hxxps://github[.]com/wojciech-graj/doom-docm

Resubmissions

29/03/2025, 11:16

250329-nc76zsssfv 8

29/03/2025, 11:05

250329-m6vmbatlw9 8

Analysis

max time kernel
627s
max time network
623s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
29/03/2025, 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/wojciech-graj/doom-docm

Score

8^/10

discovery macro macro_on_action

Malware Config

Signatures

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
behavioral1/files/0x001f00000002b26b-2195.dat	office_macro_on_action

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
27	raw.githubusercontent.com
49	raw.githubusercontent.com
50	raw.githubusercontent.com
51	raw.githubusercontent.com
101	raw.githubusercontent.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DOOM.EXE

Checks processor information in registry 2 TTPs 27 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 33 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Winword.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Winword.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133877199185081171"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1736937623-2710279395-1526620350-1000\{C617AC51-8546-4504-A885-1365153A218F}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1736937623-2710279395-1526620350-1000\{532DCD55-055D-4918-8D49-BF16C05D362A}	chrome.exe

NTFS ADS 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\doom.docm:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\doom (1).docm:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\Downloads\~WRD0000.tmp\:Zone.Identifier:$DATA	WINWORD.EXE
File created	C:\Users\Admin\Downloads\~WRD0000.tmp\:Zone.Identifier:$DATA	WINWORD.EXE
File opened for modification	C:\Users\Admin\Downloads\doom-docm-master.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\doom (2).docm:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\universal-doom-main.zip:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 18 IoCs

pid	Process
3240	WINWORD.EXE
3240	WINWORD.EXE
1952	WINWORD.EXE
1952	WINWORD.EXE
920	WINWORD.EXE
920	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
1192	WINWORD.EXE
1192	WINWORD.EXE
448	Winword.exe
448	Winword.exe
2688	WINWORD.EXE
2688	WINWORD.EXE
4116	WINWORD.EXE
4116	WINWORD.EXE
4260	WINWORD.EXE
4260	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
2128	chrome.exe
2128	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1104	OpenWith.exe
4116	WINWORD.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
692	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3240	WINWORD.EXE
3240	WINWORD.EXE
3240	WINWORD.EXE
3240	WINWORD.EXE
3240	WINWORD.EXE
3240	WINWORD.EXE
3240	WINWORD.EXE
1952	WINWORD.EXE
1952	WINWORD.EXE
1952	WINWORD.EXE
1952	WINWORD.EXE
1952	WINWORD.EXE
1952	WINWORD.EXE
1952	WINWORD.EXE
1952	WINWORD.EXE
1952	WINWORD.EXE
920	WINWORD.EXE
920	WINWORD.EXE
920	WINWORD.EXE
920	WINWORD.EXE
920	WINWORD.EXE
920	WINWORD.EXE
920	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
1192	WINWORD.EXE
1192	WINWORD.EXE
1192	WINWORD.EXE
1192	WINWORD.EXE
1192	WINWORD.EXE
1192	WINWORD.EXE
1192	WINWORD.EXE
2200	OpenWith.exe
1484	OpenWith.exe
3216	OpenWith.exe
1104	OpenWith.exe
1104	OpenWith.exe
1104	OpenWith.exe
1104	OpenWith.exe
1104	OpenWith.exe
1104	OpenWith.exe
1104	OpenWith.exe
1104	OpenWith.exe
1104	OpenWith.exe
1104	OpenWith.exe
1104	OpenWith.exe
1104	OpenWith.exe
1104	OpenWith.exe
448	Winword.exe
448	Winword.exe
448	Winword.exe
448	Winword.exe
448	Winword.exe
448	Winword.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 4256	4476	msedge.exe	81
PID 4476 wrote to memory of 4256	4476	msedge.exe	81
PID 4476 wrote to memory of 4972	4476	msedge.exe	82
PID 4476 wrote to memory of 4972	4476	msedge.exe	82
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 1664	4476	msedge.exe	83
PID 4476 wrote to memory of 240	4476	msedge.exe	84
PID 4476 wrote to memory of 240	4476	msedge.exe	84
PID 4476 wrote to memory of 240	4476	msedge.exe	84
PID 4476 wrote to memory of 240	4476	msedge.exe	84
PID 4476 wrote to memory of 240	4476	msedge.exe	84
PID 4476 wrote to memory of 240	4476	msedge.exe	84
PID 4476 wrote to memory of 240	4476	msedge.exe	84
PID 4476 wrote to memory of 240	4476	msedge.exe	84
PID 4476 wrote to memory of 240	4476	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/wojciech-graj/doom-docm
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2bc,0x7ffa30c6f208,0x7ffa30c6f214,0x7ffa30c6f220
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1868,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2256,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2500,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3504,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3512,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4140,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4164,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:9
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4184,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4284,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4280,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4388,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5300,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3692,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5940,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5940,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6128,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1108
    3⤵
    PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6432,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6312,i,14283808492774188592,13877836276359835478,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
  2⤵
  PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1f3edcf8,0x7ffa1f3edd04,0x7ffa1f3edd10
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1892,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2208,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2260 /prefetch:11
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2376,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3436,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4148,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4184 /prefetch:9
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4604,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4776,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5388,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5528,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5460,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4460 /prefetch:14
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5428,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5656,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5668,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5472,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5804 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1792
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\doom.docm" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=212,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5008,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5976,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5604,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5628 /prefetch:9
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5560,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3532
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\doom (1).docm" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1952
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\doom (1).docm" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:920
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\doom (1).docm" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3492
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\doom (1).docm" /o ""
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=4256,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5740 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2128
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\doom (1).docm" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5788,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3400 /prefetch:14
  2⤵
  PID:244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5644,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4480 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=3172,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5072,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=5648,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6200,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6176,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=5016,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6360,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6384 /prefetch:12
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6568,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  - Modifies registry class
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=6788,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=6864,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=3400,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=6840,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5632,i,8216421713569444350,2258756424135514067,262144 --variations-seed-version=20250312-184628.452000 --mojo-platform-channel-handle=6856 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5052

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4920

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2200

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1484

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3216

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1104
- C:\Program Files\Microsoft Office\root\Office16\Winword.exe
  "C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\Temp1_doom-docm-master.zip\doom-docm-master\README.md"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:4100

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004DC
1⤵
PID:3536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:400

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:2584

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\doom (2).docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
PID:2688

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\doom (2).docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:4116

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\doom (2).docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
PID:4260

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
PID:2928

C:\Users\Admin\Downloads\universal-doom-main\universal-doom-main\DOOM.EXE
"C:\Users\Admin\Downloads\universal-doom-main\universal-doom-main\DOOM.EXE"
1⤵
- System Location Discovery: System Language Discovery
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
471B

MD5
5e9c6d7d1be68fe5c5ea1290ac28ff26

SHA1
66c9956d270adf74fbce28348a3143e543c5150c

SHA256
64c55f5ed65202954c5c4fe9bf1b5454a8f66971f48a867c24126a77ee010648

SHA512
59785ded1854ce5d71327f837a8c6cbd04f06cfad6ef9b98d768aebdfad72948fd2e95e19e531b7988f266dec904c3f53732f9f9e9ed9c45d66d16b496290745

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

Filesize
420B

MD5
b40fcff5f8baca07086d4e87699707df

SHA1
916f35d3b8d6c15b55418bec15198d597a8226a8

SHA256
97080b8a334088c31a4d4695461b79ff4c9d02a1ccdad97a22eedc8e2bf852be

SHA512
2451c74d9dd21ea8460c5ee305c54c5fc7fcf6b97f210de5a4b75524040ddd1911bcdc40835ec56122f6c39ee8d8eeac19b70b080460a240f1279f94f332f217

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
5ac4a81937577fe9fcc65234ac810470

SHA1
b40c2a12aa6616d7e21b0defaee2927fcd310680

SHA256
6fe524741b7bc19cb97f0eeb1b01ad31820153dbcaffb1de4b15cbeeed57cec1

SHA512
8525e55e06022f3670e6d3606813b08826b24b2571bd7fbc68da53bc752d5db53392bbd858ad511ac0c19a48180e5e8863cf94beb522b7bb87091ed39f10e09a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
38KB

MD5
b8103746b4757c6332fe545f11de8f70

SHA1
588965d6333eb015af39c7f44ce71dfac67fb0f7

SHA256
4177d563a186175d3a67091c399db6c57fc271e202406e244d4bc8ad95b1aebd

SHA512
c83bd52d674d90752dfffeb76971a4f9684054d6f02cfdbe8f336758ac46d8b430f306cc64be00112b8c38d191afd1b8395d58600b12cefcb6a052ab70214ebf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

Filesize
21KB

MD5
ec0963f084571ccba8609e51d71bf6ec

SHA1
b4a93e1b2e235488747b17c212ae14e5551c2db9

SHA256
39041d7cca3821b6b33037d88740780d6c1b380cf4973f7a869b101d35b015c3

SHA512
88689aab98763297eb045308d3a1c415bcb0dcb58dc5d3f4338e5c92018666a0b0c5bc2cc444ffe333c4b6ea54f0286a4c6310a9e18d418fba83ff2698be5525

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
21KB

MD5
6bf0a11d94eea9f5dbb2e3878d26a2e2

SHA1
591206d03341c1083843a43d6774f66b6b9f171e

SHA256
ed3e1c41b0dfcfa1f28020accd8442e28df7ad1ce6f497eb0d070e2b89e16892

SHA512
00c277d60f835895069005f594e93ade91b2152c7a6f6f9f3b15916a3bf7a10f15f60b8f0f212930aee7fb86888625cce14f0bd4d8801fa3591423afa2103d59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
36KB

MD5
2661bff6dabf18be9bcd62fc612912d2

SHA1
6e90a28a20d59b0383f87355b39f05254bfaff20

SHA256
d8be88da29a93137d4e69bdb3b486f9b48ffd789a4e54bc0200acd8decb1a6ae

SHA512
f210e2c8e29ec830fd6d46e60bf714abc224c5d1465a75395060fa6cecdf4d9b627c1208c40ef4c39e52cc1697c38f22c8f1882b30b3daf7eb4602dfe06efc69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
59KB

MD5
69c3c3700ea2f100c905f838cbad43cb

SHA1
db70a0d95ec6c9ccbe15d65926204bd4b740cbe7

SHA256
6bda69e12c05bbdf9a0e765b6c440751405e545526d28021c36b0cc44a0d18d0

SHA512
1a961604fc64dc694a6ae92091eddc6e70d4c44fe441e31d073c5a3a2d02f67721ffe0fe6cabbb01999fb14a4a6fa360e55ec03cd39cc7754dbe618be059e5b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

Filesize
18KB

MD5
89ee4d8818e8a732f16be7086b4bf894

SHA1
2cc00669ddc0f4e33c95a926089cea5c1f7b9371

SHA256
f6a0dfa58a63ca96a9c7e2e1244fcff6aea5d14348596d6b42cd750030481b82

SHA512
89cc7dfae78985f32e9c82521b46e6a66c22258ebe70063d05f5eb25f941b2fd52df6e1938b20fe6c2e166faa2306526fdf74b398b35483f87b556a052b34c5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
55KB

MD5
92e42e747b8ca4fc0482f2d337598e72

SHA1
671d883f0ea3ead2f8951dc915dacea6ec7b7feb

SHA256
18f8f1914e86317d047fd704432fa4d293c2e93aec821d54efdd9a0d8b639733

SHA512
d544fbc039213b3aa6ed40072ce7ccd6e84701dca7a5d0b74dc5a6bfb847063996dfea1915a089f2188f3f68b35b75d83d77856fa3a3b56b7fc661fc49126627

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

Filesize
27KB

MD5
fa2d7364a6cdbe8144bfc6add239bfe7

SHA1
2b37b884e7235429a2b4d675cf1d4975f9081d4c

SHA256
3624f864be1b01a4fbcaa4623e5408ae4adf66702cf2339ebf5eb5b4cf993ac5

SHA512
5a30f88a98af6ab94a0847989d9bb98d7e459232ec7a0ebfd0aa7f4405d0394fdbc439f33fbe2f72319f7cd8789e80443a122fde0b4f743833ebdc28bda37f92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

Filesize
16KB

MD5
db2656b672846f689c00438d029d58b6

SHA1
43b8d5085f31085a3a1e0c9d703861831dd507ce

SHA256
aa3f28db9caadce78e49e2aeb52fda016b254ed89b924cdb2d87c6d86c1be763

SHA512
4c57c347b10ea6b2ca1beb908afc122f304e50bd44a404f13c3082ba855796baef1a5eb69276d8744c1728578fa8b651815d7981fcec14a3c41c3ca58d2b24ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

Filesize
541KB

MD5
d086a2c66435e06ae793aaa8a7634e45

SHA1
9fd5b344e4d3506e24c0da48d4d6f0111e07714d

SHA256
6a88a1aba47575363afeef4757ff58f9b9a298ebbbf56a8ff9135628613106fb

SHA512
40ca7f0b47f0da4ac6d34ee40e52f42895091dc041aad0c9cb0c6c0f325871cc9d166c157fa7276ad56a1cfbed6215618e7173c2e58ff281cfab492a49636b10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
16KB

MD5
dde035d148d344c412bd7ba8016cf9c6

SHA1
fb923138d1cde1f7876d03ca9d30d1accbcf6f34

SHA256
bcff459088f46809fba3c1d46ee97b79675c44f589293d1d661192cf41c05da9

SHA512
87843b8eb37be13e746eb05583441cb4a6e16c3d199788c457672e29fdadc501fc25245095b73cf7712e611f5ff40b37e27fca5ec3fa9eb26d94c546af8b2bc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
45KB

MD5
be446adf51e1e2ec8565855652e2aa12

SHA1
6107bee1993c6bd9fe14de6f011659d0cc2f7429

SHA256
f6b290ca330613ecb353e80b63c8aa8e2c3394c56e1fe14649339597d1d08a06

SHA512
b433ffc883c97526611f2be567ea56058b5476d9b940bb359f5533f1d046e25465a75ab3c24e5d85bfe2076d5f69d6aa6e7a6e1a2dece45e390c2c70f129bfe2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

Filesize
109KB

MD5
c1ee23d7fed88171020d29143a2b229f

SHA1
04fdd36f5e374b0392321a99d9fc2d692d168fa3

SHA256
3a5020be3f22468a80da6beeb67478a7c51ebdb60a088640434117a33fc84004

SHA512
6ffd3d66cd3115a21c7fdbcdb8225c4acf65b00d20fb6869a56b3f04408127c28f1abd8218c3d5fbf9605222e5aaaf0a916489d71f91865b24453a4a2f7f6cfd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

Filesize
88KB

MD5
2dfda5e914fd68531522fb7f4a9332a6

SHA1
48a850d0e9a3822a980155595e5aa548246d0776

SHA256
6abad504ab74e0a9a7a6f5b17cadc7dea2188570466793833310807fd052b09c

SHA512
d41b94218215cec61120cc474d3bc99f9473ab716aadf9cdcbcabf16e742a3e2683dc64023ba4fd8d0ff06a221147b6014f35e0be421231dffb1cc64ac1755e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

Filesize
25KB

MD5
64ef6ec481b87bd3b281a3fd8e0483a5

SHA1
48ae23e88455a10a4fddb7541a599ee55310cf95

SHA256
9f44e97732d4a6e996238fa94b9b8f6c3a6a93dd23fba09b93d9ae9487f6a92c

SHA512
8fc5d0fa10c2e7bb93d3c3bf39ee8e45c34e68530d6b58c95cb46f265fd58c4f32d0aed52b3d83ab1703705558420bfe8f756f96ce6300abb94f446b08c484fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018

Filesize
16KB

MD5
dc491f2e34e1eb5974c0781d49b8cbaf

SHA1
b73ca9b5f9c627d49da4ecbc3455192e4b305a3f

SHA256
f956049f0d96d455a71003eba400cb94f7067bc52620cd05b81006ecfdd438d8

SHA512
5c9bd0d5c93a05ca76eb727328a0fde40f2be7fe53b6b6c9eb260e8f20f92cfc831fd4b46f954d85baf151ae8aba1cdd6f76b0faf96217922cad844c905f3645

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6d461450324fcf40fa6ce81f9fc78bcd

SHA1
47230c6f2d36b37aaa3799518e287ae9f5a53ea7

SHA256
ba3fc37d5d455e483b46aff38a7801dd04355701e6ccc9c35f06211e0162a618

SHA512
503391c19e59ff698e3eecb1f3bd98ed7a5360046856fcaa89866eb9a6db870a403f1700dbf04e75a9feaf9bc266c1a637e4206f649555a42cd9b731b6bb5660

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
9b847159d3c3a1609e7853af3330845a

SHA1
57cb81b0482eeee99610bd6cac457e9b2979614f

SHA256
54b7ca62ea3e7b0128f5b76427facb9fdc48fde7093e2caf90243a345985aac2

SHA512
3790eed8e41e4ebc72b2f3509d706de586ef99a864f5f5318a33382a79f42d11510e205769488aac1ff5b0b9fd1fee9c8319439401411000162cf0c9da47a882

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
593787d31a86352eb9cd69bc5339ba64

SHA1
b5a2f60a30e63df8463855ac9b704b3f0181926c

SHA256
952a175a3cf306742fe353696eb882444ec474eb77166f70aaac9f44391640e7

SHA512
9ba17a5a83d04330de4eb2ad957374a5fc5ad30d956cde9489e05d49a07778170cfac43004203fe368a854526c57e6cb453b5d8ab0de86d6c78fe6d95c360f26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
97d07d30391db8357a06dc7e68755b60

SHA1
358a2aa588ef58f67300a2a7b4bbfab8984c61ef

SHA256
6bbf67f8b94ce8ce3a251c0037fb1ac3b73320a435c79acc9ebc6cab5ffac7b2

SHA512
020c3679721699e6a585514200552194a31af3cb069bbaf1f423baaa02606c968522229203990ab6d1c019b134a53dd056bd2ccca2b061c103f5aac0cc972b35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
abe1fc23fcc3b1f6d8eb29507d7191d2

SHA1
4679a3b354c6374fe9ffaa368c2f9442fe695c40

SHA256
87b0973e5283966ef57cf4b286ebb1d48a8967e66b7033a6f68b4186d707c80f

SHA512
86d2409f7dd8592615da0547a1d722b6f2dc8b6666b394fb7267fc2480e050dbb151c6f74ffa7c6589ff447df5011a6bff33ee7da3d6b3b24c80a4e63a4895fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
525494eb7e9adbf18ffe72736cd0a6d6

SHA1
0a9b1627224fec46bc2c9f964c59942aff117c72

SHA256
d7c977bb51d3cdf9c3a958fe7f8bb60ec9e4563be243db5b708896acf9a1d002

SHA512
692b2d17b4710623cb690b87ca6e3b41e2b3bf7aaae769dedbedbdf05d6ca3d926c4980799b93f069c60d196eb512312168afb8d56e52650dc64e8b69f30c8a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
9ea80aad1762447246eb5a9351ef8428

SHA1
d2a642a06f40b78be7695f5aa736da0d0366e5e1

SHA256
30061ab544d65848f0a385f9efe285da9e0ffc3a8146d60a760b5fa7d915c02d

SHA512
800130ad2a99825a72f3a419d8716c5111c6f71b8e5413fd75c879433e9b531a245317bf1653436dc9a4bd815b443398efc5b47056946c1e8b45c3a337410ea3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
552957a6172ead199ae8d502bbfd09b3

SHA1
90fb956319bf85ed9df76039733821570df7f3cf

SHA256
a333f1c20d04a53fe947fd64ada70ff93d40f7ab784ca098f14f2860b54c8f85

SHA512
18a5a70565500e588d8db1e82ec5dcbad539f1f5f01d40c344d2ff2c7daecca994ac83a62cb57cf4499acc5706620b623119421fb36d863fb01879d3d8ea107f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
9KB

MD5
60e7107ca93289430b4556b4ae2890b5

SHA1
df8a3a7b5e7d6014f5ac113a846dd308e1eb0c11

SHA256
02ad3b3db7ce004ed4c4fa37e31154f60cb8dbf1fbc3c12e20f7123732077b83

SHA512
4682db7619b4272f549608f1f1d66b222a5493911db85d9114835b123ec325e8f5b21ba7f8707342b006ee48fe0e5a45042504f2a08d98f6b8c9b1651d0fee1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
6d51e574937016695f2802cf8476d4c3

SHA1
03abe0b474697131e7469d403307ffc76cf8a18e

SHA256
48470a5359b2d46929bf1b4815ae5412d6e856bc874754c0ff5f4a93675b6d89

SHA512
dd316be7594a7086e27e1ea36948e7b72e0bada8e533fd92aa92de2b5a049c80a8cfda52b92426e814e3f3ddba628b1087051d7372dcbbe7c9c205eb68e05d0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
c94b3ea9757d2d89890e68421a8dd8b4

SHA1
01716bf4099c1902f634cb32e2802ff8ee23eadf

SHA256
6bed29b0f1d847c8a450cd251ae4825fc9427e6cc319fd9669dd60361b31a9ad

SHA512
6e63f4ccd090154c1f1c9d552ebc57e05fbff748f2208eca5843ded1aa63219dc2bbc4eb04f9d384f23911b07da51418a88cc8d36e0394cbc9463d14e4a52e66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
9421dff0910a61ab5c3429f7786655ef

SHA1
077aa739a5d1fe36dbfb7242c00cb46c379e5787

SHA256
d6c19511813311d84e6e714c00e7c0e0199599ca85878a12fcf2abb50f6ac88e

SHA512
3199702993ce07c0dde24e105174a1ade1e1d4239a6f7fc307a8597c76021be13159d55cf1e007e455442a15bcfb32e20127388e2976bae6899932fa72e0f91f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
1d1c3c00e5d9e531fc69a19dfa97b20d

SHA1
d648f5bc621a872c830d9806a0465a0d142f924a

SHA256
2ba0e13c40860db4ad7ba9076f880da5ec60162f37614948644939a9b0276aac

SHA512
b6a2c569f711202ef39b673d15186e8327c0b760e0303dbf177f1cba3441a7257434a54d5d547c5076cb93f4a793d3fcb50e9703670a9a87228f0012c0309490

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
c64917f9db18597721fab6cdf782cd7b

SHA1
f23f14cce33dd5ee74c8e339af227823dcf52f11

SHA256
61ebe2f5b7d4f9d5b477877eb5da38370301781057a602da3900c982753c2af6

SHA512
9ac8cc2606fb093e5062caeab1a711ff90504e292f2f6d400e9a3ac86ea756657b0a022baecfc0fa30d30e10494e7f034f1a0a8a03bbfb263d6c4c02e471ac7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
354d0b4b24863dd4ce6b13a06104c3e4

SHA1
7809733e27986cc76ba21bc177562af84ea79100

SHA256
25a0530203ba544d53de79f3dc915c8003d5e84b1e10d26982103624d6238bf7

SHA512
a50588f9da9e77918f37c257ead5cb135c5c637934cc43953045029cd0e30ade06dbfa7515ca2fcd75265710ce470218413114e501a18bb6fa576532ff5e787b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
62ad226b9c5c743e82dc8c0708fa29f4

SHA1
2af0aadd829ab9bf689db48044a3754a16d10de6

SHA256
ad2eb056370b786ad8f07db20e8a1531172a7fc2ce8e17ce4d522fba7333ab7d

SHA512
7fcc3b7edcff548ccc7ecb16a5ba499dc98d30894e2152c094a4db92202304b48c549c9a0f9c90a4ad311d7b4da44db0f6a29405cec207548b88470fed89554e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
4b585c77df543cdc63738603cf5af2d1

SHA1
bf1e807b305caad790cf56432ce06baf5c3d5e65

SHA256
b87ee41b857940764e81c80879192a90e680cb5f604d04751e6c3925846c074f

SHA512
2042d900e39f6f1fcad882f5d24c4dc4422fba7298933b898629229fcdc59b23f5f7011a38ff3491f0aa006c0e23e3d2787bd93d8910edb436e51ead5a6c2713

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
db7177a7a5c26e7acd96e111ed851ed6

SHA1
29438890ebdb06c6fa52f44964a6618f39b1218a

SHA256
e08e9c0de5ea6b48c7640e92a27621e7a50713177292e84907d41795fad66c65

SHA512
cefefe6114d0f8e026458fcb6282c61265e0eec4f12b0e930459a547285c5cd44e1416ca13dd912499d6779d768107f8eabc8549783d323a410da5f638bfe3e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
84dd76598377b3a4f252843d35b83b20

SHA1
22b8fa3076803aab446a7952dcd53e045efe57c9

SHA256
92482ab7c5cd2554dacf835f850d557b15f616c95364133bc09665aec71b6331

SHA512
bc75eb77669e5eb71fc64c2d14c75bbeba60c3ee9e340740471003537c832cb4ae09e195840a84e871780eb57bd06ea639fee1cf81ecc0061c19b81decb406f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
2902739543909b9586a451dc45bd1ee9

SHA1
d5548c0fa30db3dcd5f2df86e42813de9ef4cdbb

SHA256
f29050b39691053ce2b9d6898aaf6bb13f52462ecc3f54ea28f70ee0741b4e99

SHA512
b0bad4123818e7885f3c27b92cea3a9f0c5f57e66d9dd61789a4a46594cf810f63f667a79b28aeb94482395af592d3880f53c12f6e57af026481f319dba08e07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
583edf9e48cc4739c8d091a6ff4ec4c9

SHA1
efa10cff752a9dc2a231c9ecf69c76a199230234

SHA256
fba8ec4d82f686a85bd1a0072c1a70702043ebfbe1f528362bd021b6fe8f4e07

SHA512
891ef6966722304fc5c2bcd4e2383fc5fce01e80043d5eb2b1486ebdb994d35b1f54b6fc01d81060bd358b3aa4d9bc7cfee3f6640c04459c963716c6bde9eab2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
1f646dded1580c2dc72c101d70600276

SHA1
a334cc6a10c8dd8dca15528b6141953c18a4b29d

SHA256
912e6b35808bff6dbcb5fb0a52af407886a056d56f06b433c8cbdb4e380b049c

SHA512
ac95381e5261081650f641d6de5b417e4e20d5ba6877db4b600974071f8125376895c2c568d6898f74a81d6092bd328e4d57716debf48a2e1fccf86df9607a44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
e2ed457123d6b0a10568cf80979a92b3

SHA1
92938310e652d06fb5f1cb48fa90837165f22eae

SHA256
a229765ecfc584e6b21b1841f75b4e61d7fa19f22477a8b68fb1c31dd7bb5366

SHA512
b5f5f0e2b341e0fee925714529f82fbfdd89bbbaaa6b33503170755518f8c86688c5db4a6aabec90f575791c25467b63feeba8da0ec815db94900bb19f8d3aed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
18KB

MD5
0cf7a5d8964a05672de579de5561f082

SHA1
e77d237e10e53cc9a4f1bf714caf0b42eaa1e1b9

SHA256
fab28c44492b2070ab3bdeaafc875575c4524a48424ed8235e65dca3a2835b4e

SHA512
4adc32364ebe0fcc33b379d6304539816b581e073a37d7bb0c168ba01d9afd243b05db492d70eade335ba9b86fbd3a526b7e7e0339c482f5736b174bf25917c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
acf607c25a0a999f9aba4932f2edbb18

SHA1
e3b1c28c703bae079802c9ab6f6752a7cb39c365

SHA256
1205bf5491b150f9aa2a62e5b28f0ed9962769c8a26fd3d05d769cce1bbee2f1

SHA512
e84e0215927a3e813aafa7633e1522f789404c85ba5081d79fddaeefcd476f31e19a3f2757861213d94929bc676a01dc78251ee8f861d7785a5c90b763f547a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
3e2fa48b823bb0928bd14ffa63c55181

SHA1
9428c862f486616b77b55667530d375fc39ba406

SHA256
799e427e5eea3205c701655443cb873c89f97a40b90dc5ac60b9852e6cb86a1a

SHA512
c16d101c7efd855e7397849996d19f7ff0821dcd0f3135943f91e227d534dc963757421d4547aa2de62ca253dee03afa0f16ef99a74df9385b5f50fc2ca4de7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
43411703a26a7ccaa3d535a07c662087

SHA1
0ae40263fba209f7e8a2ba4ec575de33b4df78ce

SHA256
fc2ad7d4d1e14addc7ee035d60e45a6ecc2debb482c35458dd4c68e4dfbde6d7

SHA512
98a64b26e07cb4da1a7ceac4f4f5831169601b2035f7a5bb12283fadd7ca493d3877f406ee6a04019ec9ab2b62d271a8f9d0f96171be738e34a64d8a5498b22d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ecb2.TMP

Filesize
72B

MD5
a5be76bb097a2692619e3f44a95334ec

SHA1
578b92d34d16ecca5c9d8df121fb40ab8f399fd0

SHA256
7fd7e153e4041b1d1f2ee6e05f959463bfed51906a8d6cdc29833128b1758e37

SHA512
3bbd7ebd32dfa494555716879c4942ead66ece66832c2a140c2d73d2ae78393fa11dbb4d8b3be7b93511b65eba2f849e91cf3f351fc6864e74b04768cb1dcc33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
155KB

MD5
f34b784daabb08ac58368619838823d3

SHA1
956afd69e74b094d512c50a89f67093a0126db21

SHA256
6003bc2e16ec128d2e2a6c947cd69b83cf9da3bf7e90abfc7210e91216960211

SHA512
8d041b1fdd512c38c3a0a3c800203c363622f6f557de1a17696a4cc30aa37dc829c63154d5ef1c9616e4006ec6ed0691c7bf75f2840734c88b4ad74ae68708ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
79KB

MD5
b1375b96c9c8c576c7e5184d5793c36f

SHA1
12516bb87a18c974322a51df9077905a9f109304

SHA256
a34f5e1ccff7b7f71d141991417bd9288a34f8c7c7ecc64772b11272db21fa94

SHA512
1265271d314cdc8907f32158c8040e0f3dd99bb59ba2311cc0b17f47f62b97ae8fccd640294a5bcf5f7b4a3c3b1db97fd942807abe0f6e0db9e8a4c06d204e6b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
155KB

MD5
36d328555c8b1ce423c8d2ad04c70105

SHA1
36ab2652d3bd164fae4ba2a883c835e84fe73075

SHA256
1a0af71b858ac50fc6e7a4e144727bc03c60a746f92e9b814b04d6613f8e9d17

SHA512
7c77d8ae6bab7960e88fa533c832a2743b6acae189aa05a9bace9c6d1ffc8985cd00fdbb3fa8ee8528991640f6036e19bf823559b946dcc4f9f11ac60ca70494

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
156KB

MD5
70ead245e8d943751e6b77c99cd725f8

SHA1
c7a2e5af9361e44be389e7dee35314c5bd938772

SHA256
74b6d259d71cac8e220bf18073b9c2ec9d60f14d52eb0d5b7191a4f574c8fc21

SHA512
0693faba66a837422fc140af23d7f80f374b8ba1020d216373006cd8aac005d5241a316fa3077b10354e96018b60ef778f7e27ee37e7f998c83e03c0a640e1c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
ecf610ffadb6b05b729f1fb747c925ce

SHA1
552e136d3b35f6554388dbf3de27cc3f13aac1aa

SHA256
e60d57b0c686fee38e691bd9736e26c41a31f3f058f68c1176c0a71f8108abdd

SHA512
ac191b7ef1e260e052031443b9e97b79824c03ae79dc76639317c4f3c70c33ab7b3239cfcf38ae5ed803adf4bb011bb9a9973cb9ba1787b91de2c171cba803b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
bd575c2c20a42eebc542c0ea3cdddcab

SHA1
5d7c270094086da4e00ccde11c207e74654e064e

SHA256
a7c34f18d3331915088cc8d9525dbb0573b95dcd286b97fb3b368b3510abe7d7

SHA512
22ba7fdd9eee8c808c9cc8148ce89c86d893dd32424a65b0685946ca6a0f1d6daef99e45a65584a02f28fa1286aa709193ab65ac2f2d21ce0a82f6c9ab9b8aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
d078e361e0ed3a9230b38d7f87140520

SHA1
235c905284ee451b6d19054ce804e8e02a4dceaa

SHA256
c568a7aab912809de985c73e6f662c91cf29ef7e6d91ef6a2ff03989f0894338

SHA512
79eac09b34e1b2274901e9114c16212b608d4ba2c8875e000b77b6cab80578e25ad5c8020ff0f32c4b57884c7bc41cc494b936b4154f5d922ebba3e6457ac9e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
3963163bc1cac7fd95b56ec6775abc5b

SHA1
11ea3bb96c97a8b8abe3e8a511fec86d79b5d6f2

SHA256
d31600f82abdf7aa187251d10c2d943beff76d93ff3e1a1dbc49df4bd8fceeab

SHA512
164646f34ce6332430abc28b479b5d1a20258e6c7fceaa75ad589cf2447fb6e588ed1f5ca7d63010b1876203ad37dfb004013abc8ac3c0d03daa5725004fe685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe579616.TMP

Filesize
3KB

MD5
b785af5f8877ebd5e4af18482ab085d6

SHA1
2fd472769dd3a3c3a06745203180bb9fd742984c

SHA256
07c00e858e5baa532c9080ec553f965c284703bb64792849749af8c240c70663

SHA512
398e921c4eb6d3d8165ec73f9506b4f44c8a29156d741f926e3919d4575777c1dab6a405d74cdc6a11d9ffd5ebcdaf4a8e5fe272748ba622d55aba77b39e3366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
9e4e042ba5e39069131136d87d60998a

SHA1
1b7dc0cfc59b9b0e53f3de09378c78bc4652db3c

SHA256
c9b55a9af7e768bcaa39dedf7deb7202febb78b0e317e7c38407c585df937e66

SHA512
aa23588dee87f0fe35491462d75cc65b7e8c845f4120255754cf0f16e41578e95d82435b40949ae7bc08d8ed79f9cde08a35c148d00cf64a091a4177ddf856bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
32KB

MD5
f5d056332c9fe59edd63d7041f12a063

SHA1
31fbf8ee60934b5376601d39efd9e5c0e39ce7d9

SHA256
48906000a01bb5d78bd14fbe3d240ded614a68691f3d5de10ce9ef847f16ccc4

SHA512
d75bab1a86f4376b10a368cc8405c3f213667f3e5e06ac502436463763b393bdf0c729d62d2ade31c2a5a6888d45b1bbdcee8d46370e4631bc22324c847e3ec5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
4f8324d5ceb6ac447207f4a1ccf3c4cb

SHA1
fb44d33c20f1c560666199c222d673eddad6e040

SHA256
8ab732c80393bda189f1ea761cb1bc551aeeacfef5b7598b9b5b58869b7b6fb3

SHA512
3cf3159dcc01f4edf9eb0514f7e53dc99972702ecf76bc27fad834f6c75c9ba44e8c042621dbc234b4049bb9b2e48644ce0a787493fea755690601cd394b43eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a5e0601a-f1ee-4652-943f-213445c92a38.tmp

Filesize
14KB

MD5
31ae8187359a0d8649f78b38eb3976fb

SHA1
d99f9d3802ad6d818fc309351bd0640732b3ba63

SHA256
de4ab04fdbb7e13bb9998e5acd845003449d48409cec8dbf0e79936a772d9eaf

SHA512
cc4416f4a42a266a6b22888fa4899d1e73f551f8f987fe92eb48526bc60828ee826e948cfb36b401baa06861449ff5d26a77f31e2e83d8122eab873511cb8af3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log

Filesize
1KB

MD5
f314945b703b4b85f650a758013f1c24

SHA1
11fa1e4a5b172c7501beae867ad5eb4bc7864955

SHA256
a20db4070a557187c19007b0f97223534331f9fcef1c9c34d79c0ab617d6db3e

SHA512
64972ec703e2624ee7ab28ac21f44464879cb42d8ee7c209b4b2b9bf21346f523813fe0ebacd09ff8a8e3bdb5deec24c165193dd8cbba5a6e443903362ac4f9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
4172f7e0e7a328b097273c929f3dfd36

SHA1
ba20352f28cb3a72ee0b3b0aa33f5155b18e1874

SHA256
5c607639429f138f5c94b5abbbbe6338df25cc7ee08230aa071ae7fab23b9155

SHA512
60a9dd6dc6d17fe4efa7fbf176c0fdc75253307a4fd0dd5e52b0c1672c4dddd8d1b624800274562e44279a94f9b08b7af852058e5fb7ac1fcdf61d128e5df25b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
5f658813c21af1eea551ec0ea7ea7bca

SHA1
a02f5c6e35ddde1886bd0a08634cf3df8d125ab5

SHA256
8cfe12d3b88eaf6c4ed97e09cd681c1c1247c0530178c341dd4b77d02d38fb77

SHA512
73084293b9bac7ee99f866e1793a31a67008c48bed0cef40a3d80058397dd9620000a46af226ae9398e7e8d99bdb370385c7a3a5b74ced50940dfad7c2c79edd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
36KB

MD5
42d7f983196245a5305d5db2df780cca

SHA1
88437fd03ca814a839c756b45af81561767a9853

SHA256
2ed31d7e9a4ec885707746a180114d807fbc60a63c0564a02b11a5c38cb6de2c

SHA512
70d302962c632119aa6439ed76106e8a3ff4bdcc51fab0f12e793d1ac248d799d4bd087ebd42dfbc17e71237f9a4feffe70a85145e87b3082d1cb80b7050ee1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json

Filesize
21B

MD5
f1b59332b953b3c99b3c95a44249c0d2

SHA1
1b16a2ca32bf8481e18ff8b7365229b598908991

SHA256
138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c

SHA512
3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json

Filesize
417B

MD5
c56ff60fbd601e84edd5a0ff1010d584

SHA1
342abb130dabeacde1d8ced806d67a3aef00a749

SHA256
200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c

SHA512
acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json

Filesize
87B

MD5
e4e83f8123e9740b8aa3c3dfa77c1c04

SHA1
5281eae96efde7b0e16a1d977f005f0d3bd7aad0

SHA256
6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31

SHA512
bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyEventActivityStats.json

Filesize
14B

MD5
6ca4960355e4951c72aa5f6364e459d5

SHA1
2fd90b4ec32804dff7a41b6e63c8b0a40b592113

SHA256
88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

SHA512
8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\8695555D-E458-4AF9-8144-2EE53DE3F20B

Filesize
178KB

MD5
bddcb63b62456dacba1974f4f287b301

SHA1
5b5a3da682ca75957580331039f42b607b5c1bd2

SHA256
780271f2a3ace8192bdccde5b2232ec18be0262eb13ec5116cf8930cca6a02fb

SHA512
d54c565262b969d244744212af34b6b7cded37e2ca4a3e693658c9d37110d0ce46cde18f6b04dab5075658cebf584732b26323cae0572cdd002ca9f24afe0b19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

Filesize
10KB

MD5
53b564e598c4b7ca4cdcc0132003ceed

SHA1
46fd16dd229cfd70ca46063436df463185f0efd0

SHA256
be2f2aefb192fe7878d0dd64c7c503f9343963d4e8c08cd6209c674b4e9edf4d

SHA512
6370b73b2d8f4688b5eae2cd2469d30847a10fc829b519ba30efea23191771650fadc42dd23415dbb63ca8ab0b401dbb25708d85300e7eaa1202ea853219a3ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

Filesize
13KB

MD5
9638f690474ccae13c12c788975693d2

SHA1
288195bd0050eec47f02722f54ea7aec99808454

SHA256
3db571685d830b36bf811929232d6ed235db2a21d2cf03af909291494ae183f0

SHA512
58f373404dc727c4cfcf067f552ee89ccd6f8779fdadcaf6aef98742dbe382e4c131ccc15a23c40cec83d882d5f5c784626058686602336293f27b8629fc7844

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog

Filesize
21KB

MD5
44153bd8e87fc35b9a0531a4fbab9336

SHA1
d934e98a2d5aa10299fde8bd969278a7b4acf7f2

SHA256
ca81d7d1692df63a258e27a81444d601e78f78502dd7ed6e8ba6e96dd7ace19d

SHA512
5f9602fb4f5ae4e88284ca688a725394e1cb632cfac90ec2eff47987693caa600e0e6f4b45a7d13932b8d42bb2f912bfb858c8076811636050f232fed2836f51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db

Filesize
24KB

MD5
8665de22b67e46648a5a147c1ed296ca

SHA1
b289a96fee9fa77dd8e045ae8fd161debd376f48

SHA256
b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f

SHA512
bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db

Filesize
24KB

MD5
085ebd119f5fc6b8f63720fac1166ff5

SHA1
af066018aadec31b8e70a124a158736aca897306

SHA256
b8411fe8ec499074fca9047f6983d920279e84ddf3b02b2dd5c08cf07ec44687

SHA512
adb0522830db26123347cb485c43b156f5c888510e52091ba0fafc22b650ad29630c027746c920321905c28259dce7ff63dded93a79efddd5567c68312117875

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{B21DF39A-55C0-46AA-9051-849D2FEE3560}.tmp

Filesize
1024B

MD5
9aee1c5e88aa83ef52a1fb5fa1b07f99

SHA1
7752ecbf2d98370bc96e32cd01a1f905f65d6d2e

SHA256
de5157fbf04091efce4dbe30b22fe67b08756250af0bec537cb1fa882c65e25f

SHA512
1745c153697a39e5dcd78845f460beb59d657749d294d20539213ab5e72991962fff8b7027e63d0c89133678e05b2125e76e180c249ed216bd605dae43bffb26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{B2CDB102-2C8E-4081-98A9-B314B7D7C72C}.tmp

Filesize
1024B

MD5
5d4d94ee7e06bbb0af9584119797b23a

SHA1
dbb111419c704f116efa8e72471dd83e86e49677

SHA256
4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1

SHA512
95f83ae84cafcced5eaf504546725c34d5f9710e5ca2d11761486970f2fbeccb25f9cf50bbfc272bd75e1a66a18b7783f09e1c1454afda519624bc2bb2f28ba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\90c40333-2904-4996-898d-a135b05a695b.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\985db779-d6ee-4bc1-847e-c6b4a2a732af.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDB847.tmp\gb.xsl

Filesize
262KB

MD5
51d32ee5bc7ab811041f799652d26e04

SHA1
412193006aa3ef19e0a57e16acf86b830993024a

SHA256
6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

SHA512
5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4476_1946466337\caf806f7-c025-46ea-8eaf-ffc41e7c19e7.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\doom (1).docm.LNK

Filesize
1KB

MD5
58015c2ac7e24af8509cac9c2fbf6d55

SHA1
f3565ffee2e7b9d951c479358e8e76127e5f28ca

SHA256
222a6bb85e31d2f00efeae23b2093d52e8cf9712b01c6567fb896b192cba93a5

SHA512
33114cc6dc33c5a97043c2c606391f0abd680273a1aec98d20c014a564cd3f991954a7523992f933aec08dfa91139698e27fdae9ea000d21d7d35e96e7735f59

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
347B

MD5
5263d0b4684d312a63cdba3e35c92d32

SHA1
74a580ef07d149ade0bb396fe90b06fd15f57582

SHA256
68b76f3878c5444cdc2688ed678689cd3be432a9c653e29408efb2e27ece09a5

SHA512
91fcea0544b8dae08b7015a20c7864fce7ad9e8b41a28c4073e8911d26c1d26d9de403622f4d70f6c9a8095aec370d6b5a4e8ed14070b4ed59bf3b55396cc788

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
355B

MD5
7f1b8580c3c821181c406f1056364ac0

SHA1
8c8322eac2c89169117b8684e3946cbc1cfa9b5f

SHA256
eefa643c426301640c122d5a309519088e8ff0864bb4eccc7e47dabe301ea5d5

SHA512
a4c51e37dc35db43294975a926ad79756e69e3633cda1a050fad52dbe062fe6a880559ac396cf2b723fc94f4a9a23961bd143beb9fc37f89cbb877fbd049ef80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
370B

MD5
d497d1b788eda423676521d1ab135d44

SHA1
252fa9d11ffd7ad9b88f1559d14d738c3331df5b

SHA256
f99c544a92f9927b867892e6eef46540f57caa692f3640d346838f818e3d0c90

SHA512
6cedb0da7d2c7e352e6d46fe831eaee37292995a12498987c3144e12dbd62bbbe6bd5fabffcae51446cba26f0774f7662ec3f14c551307f6844cee20a3df8062

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
fb834a60e34f9f9772c93b2184837cc4

SHA1
c8d9ae77ed15c4bc6cac75fb47d1cc40f9c5f742

SHA256
cebd0aebf54d65ffeac379ee3dca870b3ba6a52fd52a0b94f1c8537c82b0e2c1

SHA512
e30e753c5eee398c30bb21a925b588c35ea889d897cbf88a2960889b19af37646a31c998840dafe993f447cbf854f0d95ae7d5783f8def6626c89c8054778430

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
e1816ea9626b43bce71c036fa8bfe2be

SHA1
ce88f539c0aae1e5ffddb233b1dd7d49162492d6

SHA256
15c09c77cf1620d383f1ebc74d90911ad5575588de75f63d7a9d28ca9516ece8

SHA512
ab5b99d2a8af47c1fff6054ac170cb9432b2f35441d2d924a32c970566a10c39774f8d74b51be8ad6e939cf9fff27f0190ea5723bfd8b14873354d22f65711e2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
42b0b4f03cd1a291e9daf1f8be66dccc

SHA1
7d99857014e639ffe179c8e07e53a1aab7d36dd1

SHA256
79edc9e3ca3c10fb700435bafe52d3546763470fd99616a038d43f8954bcf93f

SHA512
e4f1c3ed0543ec050fbcae4fa24d665dc2a1b708f7468c59b1453cb5288f0d956d67cbe7515a9234fbcc5571d09698c9623f6b1caad23fbd28e052a810a173ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
e7a82ffe26f2f29bec59d1a4558e4b0f

SHA1
26733127d43af1d9f6b2ebd01da5d8058810f31b

SHA256
c1c171c5b52e46b3022998d526f6965f4cdd90d69866caa464db26cf3ee17c1a

SHA512
5d196b850440b3b9d8a1760d45caa23d3383e2cbd84773666b03087696080d39d75efedb0354dd78d1316c5df6ad275a1b01d054a654521d009270d0645fd396

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
4KB

MD5
874ce3c48ddaa17b2ec862ab4a34362c

SHA1
794a770a3709b537114feef2c69ac763c60c5904

SHA256
2f515fca0c95ba5d8e858e92652733f4753d69a1dd11b53422e5c918c638729e

SHA512
e0b22d6eb473cae985cf1239d5c55f6c81ccf958e13425d33b4794533d78f7087d01521b88e6569ea4a5ce98e38bbdbacc2dae7018c9007329abb939cc9ceded

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
acd1259349755f2e13e4673b9aea80d5

SHA1
af5f9224da1a9d7b744488ead50b67ee83af2dc8

SHA256
7c757dd072f4c0d40239c9df0b02e7f8665854569911f87996b13f939c046acf

SHA512
cf5eb5ee006d509b298e0117aab3c6ae1e88599c08fca0c84a9eb1ba7f7cd1584a1b7ea370b7c1b0f249d91500958b52010625303f8d3f3d2b6858da9989a91e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
0a835de210e9ba669c553f408057fc5a

SHA1
42e282701c5c9b0b2cddac72bb08f72bdc4fed67

SHA256
d769aa5dd24218019075f6d510462bb483581735b0eb74179f6478c28fb08e85

SHA512
f4e00fd1f56c89dfdfe47ebb248d3a09a532eb7714dc97f55c85a4241802a5738fc884466d77bac030eafe9e0c404243c00d5520881d4e73eb9ce44d70901a74

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
4KB

MD5
4add689eb7d0513c565e113b41dc2d3d

SHA1
889639d670d88d7d5a83e721849d8006c45a98cc

SHA256
f7292ee457e7d11a0072c112b79e385f8c36f37ec47860aedd34b8e00b96f6e4

SHA512
51d2eb1f7f90b361b6fd9283179b05dd49cf00de0c112d8de2b0a6325547f8c55d9fb9c30a911d5417ac3d58f7a33b028810d70f0ef23d09a49c5677c010bbfa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
4KB

MD5
c57088d524e9bb881593dbf6be92dd2f

SHA1
d1dd77d0d765ff28970facfbc6ed0d6ab0ec619c

SHA256
775c2eb29ee0508082f24b0df5db7b75e9c172425d2f9849c0381feb5c531ad2

SHA512
13f4251a7d5ba565c9e276fa445ec1acfd77306101e20732954a792fcb6c6abe70af5365f873dc2cf6b849d0314e4d261647c291f19938f14a925d1e1ca6ca48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
691c2964dc734904b198092d377c76a9

SHA1
ab5d219290a5388856d2a764faba31cc97d5f03a

SHA256
5c01bb3da1d83fb925928e3e768a97f74dbceeff8fc49e880163c3af44702108

SHA512
7e9297a4137f22b553ad6facc76c80dcf824e4915c4f573966cacab480b955ad705641a9a628b2043dd0c7029de61ca1cc2955ca63475d57cddb1f46924fdb38

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
6c85d9b237fcbb20a5626d694664b18e

SHA1
45320a8e3cdb8b6fa96cbbcdc40a77feb72005b0

SHA256
609564972d5583594ad5e1efbd96d43002708f59ee660eba71674cfedca72b1b

SHA512
68a874b32bed273e75b0c2453f0f17f5d3615d598f942214d78667270ef2043b640dd4cab58cf44d4255e6eed945a397b60088ad72373bb20034b49ed0726135

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
7f50849b98428a6186762e28780a7b1c

SHA1
dac32f7670bce0eb66cef5c33437756ce8863390

SHA256
8ec8a42b7fab667f42c19888b4f63e0a4b3d52f286b0d160b9e0d0c243069026

SHA512
40b6d6ef552dccb1c5e989fa4b34aab407ac90a2c60598a921d611bed8d719b0ad18bd201e434f9540e46e503c4123ac65d66f94cb86249f5b63db0b925dbca7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Word\AutoRecovery save of doom (1).asd

Filesize
931KB

MD5
35b6519151eeed71a76fbb67f186b6dc

SHA1
d3a7d15d0c2779e7658ff6abf4e53c127d231267

SHA256
b248a3cfe887a83eaf31d89087c80c09773593d350fab3a53e1454da7fefb836

SHA512
57ce8e23003ce8732cd91711d5122a736b6522d5f9cf34a1eb1609398ac0afbf5a774b26efeb1f9fdb38e0c06e1ed8f859e826b59d11e80cb219540835e26579

Download Submit
C:\Users\Admin\Downloads\doom.docm.crdownload

Filesize
6.6MB

MD5
df9fe188e970721e6087178985410470

SHA1
ba07c4ebf64cc5f4c39c0b323f328e041b3a20b0

SHA256
ee226dd5f874e8364bec3ba8161491fef62782fac2116fc7619d59abf2c995c8

SHA512
aa1ebb59e4d931439e6d4c253ce48ca067b2d31b30db1917a490a0264b126b03c16a9f0b8c746176a0181ba4f3002f7d62b9ef009413a08fc2873e8ec8193400

Download Submit
C:\Users\Admin\Downloads\doom.docm:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\universal-doom-main.zip.crdownload

Filesize
4.7MB

MD5
87d1bc5e13d9c6c611c4eaa6ef96dc71

SHA1
f05d777bd82352efd861363b310472bc7daae6b8

SHA256
3e06581152704697e2dea5b7ab79e9098b21316a85c5f5e2c57d116e199c3110

SHA512
12b12e33fdf0ad92a9cfb91421ad21875e2d08b646419683ae87579df0a60ec152d847f74c3df8c97f5a0ae7a9e1b6f75bfba7d6d885ece5fec093bd48ec6fae

Download Submit
C:\Users\Admin\Downloads\~WRD0000.tmp

Filesize
570KB

MD5
8d2a4979374c5351b6b01a4bf2eec0fa

SHA1
56b982102497fc1fe024aa5cfbd4b2014ab6f6a9

SHA256
dbd1bc79aceba3b0fa0b1a8bc57d0048db7e3611207db4c2b29ba861ba31175c

SHA512
f9c50d245aa5bc595cef8cad05479e1638a46be09d0e4ba87c9cfeadfe1bce63d78a34ca879f8af658d2b8391a8426c645347a97d8701c27068bbf4c71df9665

Download Submit
C:\Users\Admin\Downloads\~WRD0000.tmp

Filesize
570KB

MD5
50cb43c53dee50646f1f4c26fdeb816e

SHA1
36709d35c3825a44fd7d3a7b17520f1cd04f592f

SHA256
556897a866b2e359779f1d3237a9218ffa1fee3a2fb21bb73544d36514fa9469

SHA512
65b3bb4e653c49e21f0bf8a8d7404425e81157103e05896ce6808b660d4b7bf4c5f9bb68db6574475d053bb9b69c3a4c8eb5671ca9fb4665dd95556634ace241

Download Submit
C:\Users\Admin\Downloads\~WRD0000.tmp

Filesize
570KB

MD5
01a06ef34dbbad28395ebc5e84b33a07

SHA1
a735733e1a18e91b1f9a5902807989bb67eca646

SHA256
e111031b75534cb9083488d4e65a6d1e594ab6b24321455c9f885be3f652d253

SHA512
3565339359bf5004870a653a4321433fc4f9727494c259bb969a63f337411bd945c337b40a7e9875c60a271b748aa369cb71bc9c0ba978c643f60a65c02d6c6a

Download Submit
C:\Users\Admin\Downloads\~WRD0000.tmp

Filesize
570KB

MD5
9ccf9dff53e0f976306b2c3ac9016780

SHA1
fbeaa1855cc2e1633acc6752f38db2ef50c10672

SHA256
3b54dfe890a0871136d1d16942a2a6f09de619cc37b3ccdea6d1a2e1f90a290d

SHA512
d38b9ab01825cbbc84e56741e8f777ec48d9c1fa18053f42473c7217a572a79c4039a57d51bdd7f1cbff6725834f3a82a1692e0669500ada6fcdd8fab9a1970b

Download Submit
memory/1192-2137-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/1192-2135-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/1192-2139-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/1192-2138-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/1192-2136-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/1952-1448-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/1952-1446-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/1952-1447-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/1952-1445-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/1952-1335-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/1952-1336-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/1952-1332-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/1952-1333-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/1952-1334-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/3240-1307-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/3240-1308-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/3240-1309-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/3240-1310-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/3240-1122-0x00007FF9FDAF0000-0x00007FF9FDB00000-memory.dmp

Filesize
64KB

Download
memory/3240-1121-0x00007FF9FDAF0000-0x00007FF9FDB00000-memory.dmp

Filesize
64KB

Download
memory/3240-1117-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/3240-1119-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/3240-1120-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/3240-1118-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download
memory/3240-1116-0x00007FF9FFE30000-0x00007FF9FFE40000-memory.dmp

Filesize
64KB

Download