe\dist\mjs\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\esm\platform.d.ts.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-access.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-adduser.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\configuring-npm\folders.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@pkgjs\parseargs\internal\util.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\asn1\tag.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\chownr\dist\commonjs\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpublish\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\signer\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\MSVSSettings.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\p-map\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\ranges\valid.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\yarnpkg.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-find-dupes.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-collect\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\package-json-from-dist\dist\commonjs\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\safer-buffer\tests.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\config.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\arborist\isolated-reifier.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ansi-regex\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmteam\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-install-test.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\mkdirp\dist\mjs\mkdirp-native.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ci-info\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\commonjs\walker.d.ts.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpublish\lib\unpublish.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\isexe\dist\cjs\options.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\commonjs\fs.d.ts.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ssri\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\yarn	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-unpublish.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\node_modules\make-fetch-happen\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\google\api\field_behavior.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\check-bins.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\exponential-backoff\dist\delay\delay.factory.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\prerelease.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\dist\appdata.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\jsonparse\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\esm\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\gyp.bat	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\install.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\isexe\dist\cjs\win32.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\promise-spawn\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\https-proxy-agent\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-package-arg\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\node_modules\@npmcli\fs\lib\readdir-scoped.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\override-resolves.js	msiexec.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF73316AE984EB2ABB.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF01CF9845B59B0C38.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1760.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF207B48F82D47F685.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}\NodeIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD3B0EEAB1C5832B0.TMP	msiexec.exe
File created	C:\Windows\Installer\e57e510.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE6F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF06D.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Installer\MSI157B.tmp	msiexec.exe
File created	C:\Windows\Installer\e57e512.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57e510.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE697.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF204.tmp	msiexec.exe
File created	C:\Windows\Installer\{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}\NodeIcon	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
1276	node.exe

Loads dropped DLL 7 IoCs

pid	Process
1536	MsiExec.exe
1536	MsiExec.exe
396	MsiExec.exe
396	MsiExec.exe
396	MsiExec.exe
1080	MsiExec.exe
2748	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3656	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000235a573f571b962e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000235a573f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900235a573f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d235a573f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000235a573f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4260	systeminfo.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133790366755713928"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	notepad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Version = "369819648"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff	notepad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\ProductName = "Node.js"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	notepad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\NodeRuntime	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	notepad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	notepad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\npm	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\DocumentationShortcuts	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	notepad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\ProductIcon = "C:\\Windows\\Installer\\{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}\\NodeIcon"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	notepad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\PackageName = "node-v22.11.0-x64.msi"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 01000000030000000200000000000000ffffffff	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	notepad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\corepack	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\EnvironmentPath	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	notepad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "5"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Documents"	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\PackageCode = "7ADA4E96FE88DF64FB4F54512750A882"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	notepad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\011B2C6A4395F7A48B1C157EDC15FF28	msiexec.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3944	msiexec.exe
3944	msiexec.exe
4696	chrome.exe
4696	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
232	powershell_ise.exe
1812	powershell_ise.exe
232	powershell_ise.exe
1812	powershell_ise.exe
1812	powershell_ise.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 38 IoCs

pid	Process
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3656	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3656	msiexec.exe
Token: SeSecurityPrivilege	3944	msiexec.exe
Token: SeCreateTokenPrivilege	3656	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3656	msiexec.exe
Token: SeLockMemoryPrivilege	3656	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3656	msiexec.exe
Token: SeMachineAccountPrivilege	3656	msiexec.exe
Token: SeTcbPrivilege	3656	msiexec.exe
Token: SeSecurityPrivilege	3656	msiexec.exe
Token: SeTakeOwnershipPrivilege	3656	msiexec.exe
Token: SeLoadDriverPrivilege	3656	msiexec.exe
Token: SeSystemProfilePrivilege	3656	msiexec.exe
Token: SeSystemtimePrivilege	3656	msiexec.exe
Token: SeProfSingleProcessPrivilege	3656	msiexec.exe
Token: SeIncBasePriorityPrivilege	3656	msiexec.exe
Token: SeCreatePagefilePrivilege	3656	msiexec.exe
Token: SeCreatePermanentPrivilege	3656	msiexec.exe
Token: SeBackupPrivilege	3656	msiexec.exe
Token: SeRestorePrivilege	3656	msiexec.exe
Token: SeShutdownPrivilege	3656	msiexec.exe
Token: SeDebugPrivilege	3656	msiexec.exe
Token: SeAuditPrivilege	3656	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3656	msiexec.exe
Token: SeChangeNotifyPrivilege	3656	msiexec.exe
Token: SeRemoteShutdownPrivilege	3656	msiexec.exe
Token: SeUndockPrivilege	3656	msiexec.exe
Token: SeSyncAgentPrivilege	3656	msiexec.exe
Token: SeEnableDelegationPrivilege	3656	msiexec.exe
Token: SeManageVolumePrivilege	3656	msiexec.exe
Token: SeImpersonatePrivilege	3656	msiexec.exe
Token: SeCreateGlobalPrivilege	3656	msiexec.exe
Token: SeCreateTokenPrivilege	3656	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3656	msiexec.exe
Token: SeLockMemoryPrivilege	3656	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3656	msiexec.exe
Token: SeMachineAccountPrivilege	3656	msiexec.exe
Token: SeTcbPrivilege	3656	msiexec.exe
Token: SeSecurityPrivilege	3656	msiexec.exe
Token: SeTakeOwnershipPrivilege	3656	msiexec.exe
Token: SeLoadDriverPrivilege	3656	msiexec.exe
Token: SeSystemProfilePrivilege	3656	msiexec.exe
Token: SeSystemtimePrivilege	3656	msiexec.exe
Token: SeProfSingleProcessPrivilege	3656	msiexec.exe
Token: SeIncBasePriorityPrivilege	3656	msiexec.exe
Token: SeCreatePagefilePrivilege	3656	msiexec.exe
Token: SeCreatePermanentPrivilege	3656	msiexec.exe
Token: SeBackupPrivilege	3656	msiexec.exe
Token: SeRestorePrivilege	3656	msiexec.exe
Token: SeShutdownPrivilege	3656	msiexec.exe
Token: SeDebugPrivilege	3656	msiexec.exe
Token: SeAuditPrivilege	3656	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3656	msiexec.exe
Token: SeChangeNotifyPrivilege	3656	msiexec.exe
Token: SeRemoteShutdownPrivilege	3656	msiexec.exe
Token: SeUndockPrivilege	3656	msiexec.exe
Token: SeSyncAgentPrivilege	3656	msiexec.exe
Token: SeEnableDelegationPrivilege	3656	msiexec.exe
Token: SeManageVolumePrivilege	3656	msiexec.exe
Token: SeImpersonatePrivilege	3656	msiexec.exe
Token: SeCreateGlobalPrivilege	3656	msiexec.exe
Token: SeCreateTokenPrivilege	3656	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3656	msiexec.exe
Token: SeLockMemoryPrivilege	3656	msiexec.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
3656	msiexec.exe
3656	msiexec.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3112	notepad.exe
3112	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 1536	3944	msiexec.exe	80
PID 3944 wrote to memory of 1536	3944	msiexec.exe	80
PID 3944 wrote to memory of 4364	3944	msiexec.exe	88
PID 3944 wrote to memory of 4364	3944	msiexec.exe	88
PID 3944 wrote to memory of 396	3944	msiexec.exe	90
PID 3944 wrote to memory of 396	3944	msiexec.exe	90
PID 3944 wrote to memory of 1080	3944	msiexec.exe	94
PID 3944 wrote to memory of 1080	3944	msiexec.exe	94
PID 3944 wrote to memory of 2748	3944	msiexec.exe	96
PID 3944 wrote to memory of 2748	3944	msiexec.exe	96
PID 3944 wrote to memory of 2748	3944	msiexec.exe	96
PID 348 wrote to memory of 3112	348	cmd.exe	97
PID 348 wrote to memory of 3112	348	cmd.exe	97
PID 4696 wrote to memory of 4676	4696	chrome.exe	99
PID 4696 wrote to memory of 4676	4696	chrome.exe	99
PID 988 wrote to memory of 916	988	chrome.exe	101
PID 988 wrote to memory of 916	988	chrome.exe	101
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3716	4696	chrome.exe	102
PID 4696 wrote to memory of 3528	4696	chrome.exe	103
PID 4696 wrote to memory of 3528	4696	chrome.exe	103
PID 4696 wrote to memory of 2092	4696	chrome.exe	104
PID 4696 wrote to memory of 2092	4696	chrome.exe	104
PID 4696 wrote to memory of 2092	4696	chrome.exe	104
PID 4696 wrote to memory of 2092	4696	chrome.exe	104
PID 4696 wrote to memory of 2092	4696	chrome.exe	104
PID 4696 wrote to memory of 2092	4696	chrome.exe	104
PID 4696 wrote to memory of 2092	4696	chrome.exe	104
PID 4696 wrote to memory of 2092	4696	chrome.exe	104
PID 4696 wrote to memory of 2092	4696	chrome.exe	104
PID 4696 wrote to memory of 2092	4696	chrome.exe	104
PID 4696 wrote to memory of 2092	4696	chrome.exe	104
PID 4696 wrote to memory of 2092	4696	chrome.exe	104
PID 4696 wrote to memory of 2092	4696	chrome.exe	104
PID 4696 wrote to memory of 2092	4696	chrome.exe	104
PID 4696 wrote to memory of 2092	4696	chrome.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\node-v22.11.0-x64.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3656

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C8DFC7BBD4F17BD548AFC57A129A5B0A C
  2⤵
  - Loads dropped DLL
  PID:1536
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4364
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6774746AA326162F7503229D60F59DE2
  2⤵
  - Loads dropped DLL
  PID:396
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 2627DB60573FEED4F5D3C823B3C3CFE5 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:1080
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C4E420431156A23E58942FE4107C05F0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2748

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:248

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:348
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffee76dcc40,0x7ffee76dcc4c,0x7ffee76dcc58
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2124,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2208,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2220 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3552,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4792,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4832,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4812,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5008,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5016,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4820,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5252,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3744 /prefetch:2
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4672,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4800,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5508,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5560,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5756,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5760,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6016,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6252,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1256,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=4460,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2804 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=3408,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=4816,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=3228,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=3192,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=4860,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6220,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2804 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=3380,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=6392,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=5812,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=6092,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=6148,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=6556,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=6680,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=6704,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=6820,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=6988,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=7264,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=7428,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=7560,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=7568,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7692 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=7832,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=7844,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7972 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=7864,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8132 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=8256,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8136 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=8392,i,13034055910102412973,9829740878726386988,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8440 /prefetch:1
  2⤵
  PID:3340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee76dcc40,0x7ffee76dcc4c,0x7ffee76dcc58
  2⤵
  PID:916

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4932

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:3080
- C:\Program Files\nodejs\node.exe
  node index
  2⤵
  - Executes dropped EXE
  PID:1276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Control Panel\Desktop" /v Wallpaper"
    3⤵
    PID:3316
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Control Panel\Desktop" /v Wallpaper
      4⤵
      PID:2744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "systeminfo | find "System Boot Time""
    3⤵
    PID:3412
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4260
  - - C:\Windows\system32\find.exe
      find "System Boot Time"
      4⤵
      PID:1176

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
  powershell_ise.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
  powershell_ise.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57e511.rbs

Filesize
935KB

MD5
cc529e472e21cb22450e528b07668d11

SHA1
480862e287fa57303731de538662bd867966d7dc

SHA256
aad3a5f6d4b59edafcfc4e1df5d3fb9e09f7810f63fb8c1e6f18494a0fdfe2ad

SHA512
1cc30f2168c258f276072cdaa93226f610bd4fc5b997d7817b32d65eea12f620007b8d2e9d88e7f0c64b56a9684805a17faca8f499c1ff26591b65d43cba9037

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\fs\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE

Filesize
11KB

MD5
dfc1b916d4555a69859202f8bd8ad40c

SHA1
fc22b6ee39814d22e77fe6386c883a58ecac6465

SHA256
7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9

SHA512
1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js

Filesize
79B

MD5
24563705cc4bb54fccd88e52bc96c711

SHA1
871fa42907b821246de04785a532297500372fc7

SHA256
ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13

SHA512
2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\p-map\license

Filesize
1KB

MD5
b862aeb7e1d01452e0f07403591e5a55

SHA1
b8765be74fea9525d978661759be8c11bab5e60e

SHA256
fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f

SHA512
885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\esm\package.json

Filesize
26B

MD5
2324363c71f28a5b7e946a38dc2d9293

SHA1
7eda542849fb3a4a7b4ba8a7745887adcade1673

SHA256
1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4

SHA512
7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\yallist\dist\commonjs\package.json

Filesize
28B

MD5
56368b3e2b84dac2c9ed38b5c4329ec2

SHA1
f67c4acef5973c256c47998b20b5165ab7629ed4

SHA256
58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd

SHA512
d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\fs-minipass\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\indent-string\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\npm-audit-report\LICENSE

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\node_modules\proc-log\LICENSE

Filesize
757B

MD5
8bb6f78000746d4fa0baf4bdbf9e814e

SHA1
4b7049331119a63009aec376677b97c688266613

SHA256
a5103404e4615fa1ed46aef13082dd287bf4b95964e71ffdf198984b3d5882b8

SHA512
ee6874e77e33e0e0fe271ae706b344696201c1c204356e271705d9b0687bb597991c3b589d0fa6b6b38dd2933026c0996b37bc13062a5acb2fdc7f3359cdb262

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js

Filesize
17KB

MD5
cf8f16c1aa805000c832f879529c070c

SHA1
54cc4d6c9b462ad2de246e28cd80ed030504353d

SHA256
77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573

SHA512
a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js

Filesize
15KB

MD5
9841536310d4e186a474dfa2acf558cd

SHA1
33fabbcc5e1adbe0528243eafd36e5d876aaecaa

SHA256
5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9

SHA512
b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
72b8c907a5d50eb4917010e78ef8a23b

SHA1
a3e7ebff0927ae76cecdedb6e81422be78786bd3

SHA256
f6424b15af9a46f0ebef4cc2ca73a2b534ed22b2acec189ee9233fd815187e20

SHA512
9def64b5fedadfe38456c608be144706fea63847b5fd4f636af048b2886d88779f8b1268eac2c33e1edf9cc07deaa64de3ab5504b8a16d19e2b03b22b3a08dcc

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
159239844fe85a7b6b4358e3dfb73039

SHA1
27f9fdb4b407665cb8446171b56bae1dbbf05041

SHA256
54f705bfa7da9d40819e923eacce8a3b1dde70b2196e0cea0893f7c287b2acae

SHA512
059596d7267046d98d7cda1a1af7311c2a8d4c2c32a864a99fbaeaa1568cd9d1c37a7869ff3eaaf344d2ec410cdff97c81cedc1cce1e7e48935ffecc7d76615c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4

Filesize
727B

MD5
92e2c8647142881c6854724d3e3d0aac

SHA1
d7d2a39374b3e913f6981fb5af3ccf47c02b0e84

SHA256
e911720fd72f86ac93c5a1b292a9a7d1b316ab09886a21ce211fc7adaae950dc

SHA512
22f91907b1a417153ec66f17117ae1ee5b2da7a13dade25ae0690248931ec73dd06f49776c1e7124afe8b067d62db7fefc90c1777a5c93e4a22403c66c8198fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
6e8abcfde63a04d6c0f7fae95d6f98a8

SHA1
d8c3bd8e7a0d18fd4435a0842dc1f4fc4b76f367

SHA256
25f012ae852b065244e4312ad1dd00dfb30b151c2cdf97024d49665a04d9ef2d

SHA512
4577c8e553d326b1a1c4f93cb6a8dd40486f8d9cad3009fd8a2006f4749667dd10999ae198aa9e37569a8e88f3b5d28819872f7e572a5b4ccc05eafb0cd1942f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
5fd133c5cc2b977f051ec63bccd3d23b

SHA1
b546e00ecf8bf8133ce7d40432d3700356ce7aa3

SHA256
b0d3d2391d98eab10d53a0dfbb5f86a3022694e354391df1607fe95fdc5df8fa

SHA512
332f1be6b1af61770410d7e34c18048f87f53284462c3fb8cb3ecd4d7bafaa3842c093e4cb93a69a50089e293b3ffa6bbec5855cba7f067a9b82378e08b0dbf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0D7BFF9D231ADDC3439B70E4C5E809D4

Filesize
404B

MD5
8ed93da31facd40c399fcee14c6a2b20

SHA1
644c33a9ffcce6f5b5cd061e0671044ca38a6d96

SHA256
377ddf430ecb8c2acb952411267fb22128d342caecd68faad1b2081f2a6ae318

SHA512
59200f55cf2fe8c44fd55cdaa5f5add59af802a07e9d8d9e0673ce23899bafe1d6786722f46d59b6df52b7871e5e7f42077b5f1b840a405d7a4b63080668f45e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
1b3356bd4465e7ce065a1137673c6e7a

SHA1
c832445e230cd153b9d07fadf871a3fd635d8493

SHA256
d011eb68296e62442b1c757bc3986915510dc4c67b5be786a94aa6f6772ccb20

SHA512
91cf84ef701e36a0625a05bbdba4f4d7dc05128e4300ab2be07da42cc4e00023209253a46b3164ded05eb271d0a52ee82b3577caad7a696aa5e961ae5e581e0c

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
79e90b79849ab24f7077995c4e45f1d5

SHA1
3dae744f25bcaa1b690d61b789a8b1e58a790953

SHA256
3d2a7a2b6c89618f30d26fd5dac9ff7d52d6cf1d3651fd7aaa1d1229464b1507

SHA512
6169379e245102bc4b1ff74bc2c7cf356f24fdef55e5f3f8a7323da36f6ca92f1ec38bf230cacecc89c33e12e1b201de417a570a998f31cb281bed3ae8f8deb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
7a3f4ec19e31ce99dfa8b0fc23de6e74

SHA1
6d02529d91a9a6275ee9bd1fbbf025c6286af2a4

SHA256
db7b07ff8508fcf07fffedecc78c245a8ddd6bd55b65f178afbf365458287104

SHA512
c1db8d7abf382127024751ee201cf5bf7c7c7d508ffbb06f379c9b65962b16a8be38740901c36d7d282b8e9c97031e380dc23f41c7a2de11913dc4469f3d2aa2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
30KB

MD5
86dfa3911317707bae8676cc430a8b9f

SHA1
8a24cce9caad3801b2e3d523e8af64821b3f3d54

SHA256
b73a45f35f9e059e44a6d6cc75b19594fae3ffbee2f69f6cd29cbc3e4411c445

SHA512
ee6ee12047ed9db2c5f67951f3ef12592492af6a0862d01a20ceb0f5cff62c2f189afc6e823f4bbfd5170fc92ec56ac5b7965353055e6278b3d63183d01025d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

Filesize
27KB

MD5
743438659d31b895fc9cf7c69a7832c0

SHA1
452d607d73e5643df11e522344f36b253d5de8a1

SHA256
c0b509b9923c00a730ea44bc839574fb609e771fe18724935a463f769071eea9

SHA512
11a1cfea0521b670e370787d153bb5eeaf17b7cbe112a5a55b3cc2e41fe575f0711e306f73b11be41b184e3f459e1404deb956903daabf33597d1550e0f7d079

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d

Filesize
34KB

MD5
cd28431242d66b4fc00615b887ac5805

SHA1
4c03d0ce1ddbd9e7e43be1a56149d0dbd0437ffc

SHA256
8eefb6c2900b6184c43c6844c1abcb416131953406d7e3077676b7c8a86009d6

SHA512
f59f4771144e39902a5af5aaad84865e2c946d1fe7d617190775ef136e8b9045ea1bc8754c78597e1809b75f74b6e7dd0f886299825aa80644bc6b7c7ffa3e4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021

Filesize
16KB

MD5
9c6b5ce6b3452e98573e6409c34dd73c

SHA1
de607fadef62e36945a409a838eb8fc36d819b42

SHA256
cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc

SHA512
4cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e21ebc34f4fcebaf222fcd9ac53f75dc

SHA1
bd9ed03e3e32ff4155309df6bad1a25db7f06165

SHA256
6dfdf602fdb1b76ef9dc48fc27a48b6fff48dd29f41f86d2d5f05575b60e7467

SHA512
23aa2fe4a85a196b9043f5325e467cd5a784991471a514813edc132b2819ac49f64e41681f99bb29afb99daf147f13fed34c2a5715ddbb166e3cd6a649038ddb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0fe1c057722e86b1a79ebfdaee8622fa

SHA1
f784c59ec9edacd876e8257c3aa61819dfd6892b

SHA256
d47b06b94809886aad1d355d73550f38dd922c887ef84289610fe9b72e3a84aa

SHA512
ac475a4355568170efe70e0db4f8bc8ffd9fb625d7b912bc9611435cfe7251de9103a098782c9a4895173dd2f4c88f5764fae84e3a7a405462b21abaf2c44992

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
14KB

MD5
e675d54eef9a62c3129add1a8589b7f8

SHA1
283c4880342fe1ef1624f57833eb08d2f23bf9bc

SHA256
0dc5cb6111bb8044c26784288ab67901a85366e54396255f660f44c484c6abba

SHA512
419055101fb271815c0aed49a512a874bf9db04a15527dfae8f660c8f5da3531009ba98f069db62b49d331801fe9a25db70c2a64e6654ef02800d70c87ab41a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
21KB

MD5
c49b4e6b4eff330c211cab5e1a16d168

SHA1
94476a395237453c69b6fc481a4dccf457415d36

SHA256
231d1d94441da3777fd8ad14b4a0814be9f7d2ec25872f52081fcd1569f33218

SHA512
7d445006a0c34ddeb7aea52984e9a27780a787a52ea6c4d7e8983ea02b6ed45f996e73fd4de41e92534920168102fbdf04d141035296ac3fa737001bd24babc3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
892e5e2d1b34b4e7ee39f0d8e972f626

SHA1
8e0025b716ef20d5457b0e8a3392ce63165cbd76

SHA256
9468f7c0665fc82efe3308dc3d4eecbfc8fee8a52d17e82b355e49b369d6c63c

SHA512
af2f16d23947e9a554a0182e0157d996719dcc973f40ab05b55a75738df10e19f6e66f729eddb409b19d4b6b8ec7ebb8df12e5fc4130fa178a974d75419bddc3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
ccfa8dfee40ff9bc7f348fdad8728909

SHA1
2ea56ceb4a2d48fd9ad8fffea5de71b476c4e4d3

SHA256
59f3a6e3dd507b55f242330e9f4dc9e2dc2769178105aa5cb823b9a9b7cf44cc

SHA512
1906347e5f83039c13654d3b2c9cfe4c136efebc86e4db465bef97ff376152be842e79d2ac787b19a01ec0b420a76e20352c539799ae16911e7c92febe7250ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
9039fdbc59231df21b1965958f84d304

SHA1
39723f31be62646c6bee2218b46bc2b39261bb9d

SHA256
7281e9155521c7b8680e22fdbd218c10a1d3d8249ff593b3070a6a44b6014804

SHA512
175bb0b57b6b069827f06a5ea786f339a34ab058b25dd5af588f100bb4a216a0b6ed43cc38f32bcf43a823b524aac1189c6148f84577ef0bf4238cc275af965a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fc13cbb3674f85cb4a2cc23e70247639

SHA1
8f9055ea2b723a15ef36d888879b60fafad6c83a

SHA256
19c6185ecfb12dba801807328eb3e31fe0c228fc16fa0da9833df435e8e45d53

SHA512
bec4988d77ddd0a088e18e02dc4f6f46e3261b0458d1fa49550d6d75f09f9eb7b774454e6c7646b1ece6018aa766e933a2dc94270ea8b1c5d9d1a03c7fbfa69c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9fd4d0d52f343f444abefbbd440f8e77

SHA1
2d57aff90100cbb3266d4e0f7b3175f479809f37

SHA256
334a326a6be841e487addf47d1fe98546f4b92dafc4dee145d97750bd3ebe506

SHA512
ad83880b9b538400db407940bcd65025ed3d497e14ef84a28d00b2c870a8a956613816786b56d1e4ed915b6f0e7277ed2ab3de9a00f7a3fe8061d6d8ff9f3eee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
eb815b8a6dad05761453ffbcd22f90d3

SHA1
80d5528fe96f63c8f0a86e488d8911389e465358

SHA256
b8aafcc373a609ff6e81d5be53a04493047e92f2122b8554cd3fe85117254493

SHA512
bd161bd8880d3ba8e4a0ecfa45e4efd765b390e4824c664305b5c3a1c7aa6dacf6b1c1b370da17a5f16ce5dff1156675d6bd08a2132119c69edde7e7f377bc15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e8b92ab51995103c88588b6b801c45a4

SHA1
26e30eb6490d01778f201f98971df0b58472fd81

SHA256
ae4e765f9bbcf3d0dc69a907fda7eddc21a36d53c8ff67ee373282e2f0639d6c

SHA512
6a2f41b410fc6c927d20a85ad82a4c88a9571850ec994b249a8d8cdd1257b32f4d8b4c7bafd86107b79c07b9b589e351d161999d25ccbb04f93ff323aaaec4f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ba75a2b21f46bf159ddf8a97a61b9e54

SHA1
8cd8dbd5f906599099e3f996a963ff2a7039737e

SHA256
62b1fa20a9f0fde3af125305dcdf8fbd848d8ee51758f7e57262a60b5e6556f2

SHA512
7ac134053893c798398ee5c068cfd4b818c18542f0fd55a6f382379cd0718d89638eff9acb533a68f92e5e15a5b493f28d0d2af07ad9ce0c91f7600912ef0891

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b5dd52f487fa1e17488035c2b027b905

SHA1
3ee085f1c50a33a51d9923a69b26f6dbcf90967b

SHA256
58553c53dda1058043171f8df0185ee2c66a634538e368df7a8b9564b955f66d

SHA512
506461d0cf9b3e9f4b6e5c88d3ea72fb8484696374490ef600952e49c263222047fa239e60d944c8dd95c46395b3e8df570a2145cedd7ce041f729eafdb67361

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
72b04eec76fa0d6aba491086dfb63c27

SHA1
97d1e1b868ebe2cd7f337f20c10bd22fb06a31fb

SHA256
9d477c6de221906830d477604c91d2c18d21e9405f509665fd3fac1504665cd2

SHA512
2273e115b9a85ed739b3889fe798770dea29f9374e817f544f3cb4772493ccfd47bd40d78dd07c3ae5d5f5598cb571186738881a87239e30b8bb4ae65c15dd07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e1d59b6bd8fe51ca9bbeb20c6d67d52f

SHA1
4e6095608a9223a0468ec10c7e687a3ab9373d0b

SHA256
9bdf2185c4ad20b3d0a25f82e88fd475a2732018e6f6a9928a845fce02ccd702

SHA512
5d49cad0683aaf6d4fb5dd89a293d1ec661032183c9a20f25dd74219e3ecd7fdbc1bdb71e8de72984ec8409c660d3733419bd0e558ab440aac2350aee7d799d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d67c735744f3159a9d0970c6b0816e81

SHA1
8150696608d2a42a1b599b32077a2a430353d745

SHA256
8452a2aa2953728ef0259e8cff08e8aa43867f311c8c16f8b12cc100179a14e7

SHA512
c65d88711a4f8c00208696e0e4617c44c4d6d31f914dca9aa6c6ca0f3f5cb1c532f0a43d7a3dc5aeb0baaf98716f4cb5be82fc3e71139c4dabda2fd9e02b4661

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8d1834b94f2d7a113630f2de2c33c625

SHA1
d5d449cb26b50c949b4e3b2d202742059936694f

SHA256
599948f3f710e7c3100d4c1cce30d5d7a9bcabb9cec4bab65ed95f7898c3e148

SHA512
58bbb64e8704213a7961a4a6ab9191f034477744bf573122c929f60d2bd37569599de595b7e8b8166dbec90999177114f64e56439f18a4fedbd14c5eb2dbe612

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
42b5ba45397afb5afd4346a33c953c7b

SHA1
49a437c8e9d1e96d7abc0adcc225821caf1fda71

SHA256
ae1780c4e731443d3662bb1b712f71bc8a830b96bb8b77669dee34bfae1751fb

SHA512
547d46dcf5c5c00945c84cac9f52d37e9d51b91e2a7076552c114e1ea773f4536fb471dbc5bd81a168b737462ed0e88344bcdc524349aa39b7f34c3d48ee5942

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
838eda2681e6c0479643921d19088141

SHA1
a137d2382d2f8427deed3721891fd5c1a6b06834

SHA256
46fd8cbdba1fede68cd5bfded3e79e81bf2eb79c25f31f3bd98d46995d17ad0d

SHA512
6bf9890a6ef8f8614fb829dea826fc5d4b1c0ef416ae99d32f2f8eb0b8a19e0cb8fc547270e1d7690e63d3f16f53598c74ee216ced45134c0857426e6c800e7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f13e0bd9899069dbfd726cafd12c6902

SHA1
f44edb94a101e118aeb57fdc4bd3f4ac5bdb778f

SHA256
d39f4a1ca76c185c51524800224411987812031efee4c5f93f6adf113b313aaf

SHA512
6c7381f2ceaecc53cf53c846903a05a7dfec5878ba1849a8e6e051e8daf677fe285c4c8e62790f6e61645cc8f4c2176e90cc9ef20482718244a4f2ffaf3d77e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0c2b91091b4ce88204e0db18c62ae997

SHA1
96091c1f8b6b3660bd6fd2a7af440089e550d6ef

SHA256
026e593876ed429fe3714c7820cc78ff82c1f6cf7817ab8672b64c1607cfbb42

SHA512
9dd5c44fe2f28d928a0083c1bc55846abdd54875e3a4d94b661b216605b381d69b3ab632d8b212933095e16b4ac0e6cb0d4d2864b6ff7a13dc9226f091c7d535

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8cbba562950f41b63c081553c4e0dfad

SHA1
b7ff933175270feac60278e20ef58c94ac2363d5

SHA256
f8640c4c9c3ca91101102615257b7bdc6c01195b8f4e26743e564973656f5681

SHA512
616b60f3ff716a17baa3dc4693ff0a8d14fd4d8149c2dec463927f818260b3db78b4c70c0c7ddc5205c6594c6c9385cabe9191fdecbe45c57895998b15b88200

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b8c51fdd80a81d83fd5bd5cb66569fc8

SHA1
7874722648759896317366b9115071d7057c787f

SHA256
cf1269add7607b2ac7a0294b645dff1ebb64034c331cc90a299632bce11da4d2

SHA512
05def3ac94d934337eadd06c6a09a094dcb14ec5c29e8c1aa058d761c2d1be1db54442fa8749878ffdc05d9a3320fa8f17dd031d7955c9bd48839e1378489a0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1b459c550327587fc4aad942ca9c9b67

SHA1
e2afa4e203de204fc5b9bf7ad7b8c5f43994b694

SHA256
2cd8d3a29e8db8d93b5db79cff1bde15cb1118cbf02a1d902733d91d5a3f542a

SHA512
4f6b385275dcda6f8782f78efef67db763fe29f9a34a26198cbc8d8db8f84d0319ebaddb45b6ed37258a0e3d52ad910965a36e5b761861076db5d9712ac2c232

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
92d7e6a82d115f3467180e720126a1d4

SHA1
0217eb63a02b74756667c9f98d8229a946920b50

SHA256
18efc5386639b3ffb11ad77761fdc564de83cbdba073f4783f619468bf22d58b

SHA512
0938ea3fbf3777e25e74009ba346cad9a2b14e11572e36583864f112143482ba7b5033b67ebdc8f152216e0625f63bd0a577dd5283db4ce5edce90e09b3a2b4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9ab9ae607222c285b6c3e9c8c1513eec

SHA1
940fc2c16aa686ed4d63af6a17ab4cfcd8e2525f

SHA256
e41907f27cec4057c5ea9c26fbeb91c2e3f60eb0dc31603ca33ff40a36348d48

SHA512
91a77b95e43e6d46e754fbf3f04e8d29504a4c77385303a46faeee4239c4cdda918842e6597150ecd5bf31a47eacacd129ca2141d75108dd107fbb1e847d7ea2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
994702ce7d3c59312f740339645cb6ec

SHA1
d4a69c489b6f2168d7d09fc6899efe5b9ece5dac

SHA256
afbcc57a9ad9682e87ca0d81ce7920600a85c8300d2b397ea59f3dc6fbab42f9

SHA512
a1e140a541632e249443d35ef7ade45ffadc0faf3f0bb99c68201c1fdc5950b9ac4344ef5bdcba379a67d7bd9d7abdf2bdc07c2b98ea10ea8420308b9b8bbf79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
488b1d3ab36f1774c28fef0d0ab902aa

SHA1
61b410d2c1be1d4321580e2c9e5f324474e501ad

SHA256
638994b7d050a5acd3d39835203cd304be6f4014fc9e25cd20884668e94e9d91

SHA512
1ba8bbd2ba214743849129d66e4da9f9dd0610baec25ae17ce3d54cb634479c707aed1c6a9654eaf210d800aad6d3515e9acdadc288a43d3019ba9a43844c3b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
08f538ff8885af28a858dfb97c2660ee

SHA1
5717434a4e8303b94a871668c1a752a220eaa44f

SHA256
b30946be531b80ab98d955de4e54fd1e40dedf9e6df88c092e8642eecf0a460f

SHA512
5f7daac6f024560b731892acd56fc162e2fa243314617076ee30ef495ff1d8c6f612342631dcc313e8899a06f4c35aa513c4b11937e09d932184cd6ea5e09792

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a18687ca7bf4a329714b3e3f9361105e

SHA1
449bcc2449ba2ee595e0952a69bc9d8ec15663b7

SHA256
06fbd9c1756ef18e215d7b6a61e4b97bde739ed008b12affcccf889a9567998d

SHA512
26fe12ada10638e9dd721a37d516695de8676b3bd22ec20658362f026b3dcd99c93869f4e3cc52c24bf342fbe2eb90cf2425c9e575f0e0e7ce459f1f07fd27e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b8016b1c4d66305807feecdd743fc668

SHA1
9165b28a7e95e901e7bd343ad246c734f7208868

SHA256
bcafb7e870184ac8ea22850d5abf8bb4c105473c4d5f46f9252440c989231b26

SHA512
3d15e98c8f1538753b9fcff855e1f636dca9015b778c5bbf49a0ba3431e35d0c5e561a464714700b5ab39e950c2e9498c3a8d4300c4d38ff1cf0bccb18f05f29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8493a90a1d8d5a99b503a21bcad0e226

SHA1
9a29f852bef47924ba68eadf12d3cd14875a72e8

SHA256
18d007c85bd46eeaa32ab0132790cb387c4c1658a888f715e3535c90ec37e770

SHA512
bd50b654a4a9eef6e1e58440188daa764a729cdc7c454bb1871bd22c0895073a6dbd965d85e5d0f1110fb379b9b3753e382cd7fcfaaab93b531d291a8dded73d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
65e2af4c6c4ef2774e17dcd99ba28973

SHA1
4293606f40cceb5ebd24e5cd406135c2626cecff

SHA256
c8a20ac3bb166507d5d4499345a3e481b6e113a8a94947e56fb08e9354481111

SHA512
17db85fa17938b8b368e469ab81ad286f0e1b998896edb318bb34c79d391294a2f529037ecc864490423e4b053aaa712c48a7a74a98a49772567e1f497d83c8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6ffacbdfe3d28a100abc78687ddff08b

SHA1
0da57f0ae8b93b788913ae1e0ed0b97067081014

SHA256
44a797354fe352440a0d10109c7abeab3631570894382ed15ed2d624dde33ede

SHA512
4e9092efc90557baa27f3db496ea4dff9ec336bbf65500c1b8df406c00ec6ef54b60d6b4ab0fff3b1e8cfdf08ee0899c6889faba06da1a9a6a5601114fb50ecd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0e3ca046c4cf4546ba1fbcfc86e30ceb

SHA1
bc431b3dd4577c2e6cfeec61d502b6b5be4ebb02

SHA256
3f5899ee6fb23298545d23e6db035903803d070e111a2e49c993c1de26867988

SHA512
860d083ad1a3f8f707eaee5a1af347f810be310fb9c6c2dfd9a26bea14ae165e853b14ce92cf9e39bc25a19f8da25942abe40597037477130721e7f4ff149497

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
25dbf1ea295bcbd151a2cbb1a192d556

SHA1
26f79acedbfde861fd925f131a459ca58f2e62db

SHA256
876208e122f7681524a686ab48e2a9ff42a690b2c0879405802d8e17dc25cdbc

SHA512
15b210dc5be88684a963a43a298d8337fae0877952522f2ce10e5643901b0064ac66c10145936bd3546f013defe67ceb7f103c81a475529e4f223705a77d825e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2a9783f517cc4bc29bfc99ff7e015fe7

SHA1
063f8d432f8ba2f5c9902bcc68974f4310caa120

SHA256
f6a45f1024f6a18731b5f6507e20d93ee5ba9bb0aa5e359b33d18a2be586d65c

SHA512
b79b0659881f7fecc5b2ad79ae2ceabbac85a0c3df297be3bc86a1a2dc36c99522f5d776d001fbcf8aaa34e3d9082fe7a03eaa3343de437bdae65e8b66395c16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ea21ee925741e24d019a29d02bad7bee

SHA1
a05922a3983651e5df0a94c1899f44b8fef6ab00

SHA256
a92883eff6cb699a603bc138604106d469c2d3727df5f9f8d0f84e81aea5c4a3

SHA512
e03e470ef7ca0d2866fdb64e9e544f818d875714d3e947fb8d66a715b4cf1e295d6b4f810501cb5e62fcdbc7993dcec727dd8517788a1c171590857119cbb297

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b03b9808d75b8a5caf02fee2aafed88f

SHA1
52ccb8032119c93a907f76896649fa8460374537

SHA256
c84b7e76783fdecbeee3573413676ae5787ac6f7aa76b4ca3cc83385f2dec8a3

SHA512
c95467d53323513ad82fea62153f2be41922214d39f1df1a843a5b5137359bcd188c0ca8e8c206502ba43afd22a71ea3bc88fa40044f2cb51c86085fa83e21f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
189e498c9412256a483ec79cd9f4befc

SHA1
4d3e80252603e1aaf5b2b7986f35fda65479a2e5

SHA256
f9cba04994b142b6e8eb2bf4396a1470ee7125f1f2989105bf2ceb0ed6fd5ffc

SHA512
7e4523785e633c7e20e20c658718e0858e88c8a926c1462a514fb767946b4a036d4f734f011501e41395eefc80950616ba04f0d95bbf96af6da48fdfa5222251

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2b3da6744d43f9c7036fa94927fa9c54

SHA1
151e6950061ccb637a0dafcb9fdee812ecc60da9

SHA256
ae8cf887477a1c1cd80ac392e38d104060725f684d257a42e13bf21d6fb5e717

SHA512
ac483c5d8dcb910b108faf9542ae5faaaa79cdcf3d5be0a150bdf3c2d55742ccd56bab460a94be17f3ce666f66ae006cc5336b1e18cdc1e5d060f2c39da69f28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
01021be5305ecdf88104eadf6cf0d967

SHA1
235cf3509bead519b100474aae8518265380ad20

SHA256
3b4d79e994cc76a939e132e2bc548e6c336cd11189cdc319ad46beea3c65bd5e

SHA512
05329212529a36b1dbfbf9fb0890d950bb96913470c45af583986bb2f2c94e25e9873bb74230d45cc16e757251e9e40dd3205bfd48191092175cd60669904ffc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
61e871f4ff5868992818bd1a0daeacc2

SHA1
ff77745714e71dd8de66cd8c27eeee9c541afce4

SHA256
32ea17ed98bdcc552d291dd48b9178df07a06faff7df29ef9bd05522ba1f67a8

SHA512
d4824581c42839d4a5e20a284e9440afb9334d5d71fa6eb9f193c995f8423274c846d34310e0ff112d72c02a8b37fb2677f29d1698f754e51ccc25af7cbe2507

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6334e424ae971d02bd737881482353ca

SHA1
6fdb82f126af8fb7208dec85eed05eb0bf72fd91

SHA256
5ae25bb8914490d76610c5fef5685d70172f0b896e300521289ec5369ef86c37

SHA512
a47e5e9f00e916cca3ae2e380893aa952e85b8b21aaf0eb7781884394440f9898c6b726e5721c1647276198f8835fc2ca4be65c1a22e63d42529042f24a9f798

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d56751abe8237fd526a18a5a14265b77

SHA1
e6fca54af3db53b8f840b78d25f198dc9e75cc40

SHA256
68cd5eda43d26c731758bc893051c3483fdfd2264c9ac242c3205edf913d478c

SHA512
f45ec4296a5845fb5106be8f6f2b85c5749a0c3dc9ffdf90552d60d3931463f9bd5029eacb206d8f34dec93695933170dd184ccdb5c3097dc8e066bde5e6c2b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
386f3f76e4bfa6744367a7e7e3472b1f

SHA1
770dff9c5fc36dc32b56d349f35b80b17f7c23a4

SHA256
f75efa8a30e4720ef1a9f66016b090cf033de5e7b323dca66796282c7926c924

SHA512
51f9dd6a52260bfbd5ede0679f7c17076da3a267d2d3c70933743e29120fc462a132eec50f8c7791d9f0cbf0421a7e2813e6f62de8c650424c287646782c394f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
460bb31ba4f130227f122d5bdd42272d

SHA1
10a98c120afda899afc0e7043c98cd0f06503e69

SHA256
a1031d9d513465c530de8ef0c68385478319fb39ab373cb06b834a4dc8173c4f

SHA512
d21fdfbabe45614b412cd0a14e3ad30cf4ed2d891769db17b81bd589812f6b5eed5b797abb64753c9e67b10b642971b8dc0079a756dd80fc24e69456b4c702fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
6c5e4106c83487f413924752525fa8db

SHA1
35e9ddb93b147ce50cdd4988134012112fc2b268

SHA256
014387a328a1054c8ae5b199e63ae2530b0967399bcda3f1b133b70279bbc9c3

SHA512
4f438bae97a111926d5aa8e9b2fbefbf8271b8f75621eaf38782f8a23b88287c37b4fd9b879afb0954f4040e2adf16e81bc02ed28788775c7049d421567bd846

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
1880786c61d9a7ae45947d72881bbd47

SHA1
a5532cbbb9b96d7fb63b2774fcc8869faac7aa5c

SHA256
a4ec377de17698eea5da967be6b898af6697d5f3b0e4c6114ff57fd3ef28374d

SHA512
db161774825e4156c8625b47bbf0dc24c71d36de8de1c385dd89569f1a7ff779d9c0c6f57773e50bc934b390d7a73c3e02b2ffaa33713a9c66add81ccf938137

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bde0a7ed-b0d9-404b-93c3-90bb397ebb8b.tmp

Filesize
10KB

MD5
36e5145e1dc23e61549697d81192ba18

SHA1
0825100f3e7bb0283da2f7de835a51427f6bf6ef

SHA256
dc728cb03652b5c7abce0562ba61b916cac40cd8438b5803e27a9c195f673f19

SHA512
3fb1bdeea80b424242b30b0ffe1321904d44cbeb7e996acfb8ec0cfb1456f338f85917cbddeffce3f0b5c109b25378e184eea5b631063c63780cb4d7d1f9c56b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eca28c46-fb42-4f59-ba36-ade3a2088d5d.tmp

Filesize
10KB

MD5
4831695590ea884f59d7d54e8eeba1d9

SHA1
51398436b4f2fd094d80cc65fc9bccb04716e272

SHA256
5a72aee77f844568238f121efbae748ab280ffd73bf67698dc6cc20ae99ea845

SHA512
53aa5069b67ff599f50ab72e2c37cbeb797cd8df12c34f1b4b993dde2d591483ef48d3c8d8a00dc3890bd325d9ca208761f3d44bc9ec7115bd78f2cba2c419ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
d0fd6ac8e0f26260dbe04219f04349ee

SHA1
c5a7fdc72816ade09a2e4e142a4d0920e68c3e92

SHA256
9be97ebab33a0ca197cfb04f8d6aa6ed59e7ca88dff636afa29245d15540e376

SHA512
f49568872a0c38fa820ca7b3150ab1cee9605c56ab05ebca7ee38f9fff3670a6aab3f24ed2de2baa08b978b3a41b95d2332758b4b4da4fe7afdc3ae3c8a2a78c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
f694195ed32f0e1be7d60d31b0e60d7c

SHA1
451aa0ba72e7ce401675637f5c6d776347b12684

SHA256
e002d6c867cc047d964cdbf176d7f2a496559936875062630c251dc3bf076efb

SHA512
c5c65c18a402cb063a5dec0598e3f8f989b5a4c4661a88c65e4f32eee9637478eed794b41a09826841ac53132cc1ebd98ef12bd1684aa60af2dfc5e92c211824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
ba2cc04bda8afa715a3f9084acbe2c58

SHA1
419ae2f9d9e1d0b39a7c05131cfef07b5282d45c

SHA256
0e239d57a6d464883ee7f493512af0f64826b45fc0a31bc4cfa0831c62195cc5

SHA512
8396acfb9be8d9ace1029e77d389bce9f9bceda8f0e436a662516f89157756972484b97b7dc108c8d43a5bf8b644cd01b21680a2c6aa672989184da2a8d8e497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft_Corporation\powershell_ise.exe_StrongName_lw2v2vm3wmtzzpebq33gybmeoxukb04w\3.0.0.0\AutoSaveInformation\j0kf10x0.tmp

Filesize
778B

MD5
13eabbd132a080bd3609db1aa84368a6

SHA1
e959b70223e7e0aae3c97d81a158f286960a3edd

SHA256
cea33ccf070eb7bfbcf51c5b768cafdb1dcb5691cda1230f864ca0f4ab8b0d01

SHA512
d9cfaf20da6819bbb3704bd552704c46e98369ccc852baab5a48873f7dbcfb2f2ef380cd590110824e0839037113df28b30a745e553913203685e281cc950ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI756E.tmp

Filesize
144KB

MD5
7fa9d662d634534d7c2240dd126bdeee

SHA1
bd01e22ed2da0d0d485824b372ac67da683863d2

SHA256
c0e8683b697b3c6e55deb4497d3434d6e2cc841eb8c9a1b7d3f8907cff7de206

SHA512
cbc737e3eb94151c9dacaa5ee780cb550176ca2be2e0c66925884b5bc6222b7bcde5ed66e881f2a76f3d26edf5331abf0e74c819ad4f5fd7d0819bc4c138bb81

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI75FC.tmp

Filesize
390KB

MD5
80bebea11fbe87108b08762a1bbff2cd

SHA1
a7ec111a792fd9a870841be430d130a545613782

SHA256
facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

SHA512
a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uav1fxiu.o1z.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4696_1439897154\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4696_1439897154\f2ef63fb-ce04-4298-8c90-3a39e4503386.tmp

Filesize
150KB

MD5
14937b985303ecce4196154a24fc369a

SHA1
ecfe89e11a8d08ce0c8745ff5735d5edad683730

SHA256
71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

SHA512
1d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c

Download Submit
C:\Users\Admin\Documents\test\index.js

Filesize
1KB

MD5
b2332ae83c02d22bde9752fd75b19773

SHA1
644f58ceff9b8a7467bd0fb40a3b2ce4c15563a1

SHA256
e0f5a98c57c86b12a9b8bc092c0698613326e9177125e97179cd7a756ab74265

SHA512
fca0a755ce7da2fae20e89d852aef5b555c5f2919f2055bd25fe3b21047c4cd5ad43a3e233d0b1cc3d8a81c1f668bf1a5416403290dbeb562e0af6d73a30e8e3

Download Submit
C:\Windows\Installer\MSI1760.tmp

Filesize
341KB

MD5
74528af81c94087506cebcf38eeab4bc

SHA1
20c0ddfa620f9778e9053bd721d8f51c330b5202

SHA256
2650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34

SHA512
9ce76594f64ea5969fff3becf3ca239b41fc6295bb3abf8e95f04f4209bb5ccddd09c76f69e1d3986a9fe16b4f0628e4a5c51e2d2edf3c60205758c40da04dae

Download Submit
C:\Windows\Installer\e57e510.msi

Filesize
28.9MB

MD5
fa9e1f3064a66913362e9bff7097cef5

SHA1
b34f1f9a9f6242c54486a4bc453a9336840b4425

SHA256
9eea480bd30c98ae11a97cb89a9278235cbbbd03c171ee5e5198bd86b7965b4b

SHA512
ad3e9469326dccac6b49185b5b2814ba700b5d83b4b3ce17f85a9adc5f90bdebf54d79800b253ed5c371ab82d27304841f86ab1a8a3c7ffade8a2d78e55dc99f

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
433d8ae6b9f53181f2f85642412480d8

SHA1
71b5f477561181ee086c64bbed05e1d70ed15005

SHA256
d8b33e7d93020d1a40d4d5dcc8aedd387c040dfd2701ffba8d083d985710aa31

SHA512
8b66c5d302522f81a003d98dc57e86ba466f2885f45489a16c06ed456b863599c0af71544f9425d23106c387847e0711d3d9a17da68341cf8d4f051c6468e1ba

Download Submit
\??\Volume{3f575a23-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{988f36ff-8d31-46d7-b558-839c8304762b}_OnDiskSnapshotProp

Filesize
6KB

MD5
14f15c9a470d7a825c0c575b81e0cfd7

SHA1
e5fe38783af3a2e2f8c53d1d902aa4a67f0e1f14

SHA256
3efa9c9e0c230c81380c5e0456d37b2f8a2c91104f4eacc2bd9a619a0de9030a

SHA512
5f15020f4aec2524a046d69236171002b626dbabfee5a69ca26b447b61b37a73d25877c8b260d98173ab6a2695a067d31619360193271588fea1a13d730c8131

Download Submit
memory/232-3640-0x000001FFE7450000-0x000001FFE7458000-memory.dmp

Filesize
32KB

Download
memory/232-3620-0x000001FFCBCB0000-0x000001FFCBCE8000-memory.dmp

Filesize
224KB

Download
memory/232-3639-0x000001FFE7890000-0x000001FFE7898000-memory.dmp

Filesize
32KB

Download
memory/232-3641-0x000001FFE7B40000-0x000001FFE7B66000-memory.dmp

Filesize
152KB

Download
memory/232-3638-0x000001FFE7880000-0x000001FFE7888000-memory.dmp

Filesize
32KB

Download
memory/232-3637-0x000001FFE7960000-0x000001FFE7982000-memory.dmp

Filesize
136KB

Download
memory/232-3724-0x000001FFE6CF0000-0x000001FFE6D02000-memory.dmp

Filesize
72KB

Download
memory/232-3628-0x000001FFE7590000-0x000001FFE7598000-memory.dmp

Filesize
32KB

Download
memory/232-3623-0x000001FFE7620000-0x000001FFE7658000-memory.dmp

Filesize
224KB

Download
memory/232-3622-0x000001FFCDB10000-0x000001FFCDB1E000-memory.dmp

Filesize
56KB

Download
memory/232-3621-0x000001FFE75D0000-0x000001FFE761A000-memory.dmp

Filesize
296KB

Download
memory/232-3725-0x000001FFE6E20000-0x000001FFE6E5C000-memory.dmp

Filesize
240KB

Download