lumma | 3c5a551b8fee65ffc444a3c0730b990591c3a95e442426563539f0a2ca3871d2

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2025, 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

v7942.exe
Size

634KB
MD5

d62b289592043f863f302d7e8582e9bc
SHA1

cc72a132de961bb1f4398b933d88585ef8c29a41
SHA256

3c5a551b8fee65ffc444a3c0730b990591c3a95e442426563539f0a2ca3871d2
SHA512

63d389102c1b78ea5157aad0a3f45f351a5752ae896729d85be81b70721f19869efdb8dfa87906f891be9bec0d9154b7498e4ac4216fd3ec574fae64707e258c
SSDEEP

12288:SaQ9+ICJkAp0mBpehM8ppy+E4J/aDQy5b4WeZGl/GtWV3OH2JrZw9RlUR:Kw4GBpehMjcuP5b4Fty3pZwXlUR

Score

10^/10

lumma stealc vidar 928af183c2a2807a3c0526e8c0c9369d default credential_access discovery persistence spyware stealer

Malware Config

Extracted

Family

vidar

Version

13.3

Botnet

928af183c2a2807a3c0526e8c0c9369d

https://t.me/lw25chm

https://steamcommunity.com/profiles/76561199839170361

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Extracted

Family

lumma

https://wxayfarer.live/ALosnz

https://byteplusx.digital/aXweAX

https://travewlio.shop/ZNxbHi

https://skynetxc.live/AksoPA

https://pixtreev.run/LkaUz

https://advennture.top/GKsiio

https://atargett.top/dsANGt

https://70sparkiob.digital/KeASUp

https://appgridn.live/LEjdAK

Extracted

Family

stealc

Botnet

default

http://77.90.153.241

Attributes

url_path
/612acd258782ade8.php

Signatures

Detect Vidar Stealer 45 IoCs

stealer

resource	yara_rule
behavioral2/memory/436-0-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-1-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-2-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-9-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-10-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-15-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-16-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-19-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-23-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-24-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-25-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-29-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-30-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-72-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-370-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-371-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-372-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-373-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-376-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-380-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-381-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-382-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-386-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-395-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-734-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-773-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-774-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-777-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-778-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-779-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-780-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-781-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-782-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-783-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/436-843-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/6256-1783-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/6256-1803-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/6256-1804-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/6256-1809-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/6256-1810-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/6256-1813-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/6256-1817-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/6256-1818-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/6256-1822-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral2/memory/6256-1823-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Downloads MZ/PE file 19 IoCs

flow	pid	Process
249	436	MSBuild.exe
249	436	MSBuild.exe
417	5880	MSBuild.exe
417	5880	MSBuild.exe
417	5880	MSBuild.exe
417	5880	MSBuild.exe
417	5880	MSBuild.exe
417	5880	MSBuild.exe
424	5880	MSBuild.exe
424	5880	MSBuild.exe
585	6256	MSBuild.exe
585	6256	MSBuild.exe
710	7892	MSBuild.exe
710	7892	MSBuild.exe
710	7892	MSBuild.exe
710	7892	MSBuild.exe
710	7892	MSBuild.exe
710	7892	MSBuild.exe
715	7892	MSBuild.exe

Uses browser remote debugging 2 TTPs 39 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
24080	msedge.exe
24156	msedge.exe
10468	msedge.exe
23260	msedge.exe
4116	chrome.exe
1584	chrome.exe
972	msedge.exe
11076	chrome.exe
18572	chrome.exe
3752	chrome.exe
4892	chrome.exe
24416	chrome.exe
24408	chrome.exe
5052	chrome.exe
24220	msedge.exe
5688	msedge.exe
24232	msedge.exe
6108	chrome.exe
21660	msedge.exe
19112	chrome.exe
10900	msedge.exe
5684	chrome.exe
6008	chrome.exe
21668	msedge.exe
17456	chrome.exe
5084	chrome.exe
2364	chrome.exe
5124	msedge.exe
2476	chrome.exe
5136	msedge.exe
18700	msedge.exe
6980	chrome.exe
23692	msedge.exe
4168	msedge.exe
10864	msedge.exe
5168	chrome.exe
18712	msedge.exe
10836	chrome.exe
10804	msedge.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk	N4rIdMJwbFMq8mgp.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk	zRTkV1bVBDUUwiOy.exe

Executes dropped EXE 24 IoCs

pid	Process
4116	djeknyuk6f.exe
3304	zctjmohd2n.exe
5824	y58gdtjm7g.exe
5260	N4rIdMJwbFMq8mgp.exe
5200	zRTkV1bVBDUUwiOy.exe
10680	N4rIdMJwbFMq8mgp.exe
10728	SyvlC7hcrUjwmdt8.exe
9740	FbZx8V53lBfGCunA.exe
6284	IEHIIIJDAA.exe
4880	AKFCBFHJDH.exe
820	HCBGDGCAAK.exe
400	NkZFXOtVysz92grt.exe
4908	78nqXBcfPVe7DLGg.exe
17924	BKSckeIwsdNTVsjN.exe
17876	gdbi5pppzm.exe
21828	h4wb1dbiek.exe
7888	q9rqqqq1dj.exe
19052	YaeCUyZSGiBPlVg8.exe
19892	CjMUyJ6gAJTkbBws.exe
7392	DAAECAFHDB.exe
8628	HCAEHDHDAK.exe
8392	KJKKJKEHDB.exe
8396	QAaitF8tiVftTac5.exe
8596	3NmXdhr9SvjEFnBN.exe

Loads dropped DLL 4 IoCs

pid	Process
5880	MSBuild.exe
5880	MSBuild.exe
7892	MSBuild.exe
7892	MSBuild.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleChrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rep10aXY\\N4rIdMJwbFMq8mgp.exe"	N4rIdMJwbFMq8mgp.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 8 set thread context of 436	8	v7942.exe	87
PID 4116 set thread context of 5740	4116	djeknyuk6f.exe	145
PID 3304 set thread context of 5880	3304	zctjmohd2n.exe	148
PID 6284 set thread context of 6256	6284	IEHIIIJDAA.exe	210
PID 4880 set thread context of 5508	4880	AKFCBFHJDH.exe	214
PID 17876 set thread context of 19932	17876	gdbi5pppzm.exe	258
PID 21828 set thread context of 7892	21828	h4wb1dbiek.exe	260
PID 7392 set thread context of 8024	7392	DAAECAFHDB.exe	301
PID 8628 set thread context of 8576	8628	HCAEHDHDAK.exe	305

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
10816	5200	WerFault.exe	153
23948	5260	WerFault.exe	150
23980	10728	WerFault.exe	156
7304	400	WerFault.exe	218
22032	9740	WerFault.exe	194
18076	4908	WerFault.exe	219
18092	17924	WerFault.exe	253

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78nqXBcfPVe7DLGg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	q9rqqqq1dj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QAaitF8tiVftTac5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y58gdtjm7g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NkZFXOtVysz92grt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BKSckeIwsdNTVsjN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CjMUyJ6gAJTkbBws.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zRTkV1bVBDUUwiOy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3NmXdhr9SvjEFnBN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	N4rIdMJwbFMq8mgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YaeCUyZSGiBPlVg8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SyvlC7hcrUjwmdt8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FbZx8V53lBfGCunA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KJKKJKEHDB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	N4rIdMJwbFMq8mgp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HCBGDGCAAK.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
10896	timeout.exe
18512	timeout.exe

Enumerates system info in registry 2 TTPs 24 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133877282485140651"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-869607583-2483572573-2297019986-1000\{D7FC421D-C5E9-4774-BE8B-A5E62921C067}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
436	MSBuild.exe
436	MSBuild.exe
436	MSBuild.exe
436	MSBuild.exe
5052	chrome.exe
5052	chrome.exe
436	MSBuild.exe
436	MSBuild.exe
436	MSBuild.exe
436	MSBuild.exe
436	MSBuild.exe
436	MSBuild.exe
436	MSBuild.exe
436	MSBuild.exe
5740	MSBuild.exe
5740	MSBuild.exe
5740	MSBuild.exe
5740	MSBuild.exe
5880	MSBuild.exe
5880	MSBuild.exe
5260	N4rIdMJwbFMq8mgp.exe
5260	N4rIdMJwbFMq8mgp.exe
5200	zRTkV1bVBDUUwiOy.exe
5200	zRTkV1bVBDUUwiOy.exe
5200	zRTkV1bVBDUUwiOy.exe
5200	zRTkV1bVBDUUwiOy.exe
10680	N4rIdMJwbFMq8mgp.exe
10680	N4rIdMJwbFMq8mgp.exe
10680	N4rIdMJwbFMq8mgp.exe
10680	N4rIdMJwbFMq8mgp.exe
10728	SyvlC7hcrUjwmdt8.exe
10728	SyvlC7hcrUjwmdt8.exe
5880	MSBuild.exe
5880	MSBuild.exe
11076	chrome.exe
11076	chrome.exe
5880	MSBuild.exe
5880	MSBuild.exe
5880	MSBuild.exe
5880	MSBuild.exe
9740	FbZx8V53lBfGCunA.exe
9740	FbZx8V53lBfGCunA.exe
9740	FbZx8V53lBfGCunA.exe
9740	FbZx8V53lBfGCunA.exe
9740	FbZx8V53lBfGCunA.exe
9740	FbZx8V53lBfGCunA.exe
5880	MSBuild.exe
5880	MSBuild.exe
5880	MSBuild.exe
5880	MSBuild.exe
400	NkZFXOtVysz92grt.exe
400	NkZFXOtVysz92grt.exe
4908	78nqXBcfPVe7DLGg.exe
4908	78nqXBcfPVe7DLGg.exe
4908	78nqXBcfPVe7DLGg.exe
4908	78nqXBcfPVe7DLGg.exe
5508	MSBuild.exe
5508	MSBuild.exe
5508	MSBuild.exe
5508	MSBuild.exe
6256	MSBuild.exe
6256	MSBuild.exe
6256	MSBuild.exe
6256	MSBuild.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs

pid	Process
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
5688	msedge.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
24232	msedge.exe
24232	msedge.exe
24232	msedge.exe
24232	msedge.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
21660	msedge.exe
21660	msedge.exe
18572	chrome.exe
18572	chrome.exe
18572	chrome.exe
18572	chrome.exe
23260	msedge.exe
23260	msedge.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	11076	chrome.exe
Token: SeCreatePagefilePrivilege	11076	chrome.exe
Token: SeShutdownPrivilege	11076	chrome.exe
Token: SeCreatePagefilePrivilege	11076	chrome.exe
Token: SeShutdownPrivilege	11076	chrome.exe
Token: SeCreatePagefilePrivilege	11076	chrome.exe
Token: SeShutdownPrivilege	11076	chrome.exe
Token: SeCreatePagefilePrivilege	11076	chrome.exe
Token: SeShutdownPrivilege	11076	chrome.exe
Token: SeCreatePagefilePrivilege	11076	chrome.exe
Token: SeShutdownPrivilege	11076	chrome.exe
Token: SeCreatePagefilePrivilege	11076	chrome.exe
Token: SeShutdownPrivilege	11076	chrome.exe
Token: SeCreatePagefilePrivilege	11076	chrome.exe
Token: SeShutdownPrivilege	11076	chrome.exe
Token: SeCreatePagefilePrivilege	11076	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	18572	chrome.exe
Token: SeCreatePagefilePrivilege	18572	chrome.exe
Token: SeShutdownPrivilege	18572	chrome.exe
Token: SeCreatePagefilePrivilege	18572	chrome.exe
Token: SeShutdownPrivilege	18572	chrome.exe
Token: SeCreatePagefilePrivilege	18572	chrome.exe
Token: SeShutdownPrivilege	18572	chrome.exe
Token: SeCreatePagefilePrivilege	18572	chrome.exe
Token: SeShutdownPrivilege	18572	chrome.exe
Token: SeCreatePagefilePrivilege	18572	chrome.exe
Token: SeShutdownPrivilege	18572	chrome.exe
Token: SeCreatePagefilePrivilege	18572	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5052	chrome.exe
5688	msedge.exe
5688	msedge.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
11076	chrome.exe
24232	msedge.exe
24232	msedge.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 436	8	v7942.exe	87
PID 8 wrote to memory of 436	8	v7942.exe	87
PID 8 wrote to memory of 436	8	v7942.exe	87
PID 8 wrote to memory of 436	8	v7942.exe	87
PID 8 wrote to memory of 436	8	v7942.exe	87
PID 8 wrote to memory of 436	8	v7942.exe	87
PID 8 wrote to memory of 436	8	v7942.exe	87
PID 8 wrote to memory of 436	8	v7942.exe	87
PID 8 wrote to memory of 436	8	v7942.exe	87
PID 8 wrote to memory of 436	8	v7942.exe	87
PID 8 wrote to memory of 436	8	v7942.exe	87
PID 8 wrote to memory of 436	8	v7942.exe	87
PID 436 wrote to memory of 5052	436	MSBuild.exe	98
PID 436 wrote to memory of 5052	436	MSBuild.exe	98
PID 5052 wrote to memory of 1764	5052	chrome.exe	99
PID 5052 wrote to memory of 1764	5052	chrome.exe	99
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 4660	5052	chrome.exe	100
PID 5052 wrote to memory of 3332	5052	chrome.exe	101
PID 5052 wrote to memory of 3332	5052	chrome.exe	101
PID 5052 wrote to memory of 5088	5052	chrome.exe	102
PID 5052 wrote to memory of 5088	5052	chrome.exe	102
PID 5052 wrote to memory of 5088	5052	chrome.exe	102
PID 5052 wrote to memory of 5088	5052	chrome.exe	102
PID 5052 wrote to memory of 5088	5052	chrome.exe	102
PID 5052 wrote to memory of 5088	5052	chrome.exe	102
PID 5052 wrote to memory of 5088	5052	chrome.exe	102
PID 5052 wrote to memory of 5088	5052	chrome.exe	102
PID 5052 wrote to memory of 5088	5052	chrome.exe	102
PID 5052 wrote to memory of 5088	5052	chrome.exe	102
PID 5052 wrote to memory of 5088	5052	chrome.exe	102
PID 5052 wrote to memory of 5088	5052	chrome.exe	102
PID 5052 wrote to memory of 5088	5052	chrome.exe	102
PID 5052 wrote to memory of 5088	5052	chrome.exe	102
PID 5052 wrote to memory of 5088	5052	chrome.exe	102
PID 5052 wrote to memory of 5088	5052	chrome.exe	102

C:\Users\Admin\AppData\Local\Temp\v7942.exe
"C:\Users\Admin\AppData\Local\Temp\v7942.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Downloads MZ/PE file
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffd35d3dcf8,0x7ffd35d3dd04,0x7ffd35d3dd10
      4⤵
      PID:1764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1996,i,17362244325492639756,4030877285420134785,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1992 /prefetch:2
      4⤵
      PID:4660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1612,i,17362244325492639756,4030877285420134785,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2252 /prefetch:3
      4⤵
      PID:3332
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2356,i,17362244325492639756,4030877285420134785,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2544 /prefetch:8
      4⤵
      PID:5088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3256,i,17362244325492639756,4030877285420134785,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3272,i,17362244325492639756,4030877285420134785,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3300 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4272,i,17362244325492639756,4030877285420134785,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4308 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:1584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3160,i,17362244325492639756,4030877285420134785,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4680 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5308,i,17362244325492639756,4030877285420134785,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5324 /prefetch:8
      4⤵
      PID:4296
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5396,i,17362244325492639756,4030877285420134785,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5408 /prefetch:8
      4⤵
      PID:2336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5324,i,17362244325492639756,4030877285420134785,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5632 /prefetch:8
      4⤵
      PID:1016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5488,i,17362244325492639756,4030877285420134785,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5316 /prefetch:8
      4⤵
      PID:3152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5496,i,17362244325492639756,4030877285420134785,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5484 /prefetch:8
      4⤵
      PID:2448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5628,i,17362244325492639756,4030877285420134785,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5732 /prefetch:8
      4⤵
      PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffd35d1f208,0x7ffd35d1f214,0x7ffd35d1f220
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2104,i,2501090495878788310,17075355666738596859,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1928,i,2501090495878788310,17075355666738596859,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2532,i,2501090495878788310,17075355666738596859,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:8
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3592,i,2501090495878788310,17075355666738596859,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3620,i,2501090495878788310,17075355666738596859,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4132,i,2501090495878788310,17075355666738596859,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4228,i,2501090495878788310,17075355666738596859,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5140,i,2501090495878788310,17075355666738596859,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3752,i,2501090495878788310,17075355666738596859,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5152,i,2501090495878788310,17075355666738596859,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5148,i,2501090495878788310,17075355666738596859,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
      4⤵
      PID:460
- - C:\ProgramData\djeknyuk6f.exe
    "C:\ProgramData\djeknyuk6f.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4116
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5740
- - C:\ProgramData\zctjmohd2n.exe
    "C:\ProgramData\zctjmohd2n.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3304
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:5804
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Downloads MZ/PE file
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:5880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
        5⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:11076
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd34abdcf8,0x7ffd34abdd04,0x7ffd34abdd10
        6⤵
        
        PID:11092
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1572,i,3142918113192233841,12593786994660021609,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2420 /prefetch:3
        6⤵
        
        PID:4652
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2392,i,3142918113192233841,12593786994660021609,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2388 /prefetch:2
        6⤵
        
        PID:1188
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2076,i,3142918113192233841,12593786994660021609,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2776 /prefetch:8
        6⤵
        
        PID:1932
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3280,i,3142918113192233841,12593786994660021609,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3316 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4892
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3292,i,3142918113192233841,12593786994660021609,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3340 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4116
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4224,i,3142918113192233841,12593786994660021609,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4240 /prefetch:2
        6⤵
        Uses browser remote debugging
        
        PID:17456
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4608,i,3142918113192233841,12593786994660021609,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4600 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:19112
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5196,i,3142918113192233841,12593786994660021609,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5208 /prefetch:8
        6⤵
        
        PID:24020
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5328,i,3142918113192233841,12593786994660021609,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5536 /prefetch:8
        6⤵
        
        PID:24108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
        5⤵
        Uses browser remote debugging
        
        PID:24220
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --edge-skip-compat-layer-relaunch
        6⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:24232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd347ef208,0x7ffd347ef214,0x7ffd347ef220
        7⤵
        
        PID:24260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1860,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:3
        7⤵
        
        PID:24528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2444,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
        7⤵
        
        PID:24536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2128,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:8
        7⤵
        
        PID:24548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3476,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:24080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3524,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:10900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4116,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:10864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4136,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
        7⤵
        Uses browser remote debugging
        
        PID:24156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4752,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
        7⤵
        
        PID:11096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5248,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
        7⤵
        
        PID:24216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5428,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
        7⤵
        
        PID:24308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4668,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
        7⤵
        
        PID:24332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3728,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
        7⤵
        
        PID:9364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3728,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
        7⤵
        
        PID:9352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6536,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
        7⤵
        
        PID:8860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6504,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
        7⤵
        
        PID:8808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6736,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
        7⤵
        
        PID:8620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4348,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
        7⤵
        
        PID:8608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4360,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
        7⤵
        
        PID:8536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6948,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
        7⤵
        
        PID:8528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6976,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:8
        7⤵
        
        PID:8440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6936,i,7729192448481561442,6697585425361120448,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:8
        7⤵
        
        PID:7952
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\IEHIIIJDAA.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6328
      - C:\Users\Admin\IEHIIIJDAA.exe
        
        "C:\Users\Admin\IEHIIIJDAA.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6284
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:6260
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:6256
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5684
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd366adcf8,0x7ffd366add04,0x7ffd366add10
        9⤵
        
        PID:2644
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2120,i,4099172212702752493,7440650497221832226,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
        9⤵
        
        PID:1488
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1980,i,4099172212702752493,7440650497221832226,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3
        9⤵
        
        PID:324
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2344,i,4099172212702752493,7440650497221832226,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
        9⤵
        
        PID:1376
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3240,i,4099172212702752493,7440650497221832226,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:5168
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3260,i,4099172212702752493,7440650497221832226,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:6108
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4220,i,4099172212702752493,7440650497221832226,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
        9⤵
        Uses browser remote debugging
        
        PID:6008
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4396,i,4099172212702752493,7440650497221832226,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:2476
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5284,i,4099172212702752493,7440650497221832226,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
        9⤵
        
        PID:5320
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5556,i,4099172212702752493,7440650497221832226,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
        9⤵
        
        PID:23204
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5496,i,4099172212702752493,7440650497221832226,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
        9⤵
        
        PID:23084
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5676,i,4099172212702752493,7440650497221832226,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
        9⤵
        
        PID:23032
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5680,i,4099172212702752493,7440650497221832226,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
        9⤵
        
        PID:22992
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5696,i,4099172212702752493,7440650497221832226,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
        9⤵
        
        PID:22616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        
        PID:21668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --edge-skip-compat-layer-relaunch
        9⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:21660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffd347ef208,0x7ffd347ef214,0x7ffd347ef220
        10⤵
        
        PID:21632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2260,i,17636285127190771907,3265294979074827748,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
        10⤵
        
        PID:21396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=272,i,17636285127190771907,3265294979074827748,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
        10⤵
        
        PID:21392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2540,i,17636285127190771907,3265294979074827748,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:8
        10⤵
        
        PID:21340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3500,i,17636285127190771907,3265294979074827748,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:18712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3524,i,17636285127190771907,3265294979074827748,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:18700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3504,i,17636285127190771907,3265294979074827748,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
        10⤵
        
        PID:18428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4924,i,17636285127190771907,3265294979074827748,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
        10⤵
        
        PID:18352
        
        C:\ProgramData\gdbi5pppzm.exe
        
        "C:\ProgramData\gdbi5pppzm.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:17876
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        
        PID:19736
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        
        PID:19764
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        
        PID:18312
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:19932
        
        C:\ProgramData\h4wb1dbiek.exe
        
        "C:\ProgramData\h4wb1dbiek.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:21828
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        Downloads MZ/PE file
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:7892
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
        10⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        
        PID:18572
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd36b3dcf8,0x7ffd36b3dd04,0x7ffd36b3dd10
        11⤵
        
        PID:18592
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1992,i,11120137218906956770,6618337670988351707,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:3
        11⤵
        
        PID:7044
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2520,i,11120137218906956770,6618337670988351707,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:2
        11⤵
        
        PID:7048
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2100,i,11120137218906956770,6618337670988351707,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
        11⤵
        
        PID:24380
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3252,i,11120137218906956770,6618337670988351707,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:24408
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3260,i,11120137218906956770,6618337670988351707,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:24416
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4252,i,11120137218906956770,6618337670988351707,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
        11⤵
        Uses browser remote debugging
        
        PID:6980
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4512,i,11120137218906956770,6618337670988351707,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
        11⤵
        Uses browser remote debugging
        
        PID:10836
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5344,i,11120137218906956770,6618337670988351707,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
        11⤵
        
        PID:6880
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5552,i,11120137218906956770,6618337670988351707,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
        11⤵
        
        PID:6820
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5620,i,11120137218906956770,6618337670988351707,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
        11⤵
        
        PID:1464
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5592,i,11120137218906956770,6618337670988351707,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
        11⤵
        
        PID:6128
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5696,i,11120137218906956770,6618337670988351707,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
        11⤵
        
        PID:980
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5876,i,11120137218906956770,6618337670988351707,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
        11⤵
        
        PID:10612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
        10⤵
        Uses browser remote debugging
        
        PID:10468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --edge-skip-compat-layer-relaunch
        11⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:23260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd347ef208,0x7ffd347ef214,0x7ffd347ef220
        12⤵
        
        PID:23308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1920,i,18165316726544767124,7516584600822096918,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:3
        12⤵
        
        PID:10004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2656,i,18165316726544767124,7516584600822096918,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:2
        12⤵
        
        PID:23340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2176,i,18165316726544767124,7516584600822096918,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
        12⤵
        
        PID:10020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3360,i,18165316726544767124,7516584600822096918,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
        12⤵
        Uses browser remote debugging
        
        PID:10804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3380,i,18165316726544767124,7516584600822096918,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
        12⤵
        Uses browser remote debugging
        
        PID:23692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1788,i,18165316726544767124,7516584600822096918,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
        12⤵
        
        PID:23696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5092,i,18165316726544767124,7516584600822096918,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
        12⤵
        
        PID:23624
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\DAAECAFHDB.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:7772
        
        C:\Users\Admin\DAAECAFHDB.exe
        
        "C:\Users\Admin\DAAECAFHDB.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:7392
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        12⤵
        
        PID:7852
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        12⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:8024
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\HCAEHDHDAK.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:8704
        
        C:\Users\Admin\HCAEHDHDAK.exe
        
        "C:\Users\Admin\HCAEHDHDAK.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:8628
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:8576
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\KJKKJKEHDB.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:8468
        
        C:\Users\Admin\KJKKJKEHDB.exe
        
        "C:\Users\Admin\KJKKJKEHDB.exe"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\7HgldWt5\QAaitF8tiVftTac5.exe
        
        C:\Users\Admin\AppData\Local\Temp\7HgldWt5\QAaitF8tiVftTac5.exe 0
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\7HgldWt5\3NmXdhr9SvjEFnBN.exe
        
        C:\Users\Admin\AppData\Local\Temp\7HgldWt5\3NmXdhr9SvjEFnBN.exe 8396
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:8596
        
        C:\ProgramData\q9rqqqq1dj.exe
        
        "C:\ProgramData\q9rqqqq1dj.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\5DJSL6ll\YaeCUyZSGiBPlVg8.exe
        
        C:\Users\Admin\AppData\Local\Temp\5DJSL6ll\YaeCUyZSGiBPlVg8.exe 0
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:19052
        
        C:\Users\Admin\AppData\Local\Temp\5DJSL6ll\CjMUyJ6gAJTkbBws.exe
        
        C:\Users\Admin\AppData\Local\Temp\5DJSL6ll\CjMUyJ6gAJTkbBws.exe 19052
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:19892
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\6pzcb" & exit
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7260
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        9⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:18512
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AKFCBFHJDH.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
      - C:\Users\Admin\AKFCBFHJDH.exe
        
        "C:\Users\Admin\AKFCBFHJDH.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4880
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5508
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\HCBGDGCAAK.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
      - C:\Users\Admin\HCBGDGCAAK.exe
        
        "C:\Users\Admin\HCBGDGCAAK.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\UfKWYobh\NkZFXOtVysz92grt.exe
        
        C:\Users\Admin\AppData\Local\Temp\UfKWYobh\NkZFXOtVysz92grt.exe 0
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\UfKWYobh\78nqXBcfPVe7DLGg.exe
        
        C:\Users\Admin\AppData\Local\Temp\UfKWYobh\78nqXBcfPVe7DLGg.exe 400
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 2592
        9⤵
        Program crash
        
        PID:18076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 696
        8⤵
        Program crash
        
        PID:7304
- - C:\ProgramData\y58gdtjm7g.exe
    "C:\ProgramData\y58gdtjm7g.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\rep10aXY\N4rIdMJwbFMq8mgp.exe
      C:\Users\Admin\AppData\Local\Temp\rep10aXY\N4rIdMJwbFMq8mgp.exe 0
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\rep10aXY\zRTkV1bVBDUUwiOy.exe
        
        C:\Users\Admin\AppData\Local\Temp\rep10aXY\zRTkV1bVBDUUwiOy.exe 5260
        5⤵
        Drops startup file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 892
        6⤵
        Program crash
        
        PID:10816
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 1092
        5⤵
        Program crash
        
        PID:23948
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\hv3ek" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10848
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 11
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:10896

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\rep10aXY\N4rIdMJwbFMq8mgp.exe
1⤵
PID:3256
- C:\Users\Admin\AppData\Local\Temp\rep10aXY\N4rIdMJwbFMq8mgp.exe
  C:\Users\Admin\AppData\Local\Temp\rep10aXY\N4rIdMJwbFMq8mgp.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:10680
- - C:\Users\Admin\AppData\Local\Temp\Y3qw7kzN\SyvlC7hcrUjwmdt8.exe
    C:\Users\Admin\AppData\Local\Temp\Y3qw7kzN\SyvlC7hcrUjwmdt8.exe 10680
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:10728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10728 -s 612
      4⤵
      Program crash
      PID:23980
- - C:\Users\Admin\AppData\Local\Temp\rep10aXY\FbZx8V53lBfGCunA.exe
    C:\Users\Admin\AppData\Local\Temp\rep10aXY\FbZx8V53lBfGCunA.exe 10680
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:9740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9740 -s 904
      4⤵
      Program crash
      PID:22032
- - C:\Users\Admin\AppData\Local\Temp\rep10aXY\BKSckeIwsdNTVsjN.exe
    C:\Users\Admin\AppData\Local\Temp\rep10aXY\BKSckeIwsdNTVsjN.exe 10680
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:17924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 17924 -s 680
      4⤵
      Program crash
      PID:18092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5200 -ip 5200
1⤵
PID:10736

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5260 -ip 5260
1⤵
PID:17472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 10728 -ip 10728
1⤵
PID:23896

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:10904

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:18724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 400 -ip 400
1⤵
PID:7360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 9740 -ip 9740
1⤵
PID:22080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4908 -ip 4908
1⤵
PID:20920

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:7032

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:11212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 17924 -ip 17924
1⤵
PID:12900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\6pzcb\0rqi58

Filesize
228KB

MD5
701606ebe7a0349526bf3a506189edc5

SHA1
657423f7f71cb05a2e0c4ba4566df83c30fbcb8b

SHA256
ea686777d8b1d2e42b722c8809d68fab2959d086840846d6bc8201636a0015c3

SHA512
05a50fe986e1a0c6d8fb1c9308a764bba86212aca7d4edb6f1b8273b7d239a7606291e74e8c60f3e0e8673c6dd134372ab0d3f2994dfa034ed1ce585351dda3f

Download Submit
C:\ProgramData\6pzcb\fknyctj5p

Filesize
40KB

MD5
dfd4f60adc85fc874327517efed62ff7

SHA1
f97489afb75bfd5ee52892f37383fbc85aa14a69

SHA256
c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e

SHA512
d76f75b1b5b23aa4f87c53ce44c3d3b7e41a44401e53d89f05a114600ea3dcd8beda9ca1977b489ac6ea5586cf26e47396e92d4796c370e89fab0aa76f38f3c4

Download Submit
C:\ProgramData\6pzcb\j5xtr1

Filesize
130KB

MD5
2fed0b7f1f214965ab3c7192e78e18c3

SHA1
48e217caff49d346228f2493f42b9bd42a072e85

SHA256
c49ceefbc68e1812a699ba64045f06e0b39dcc4cb56398b31378bcdc59c3baa3

SHA512
00d68ab35705efaf143c7ff020687c028afaa9ad375ba79152a30eb3087e2d343990c920e924a59b4a75ec2042ad95c1d4b3d8c224251301d607e8e4940c3385

Download Submit
C:\ProgramData\6pzcb\l6xlf3

Filesize
96KB

MD5
6066c07e98c96795ecd876aa92fe10f8

SHA1
f73cbd7b307c53aaae38677d6513b1baa729ac9f

SHA256
33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53

SHA512
7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7

Download Submit
C:\ProgramData\6pzcb\uknyc2vkn

Filesize
56KB

MD5
1c832d859b03f2e59817374006fe1189

SHA1
a4994a54e9f46a6c86ff92280c6dabe2bcd4cc42

SHA256
bb923abf471bb79086ff9ace293602e1ad882d9af7946dda17ff1c3a7e19f45b

SHA512
c4d3be414fa5dd30151cde9f6d808d56c26b031ff3f6446d21a15d071053787b6ba337b12909a56af7bb420f858dba5213f08e64ca9f836f52c98a18762b4bef

Download Submit
C:\ProgramData\6pzcb\y58900

Filesize
288KB

MD5
7b273f9f582b1351dde216851fd1180c

SHA1
397de0da356f858295a69922f92a9a0b8e972054

SHA256
7d0499776310ffda6b34db4477c123ea4195938546c0dcab9112d93f87a9af1f

SHA512
937d3cff55ca989a761f8576e3a7fad08287bfe0e0fd4128f498e8c3364de6c1cfbcb431049ed37ca5895263c6fad7e37eacf86b82bec92d0c86c7c919f117ad

Download Submit
C:\ProgramData\IIEHJEHDBGHIDGDGHCBG

Filesize
6KB

MD5
7f55778a1ed643563f139a89effd0963

SHA1
722d08aff07d436ce41c44fc5799ffd15ee24a6f

SHA256
50f2c4b4299568786903fbef957a644557c82313dcfc0612e1523acdd26c7404

SHA512
0ceea356ef37cb2832ff9ebd29a78aa9bedf88f0703a975814f5253211e728a0e98ab9b6d216290a1539bd6f4fe4c441be57f9f39146e5604430f080ac386350

Download Submit
C:\ProgramData\djeknyuk6f.exe

Filesize
850KB

MD5
260faa08dbff4bc7ca6346061f42b956

SHA1
ccef508bb2693b097510015ef89ebb8f0289c5c1

SHA256
c47a55b842177445756163ca2d5cadaed5cdd4d313d7897b9aaac8e1d1c6e810

SHA512
ae30c903720f58abef12b9e091872d4a6470bae5ba246fc1d35dbaa4aecad04803647a0339490090a037de780b09df4282d5cc6247731729bf24e8fe872c42dc

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\ProgramData\pz5pz\l6pp8g

Filesize
160KB

MD5
9b85a4b842b758be395bc19aba64799c

SHA1
c32922b745c9cf827e080b09f410b4378560acb3

SHA256
ecc8d7540d26e3c2c43589c761e94638fc5096af874d7df216e833b9599c673a

SHA512
fad80745bb64406d8f2947c1e69817cff57cc504d5a8cdca9e22da50402d27d005988f6759eaa91f1f7616d250772c9f5e4ec2f98ce7264501dd4f436d1665f0

Download Submit
C:\ProgramData\pz5pz\nglngv

Filesize
130KB

MD5
3518bfdeb855229eacd7584cd5663d84

SHA1
dd155354ee54b3ad6bc2986f8228f7c1e973ed92

SHA256
ba8e0c1adfd384dc37a488dcc6502d90ab55f1eb0de52cf46ad1ad74c47bdbc2

SHA512
db07a81d610adf37a7766b272c0cafcd4bb970254899e9c12d46d59e71ecd863cdc781efc648849181213ecbdca185e55fdc769d8cce9e45502dfac5a370ceb9

Download Submit
C:\ProgramData\y58gdtjm7g.exe

Filesize
251KB

MD5
58d3a0d574e37dc90b40603f0658abd2

SHA1
bf5419ce7000113002b8112ace2a9ac35d0dc557

SHA256
dcc05c3ac7ae22d601bcb7c97cfcda568f3041bd39b2fd8899282dfde83369a5

SHA512
df61329a32e9261b01c5b7d95e0d9a3fb8cc36e5d90ede72bc16befe00fb32c221898a8346db9de07c0f5dcba57dcdbb09a22ca8b73223f989d33ec433c3a90a

Download Submit
C:\ProgramData\zctjmohd2n.exe

Filesize
736KB

MD5
18e5e760b807fc2b05172215540398b3

SHA1
6a1b4d3227088473c45869469b68a1737b26b90d

SHA256
6cff9733bcd32c2af2da61eab8281cd412a6d208ce6b763b783157be2901d5bd

SHA512
23430597753696466eea1c54337b1d37a734918433be2e0637aaf022c0ef09d5f8b04a3793ccb1a296bb83d13fda832d677cb926730653d78b0833f96737fa04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma

Filesize
1024KB

MD5
34c29bdb9e41b1f47f2d2786762c12ec

SHA1
4075131b18c3487e3e848361e112009c897629c7

SHA256
67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17

SHA512
ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
a23f16315f295f0609a09177b8447561

SHA1
469ee7f11c8a5adcac01926ae1ac64df58f843ec

SHA256
54f6a29bc62bec9cd3df9ae35e425f4234e18c95fefd1c3f9f202cfac5d551a8

SHA512
618a121c943504d4a399d9b0ce2d93b2f101444c62a52a167e9ea8cb373fae7d8817b7ff3b73cf87365a71b4515a3376e48d6f6e52df06ab66492207e52549c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
9748f82980ad16f944c557519a255dbd

SHA1
0ef50f961ff21a5ab3c7d37eafa1e6e1faecdbbd

SHA256
cec5e43403b32254ec2c9ab9ce87373c273303b9960efa581ea5ba29d2dc8be1

SHA512
446e08358f4f6edb792afb57133904e47e60847f341eccf4b10de945a04baef8c30049357ac95de03b01ace50f4ce120044af73048940fd46db7e56cd8f6905e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
4e9118eabccb0f01ca2a5c1be98f46cd

SHA1
262627770be6c60b7a42ccb9b33cef6a9f658876

SHA256
aff4aa02365417521b312773b5ad4388507ef061627437516083b78905f72161

SHA512
cccde35c595512de43d462cf7d12d071a31e2c5bcd15516389f3122ae1f7dc67f47ba2268f9c442d6aa6dd29acd322cf163f58f7ae904de76711cb57ab8cda58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
a58e9ad9961d1e1b198bdc2a212c3a64

SHA1
ce67e9553fc865ea64b2f4dd3d14d5c2f1f36ff5

SHA256
8dc3b4e62e9345eff6491fda2710ec84a2069213b649635d0257bdf8c466eb65

SHA512
550702f27266d2383ee8fdacc6597b4264bbbed99bca7147cfbb197a91a04bdc0665186a4fd4200b0a7e8951fa932c2e2284190d6a60940d2d34a2f15443cc4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
0605b75c5c345cc202a7885499cc09a7

SHA1
540568cdb245ba26bce8711347e456320012e83d

SHA256
8ed5d8964a977a79c5aacf34853c9e5e00a06de2f2f0964a56c4089805a2dda8

SHA512
dae16a98e4cf861b918d684f0d7660e1c6647897afeded6859253a51f8dd95c41f007e3f20fe43da0292b493c170cb94fb8370d7b17b4f23cf2950cec477f9a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
af5aa16d0f5372a9b6198182255fb792

SHA1
4fcec515c1dc2e3e0592a8454cc563a260bfab17

SHA256
2ec7e526d3f092e7702c0c317fd54a14a3ea719f101606bad9fafbae574348e4

SHA512
738c729917a24a4dd0f364643eb360380259f740f222ce758ff4cd9cf98531e84e1d0ae5dffa11071ae6c993004a3bae31bb69aabbfe78445d4534cb02c93ecb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
35KB

MD5
522d433e7a5af6459dbb265e22cf51bf

SHA1
b300567ff767dd6619c118c97c4e985c1aeb9941

SHA256
8d05ae9eabb80124a33f60af551e9ddef7bfacf37c6a257bcfcfbd0612002090

SHA512
ba864e135f906f5773288c72d8cdf4f6fd3b12f135572a66dd04415094bac6f9abcd8fc05436d855142e34a26a2c21e4445e1b29dbc7f38d9d67c7688afdaffe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
63KB

MD5
1901d2bcbbabee4bbb9804c30642ae2b

SHA1
f31774bc12614be681c0b0c7de3ac128f0e932db

SHA256
15eba349e5829f11363614b8f3dd9c3d04994586601d3c4c4d8069e0f5655310

SHA512
bdb94d7d8cf47b239c61559545b1dd26e05da909fec05d215471388545879cd8ec9e1fea51c04ed43927e2b07b5b80a74f09eb9038c8d9045e4161ea69df215f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
38KB

MD5
f53236bc138719b68ccd1c7efb02a276

SHA1
26b7d3eea5d3b12d0b0e173ebf2af50a7d7e56d6

SHA256
787c14f8cc865430c03c96a345044b7c5b8dc8a032511a500d4a42228533acd8

SHA512
5485bc7ccce8ec75f60bca3be846086a4bd4466009c8e22da9cdd16bb1154529af2fb2667cd3a97485cc4f6635fb79ac0fdda4f3e1f39f25f6196f708a92d740

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

Filesize
320B

MD5
517afc1a4a8dfc16d0959430b49b8154

SHA1
c9274ef784a40b3a46a436629441b91aaf5747cd

SHA256
7287362dc18dccd4dd23bfb5cfce8282006085de63eab6629ec8329df3f24e0b

SHA512
a08dcdfcdfd166c2ec005609488bcfbf9e0cecfb7675bfafab833ee280b08e85c22cbf2a1d7e76f3ad20281b169294cfc54350368ef33dac300620570f5d9bdc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log

Filesize
3KB

MD5
3925608f5ff2266c3fad43d98acaa30b

SHA1
6d6a5e0893ca5bb01de54e0d5523642da22c6cfb

SHA256
53048803abb6436675c6d6f662c1024dbe0efe6baabd20a2230f220f58ac4d67

SHA512
8787888da72fa644fa628e5347700e46ff7ae316b47fddb6eb5b157ff2920e2f978cfb0dc3c8d6dd7b4e9baca3b226b04aa7de7bb32acfdae9b02aeefb8aa6cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG

Filesize
333B

MD5
4dc0ff44a27ac99455f6d3de3227bd4e

SHA1
1b8abbca6785ff8e6559abcb80bdc45611e11b32

SHA256
065416da7d2cc43ad0ec5197c17aa78a7bc6c0c1d0ae078d24ba6c72cc933674

SHA512
383b5ee07ecb82b8b88aeb1b46cbed77bbb0ac19d0d8d749a7b6708f8b3f36d2b0dbf7f2ccf2597b47c4586cef346ffd530fe3713124b7f8a481be1f334e57ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0

Filesize
128KB

MD5
ad5500392a3d6dab62cbbed72729419d

SHA1
74b1d039a44cc37e62dc573d0d14efe2ead9e391

SHA256
aac955452d846e19791a2c1f30dba6a9c1ebde5b20547d37c6e7ebb6c62154eb

SHA512
454433c661570990955c25eedb52ebdf5ae2317ac062cb23be3537b1cc8b5afc2a1d3d1e370951641a473cccb0f3ddee9db34dee2bb7f52db5bb4c9a609a1872

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1

Filesize
343KB

MD5
5a59103dbde3e8137761097609bcf005

SHA1
fd55aca2ae3c317576aa6b9f50877a0241a18968

SHA256
315e9ce1dbacfe9740368bac58caac24fdbece24a1c712cb26eb4933723ffedb

SHA512
4ea3f262b2a16e653dd2ac84908c89823ee3dc9532ca0e368325d66f95912c45e01b33d9ffce34b2b01b821bdcc623f2fbb773d382c82a2edb394b1985c7ba46

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
359b99beb5681c882a436858b1375904

SHA1
f9b76a5729ea7ec8169f941be759d328e202d728

SHA256
38346efd2fd2fca291609c8d0190c30ce6e28dba75a58f0f20a3ca846a8eda66

SHA512
73e5111f2461e648837e64024c7853c79c0c1b5f7b8175806437dfab5d1259e77c8a18efe7185728d7df0d824428922c14cbdb5156d3663996f144893fdb85c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
345B

MD5
611d3d9d356ccb745a970ae258cf4348

SHA1
239fba764c5d82a36a2b8a51c1fbcd62c5910c31

SHA256
c39f9746abee1e0a2eee12cd62cd9865a2498747bcc5dfdcfc2d72c2255acf2b

SHA512
fe6fc5923366f5ff2f73ed26cd7060c2ed0ca343bea4b46d52b8024fb1749d7eb1f95af13bcbac803e058b34a1da5d4331e6b00db7e07240abf31dc0d65552be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
321B

MD5
f5c2883753eba0c2e8a2623c4bb49d76

SHA1
8adda3c9a410da82175c07545d2a1498a5238b79

SHA256
be27f0665fe633ab68506c1105dc581a4920642c1796cea2286d41d762575aad

SHA512
b7b8930dc4b743ff20a21050aaa443172c85171858f2d98881343bc4e8576a0e8e774a3f6b6973b792b4033d39b5ba8cb20010774f96ad7db5ad96ccbb567a36

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal

Filesize
12KB

MD5
858eb8a95dcf83ffc4157bd0692c99ac

SHA1
38b0a02e9c611362612b7a563c97a45a87ef6097

SHA256
c13bbb35d8ce8e38d64d95409c6a6355d3d6fec8387795725e152405531e424e

SHA512
fadf08bc7daa1274cf64d9b6abb0307efed608fe094bacd52a47a530891d30f406783177a5979eacfde383ad35d7491b50eebb85901591cb458c9acab7f4ddb4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

Filesize
338B

MD5
9f14e032b20ce8bc69e3e9ac8d5e74be

SHA1
305296d60eb8f8cbf179edd1903ac051b0389558

SHA256
82f7f0ab0c4365b75060577204fb39636fb53c669d090861732d6e74a507d565

SHA512
0c1b20e8ce1235335dd1b6d136427e2dbb48e343e628aa5f7d782891ab7e2b71d916cf5eedb54f5ad233ab760a1951c87f5c32aae4dca02cf1b7d197463f3625

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
13B

MD5
a4710a30ca124ef24daf2c2462a1da92

SHA1
96958e2fe60d71e08ea922dfd5e69a50e38cc5db

SHA256
7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7

SHA512
43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
18d2eba5447ed0a4b8757dc6506057d4

SHA1
0ea8061b0c22b33f7ea9a7871bcc8df55d550fab

SHA256
6d75f014e9af48ed637ef85ce122c9a31b38bff2a516fb126ea7321060ccb286

SHA512
9e96ea30b2fba2d63588a6433f42d3c69233b26a72c7ea7da4429422bf16afc9a14cb8efb92119cea14e46257aff21240958b564a11baf97bd59c4190c5c14dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
16b7586b9eba5296ea04b791fc3d675e

SHA1
8890767dd7eb4d1beab829324ba8b9599051f0b0

SHA256
474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680

SHA512
58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Filesize
16KB

MD5
3406d3b708dcef0116bffd8eaa181ad4

SHA1
3df64b48bff2b9d4160d900e91a7670046a24340

SHA256
fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd

SHA512
d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
57961508d9a96a7ffaba3d0d986346b6

SHA1
816c8a71710492408a6d4672c7d536cb45a6119a

SHA256
ed9cce9a20e200b8607c14a433f0f2e7137d746cada9798ae7bd0e21aa5d8487

SHA512
e4a9be2ca5efd7cd39dc1031cd0a69ec4349845f55210b87ecad4f86c50436a3f731306115a8d5be813390ad549e86b4ea3078abc603df8ca9b3d992720aa26d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
ac7f35e156c3845106ded0e90f064010

SHA1
74bf7efbfe16f00409fb2bdc7009a74478c2e635

SHA256
7df550e1ac308988ebd3ae90b7e13cc75877632f6fee114713abfe32c0d1d4f6

SHA512
213265c930903005932687c9a879ec830d600134d18a8c339bc19b332f473a3bf43b83ca07b2b0a8fe160df1215960b7659161da36af404a531439c894bf96d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
a0ce12600a6c335dd4e031e796eae478

SHA1
a08a2d1eaaeeb042cf0a37c753ddacc9500b8cc9

SHA256
66a17c6351629c9fb04dba12f069b2d7616372ae7172d54a9a4d0b77ee6d47e1

SHA512
4d6a355369f444816d6918ea768aac36beb27fd1c1dd70df7a33d71859414053e097067b021379d6fc24d85150d82177f52aed662bb59fcd7a9a7e1c1236d2fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
049e5a246ed025dee243db0ba8e2984c

SHA1
15ec2d2b28dcfc17c1cfb5d0c13482d0706f942d

SHA256
33071ca42c472861a2fabd0f82f8b03ef0daaa6796b24b83f3df02587e4c3d12

SHA512
bc5f6fa6a8cae20ab40eae4552650d75f38ebb158c95288a79d9f332623bb507946513c39d19c00a5aee323df01f0f1a51c54594ef1c293289baf45f4ae2145b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
4facd0ff10154cde70c99baa7df81001

SHA1
65267ea75bcb63edd2905e288d7b96b543708205

SHA256
a13534df0cd0a79a3a1b91085a6d575b47d5a9aad7fc6d712fd2616c0e95a23b

SHA512
ad8d2b965851c0ddc23e92ae151b3b0b2bcda850c446f4278bdb0754d6b42ead8fc034b394749578a27b33ad7e4ab0633f974dfd4773fbe4d93ae477f00b73f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
cc6c1fc4642151a768e0e5714c7b10ae

SHA1
b6c727bdaeeefa52e62e19c6a6a131803eea5561

SHA256
983b179ac4cc7c3c04c85b1927f0222e679db3102bfe6bc224e0117371eb832e

SHA512
82547823830ed8c7fb88f53e930788bc4e1ac8a972f31f4761f8a0459f6b896423d0b1b4f9779047b49af4c2f4bea9f843d77228e282f0a6b1d28c2951c1861e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
f3515508400c64f5e5654aa37bbd5c99

SHA1
7e2139fd2640f01784aa3ff715be4ca8f5374d05

SHA256
090bc62ba1a38afcabfc80315bd9c1f5c73521ab12ed1f168f6d1c707ced742d

SHA512
d6391627317802fd612727237454fc486e3b39e53ce8b12e63550781551cb236b005cc8e568231fc93f6e6eaa3be73fb74fca8e53b4e3242896a05f1635734a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3be3918f-1e43-4210-b841-c22f80e09097.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0

Filesize
355KB

MD5
2c017cd370b98f091fa277c8ed78271d

SHA1
8375a048564a44e5050bcfc12b1f2eff5f1f77b9

SHA256
c2b3511773b754984d34120b24d5af9c8be62298105c7251a3d0d4c14c4ddee8

SHA512
f93da7b825def400c32ae5f91c5e10ebeb17bb6d8596c556a02e9c3df24754448f818dd4b9d34af9ebe9c8c20be84d391fff22a04baead3c982775195d7dcb86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
09dcc6211939712d3c01dbc3757846a8

SHA1
c297b65d5fa415205d82b284eca9f51250794dbe

SHA256
b071473b43a1589daac031afc89e5f6121a84295825be7e0b04278198495cf45

SHA512
945445f1e450024243cbfaa3195b25035487b7b5ff2cc935d8a79010163afc65cfa43d16666927083ab39fbfd795e9fdaa84ef0c104b0374f0b98a6714016bb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
31KB

MD5
2510629b6ba9cf449b72bdb6821bd69a

SHA1
8ddffc3ac48f5b82ea01683a12e5ca4507bc0f20

SHA256
52f5676f01a061bcac8cb1835679914a14f485d645993cc1d70493991bffbeee

SHA512
2e7ead853bec2b3efad12d716fe8047336aa269932912c46abf61cb8b2bfe4d8480d9e1974def3d6f0b1c39a8a5ec7ab377332048d0cfaded4c7f39ce5f0ed52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc742e8e-8d86-4c2c-a946-d520a388195f\index-dir\the-real-index

Filesize
648B

MD5
eb20a893814e6dd474ad89b0338cda13

SHA1
228bf060472add580d9ac2d71102188484f19f60

SHA256
85490e429dbf52224f79346586fad66765131e48a3c1418b30e297bbb9e7f604

SHA512
a503dd51eb867b4650a484dcec40cfa55033471d6d5042ad62dce41abf896a5783abe7c4fc968b1e26042547d33f3c6321e92ea35595147df566e72d5efbbb48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc742e8e-8d86-4c2c-a946-d520a388195f\index-dir\the-real-index

Filesize
2KB

MD5
f10b311e7a6d290d2e602e2ee64684d0

SHA1
f0f4eda75307167196105201a7e9c9d14ced6860

SHA256
4368ba0cf7468ee007535aff1733b5664f6010c1f6eec0e71d157489881e3537

SHA512
42ddbd2865556610853bfd79a26980b9115a6899102473035c64ba944163a130f86d2542c6d42ea556c53bfd08c7093b807014076ccac55aeb9315bc6b5bae81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc742e8e-8d86-4c2c-a946-d520a388195f\index-dir\the-real-index

Filesize
2KB

MD5
2e52939ef8898fbe61be59ba8ae34091

SHA1
244a754e05b41a95d20372bc84ec8e1f88b67670

SHA256
93744cbe1ea40845c724a953ab267f5c4dfeb498fc6ea69505eed3558cced0db

SHA512
ca2078005c4e127d977060ce4cffe14d7b6474e4d2259e47c3a46bc7190cbcbbfe8dc1a945b66c4c4b49c51d1089a33dd0a6ac29ec4e35f45c37069ee649a576

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc742e8e-8d86-4c2c-a946-d520a388195f\index-dir\the-real-index

Filesize
816B

MD5
94653a16455e59cf1fca3ffced35be1b

SHA1
6847afee4eccbdceaf0f6a0098b631fa4c58c562

SHA256
903493774d0c5da2d917d54836e396e3bdfb4fcdb41f5cc1c5cf93c3485df145

SHA512
e31d0a89f973076af4aae1caea8c2c091fef82f67bc490a650afd0aa2bfddf1573ddb08a2b08c54fd685b269ec7cf50209d70aaee48494f45c7c04331cd04237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc742e8e-8d86-4c2c-a946-d520a388195f\index-dir\the-real-index~RFe57e31c.TMP

Filesize
648B

MD5
c3c101814cdaad2df16508d31d08edde

SHA1
a6c62575440f821bc3e49d4196c03c75eef0124e

SHA256
d7f97a802bc097e715e623081191aefd4e59fe16778cf5b6d6f42cf3d646cde9

SHA512
5a0df9fb2c88a9915451247a9ce3d01ed58e0c879b59d0bc4458d8bdc22a0fd67d75943252fb732f24ec9cd5a4fa6d08af920b4d1cb66a9b7e1e45fcf188f148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc742e8e-8d86-4c2c-a946-d520a388195f\index-dir\the-real-index~RFe587a9a.TMP

Filesize
816B

MD5
419960035c33a81c0142f2b85a39709b

SHA1
748a53d4088c82742fb77dc59a4d0fdfe40468a4

SHA256
4c4574d3bc0ee6a302b26134dcc5fccf94f310bebe2b8d582b79600796f1bc81

SHA512
4cbf285e7cf82d8ab44236c1adaed5326960fbb2ac55a79d3230d4d50d842329520e4566fa353812d374939b883c25166a1915a751e81f8be9c8ca3207484633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc742e8e-8d86-4c2c-a946-d520a388195f\index-dir\the-real-index~RFe5912c3.TMP

Filesize
2KB

MD5
456e08c8a65eabcccb129928a095401a

SHA1
99cc77fea7583b23b5178c1e642c648e32497b71

SHA256
9be51b5a8dff4ac15241382131973fe3e96a727579a8e01cc24c18300bf8f0a9

SHA512
74797707433734a41926df143d070ad6c1e2617c2abba2eb28705758dd5f1f204fa66dc60456a99cb5fbc24dea0b4176a46ec0d67402bbf269abf71defe49325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cc742e8e-8d86-4c2c-a946-d520a388195f\index-dir\the-real-index~RFe599783.TMP

Filesize
2KB

MD5
0a15860ca56c5f4aa665fcde1a18188b

SHA1
aea9c206d84522ab843548134d87333e90067b21

SHA256
0d3ba3eb987dc5c5eca4df0348c5e8ffb199b4a8dfe672614c5e2239ff6a56bb

SHA512
9ca9c33ffc7619a9a2f5eb77628ac4759e087d212698f5d9a731b3156d3f5987c44a1854417e0708632a2f5181f813d33e87243e1a9e6eb2c93410d6ca90ee8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
a739916d1c9a2e18247621b2ee705117

SHA1
f90f4d50285e33f2baf4a73543f5ba0faccd74e1

SHA256
980cf8e63cac26b49ffc64e3be67c6291bb02d6c339df8e2f04e8eeb338ec021

SHA512
e3c4da9dfcc07da65a5d6f2717f530d50868f16080a5705777a5878dc6ea258f222d3215c0d35117d04d4184e4987fec0cb1cf86a525c145a4b28adc61858c21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
5472921cd0e41001265af871cbf2eb75

SHA1
d6a1a0dd08d0194afab39339ca3b6a07406e084f

SHA256
a7cf9e3d4bade1e4c3aa0530e4a0197d1edc17e11ca492db3004e3e09129391c

SHA512
71823bb9bf69e48931967b52ef85cd17f03909a72102a02b144fa2338b4f579c0d3e7bdac8e2d2e23a86630deaa2fb6bfdb1ea4df9d7af6d07c1e9ee43578536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
90ee0764c262b5c7afd32d012232ca25

SHA1
ef228bedb73bdd4637d640c3547297c057cd95dc

SHA256
d167d9f0a0069c23b7486e768aae376ca01069748df02e20d951e4e0a244fd46

SHA512
4eff7a6f43b2be9803c91f4a1e3247b2f0571c3fd85b1f101b3edd6cc6d21ef3c5286d8c7467787984c67c3d521d331cb7cac95e28c1ab9af4cf98e306363f97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
0fff223d5987c80bd464d1d927c89de4

SHA1
9c7b2a70b526194b45b4cd6092f87db8d5de9116

SHA256
36b01c623a5d1865f5a98e8d4776f120f7c50925f1e11a6e42668dcbde92ece6

SHA512
779eb64f5eb63c3ae450829b4464fb4a5668b19d1f55eb98304e18fb4981a83c1b7df7bea3b6196045987148fba3b683b809ac5e669039f55c5d04a1cdc9ee13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
21475a2aecbd12c01ed3504c75035ba3

SHA1
46025a10c154d654f9404c5525f717081491239f

SHA256
132086c8a79766a706b44febe85dc8cf0bd326d908a7329d88da4de086c639b4

SHA512
309eb040cad7b55fe7ebb2f6d8e9b1b670f688d540c54f1217479ab3ce6eb7158527ed9ce120223174d995465d93b9488e6f647be5af477c506387fa681aa90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\edce6b5b-3ff4-4edd-9389-ba13a3cc478d.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f19a7891-7e92-401a-bf31-a4b6681774c1.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir18572_1598529459\CRX_INSTALL\_locales\gl\messages.json

Filesize
927B

MD5
cc31777e68b20f10a394162ee3cee03a

SHA1
969f7a9caf86ebaa82484fbf0837010ad3fd34d7

SHA256
9890710df0fbf1db41bce41fe2f62424a3bd39d755d29e829744ed3da0c2ce1d

SHA512
8215a6e50c6acf8045d97c0d4d422c0caacb7f09d136e73e34dba48903bb4c85a25d6875b56e192993f48a428d3a85ba041e0e61e4277b7d3a70f38d01f68aab

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir18572_1598529459\CRX_INSTALL\_locales\ne\messages.json

Filesize
3KB

MD5
065eb4de2319a4094f7c1c381ac753a0

SHA1
6324108a1ad968cb3aec83316c6f12d51456c464

SHA256
160e1cd593c901c7291ea4ecba735191d793ddfd7e9646a0560498627f61da6f

SHA512
8b3e970a2beb8b6b193ad6ab9baa0fd8e1147cb5b9e64d76a6d3f104d636481621be52c2d72c588adf444e136a9b1350ac767255d2e680df44e9a1fb75e4c898

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir24232_1534671066\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir24232_1534671066\CRX_INSTALL\_locales\en_US\messages.json

Filesize
1KB

MD5
64eaeb92cb15bf128429c2354ef22977

SHA1
45ec549acaa1fda7c664d3906835ced6295ee752

SHA256
4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c

SHA512
f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir24232_1534671066\CRX_INSTALL\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir24232_1534671066\CRX_INSTALL\manifest.json

Filesize
1KB

MD5
2a738ca67be8dd698c70974c9d4bb21b

SHA1
45a4086c876d276954ffce187af2ebe3dc667b5f

SHA256
b08d566a5705247ddc9abf5e970fc93034970b02cf4cb3d5ccc90e1a1f8c816e

SHA512
f72b9190f9f2b1acc52f7fbb920d48797a96e62dfc0659c418edbbc0299dccf1931f6c508b86c940b976016745b9877f88f2ee081d3e3d5dcdcc2cc7e7884492

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\128.png

Filesize
4KB

MD5
d056cec3b05d6a863ddfa7ee4c1c9f0c

SHA1
dcd15b46dea9d234f13d7f04c739a2c516c973f1

SHA256
ff702ca753a7e3b75f9d9850cc9343e28e8d60f8005a2c955c8ac2105532b2c9

SHA512
751274949b04c7cdc5e8f5f20fd062bfe130f1415eee524d9d83bcf1a448fbfb4b82dff8bbf7495250a852779c3d11ac87e33275508a4064f9d52417f4ca230f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\af\messages.json

Filesize
772B

MD5
7bc8fed14870159b4770d2b43b95776b

SHA1
4393c3a14661f655849f4de93b40e28d72b39830

SHA256
aa12205b108750cf9fa0978461a6d8881e4e80da20a846d824da4069d9c91847

SHA512
7e943b672700edd55bfd2627f4f02eb62eee283e29f777f6660fbdbf04f900757272c5fb8a0c8744c197a53eadacd943598b131fa2d9594d39e20baa2a9b79f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\am\messages.json

Filesize
1KB

MD5
83e0e58d0752ff7c3f888e6406413b84

SHA1
14a8981e4355301bb3073db6d7ffb337ef8482e3

SHA256
64e01bc292ba2ea1699576fcc445367047520ee895e290ccee20c24c9336d8ef

SHA512
fc772bd3d6ac64110562aaca7d320f49ffba4e1f9ac2e10456fcb75e172d086d3ce8996cfc64b33b2ecdf4f6b96e38905e671c1e6ba5205fede9af4a183812c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\ar\messages.json

Filesize
2KB

MD5
c825621044e4d5c504404dae9752285c

SHA1
68c1e29daf042487cb76629abcdc03f16fccc92a

SHA256
47652115cbb912907f405992fcfc64f987642158f0cb35c9d6e0d4742d833802

SHA512
4aef3e7a747e290be8ba10e22e670c1c2dc653d4311020a4fd3060205fd88bb5d13d9edf388fc18919abe353c62d6841a4ef87e38064430299e52ca16c81941e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\az\messages.json

Filesize
1KB

MD5
c603747b8578c1324dd262565f643e06

SHA1
5cd18bb971af007d9a589377a662688daafe7519

SHA256
614470da3c5034ace649f1786beaaad2c94f4475bcc8858390b721f06fb7bf64

SHA512
59a5b29459e6a10628ab95ed620ab159dacde2d98dc2c3dc7949d0e5e253f2be7a21cb13f0ee8ae0e2f85191a520c9daf797fd93b27c39f53b1faa8aef1b706a

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\bg\messages.json

Filesize
3KB

MD5
361b516edf253851044dae6bad6d9d6f

SHA1
d64c297cf1977cd8ad5c57d9b0a985a4de4fd54b

SHA256
22bc37b47ce8a832f39701641dc358357676e9be187a93a4c5d4b016e29238ae

SHA512
b2614c53e93e705a93b82db9fcf5259ca44b10b5e5237967a34f68607ab2380ea0c8e5df4ffd941d914617fa3538fd40c18df7d3c9808c5f652852f01e214c77

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\bn\messages.json

Filesize
2KB

MD5
b1101fac65ce2faa3702e70fd88957d2

SHA1
06ebd889fad9ee2d5d5083b10abf7b2a4d0e1724

SHA256
3e3ceaa214d8079b02c9c941635f5d45e621236d9c3f82e06ac604f0772670e8

SHA512
398d03bd3b51e2789d0573f5e4792c13193c36539e8fa35261bc3b9a991a155635e6d44a9999b42d3dfa264e3fc329e11dd65d6e1408c4076a49576e7e5ef4ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\ca\messages.json

Filesize
843B

MD5
fbb841a2982166239d68907361f41f61

SHA1
4a8d76a6fe1bb111fdbdfd42d1af0019a97fc540

SHA256
de6d7b7c2427ec4e738407d7834b71941f69166b030355e00f325ff1391df5a1

SHA512
8db540b4c9e250d3781797238b1d16ad820c568edc563bfb912872ab99950def7e89ee432c696ba9876e3d7b24a4e4c26fa5b0fa9e76a54e11ae63996e02a561

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\cs\messages.json

Filesize
953B

MD5
48663a88dcf0ef6c9fade9bee4935b91

SHA1
af7cad1498bb4b0f05c1468abe3563d0182a97b4

SHA256
5a701d67910ba6c7ccedc26e02fa707cc86a1be57cd7d36290a3d268732a42c7

SHA512
3c3e5b9e56535efe1e20d6024b6fa46d3ea969c971d5ec8f5af1c933c1feb75d25e7f26c9e2bb8d200bca70ea1f1bd7e93e4e1c09dbc447340cdbeefa91cc33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\da\messages.json

Filesize
764B

MD5
0e451c9c8453577e513aabf630c275f2

SHA1
5912cc58aa82bc75691540c8aeaca7c68641539e

SHA256
94cddb998c2c5ab40b6f074c359a60e6eebaaa2d52a9649c22f4ea4c1b9936f2

SHA512
a89dcc1ec8c79e7cf702692e20ebc952907b2fb1d76a3beef60d7415baee24e055e2988b55e12ce00bc112c115ddd9d46d63bf0a1c511fffb041da7054391f80

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\de\messages.json

Filesize
927B

MD5
5daf77ae7d2b7dbef44c5cf7e19805ee

SHA1
48c06099aee249dd05b268749836e3021e27cfb5

SHA256
22e2828bfdbb9c340e7806894ae0442bd6c8934f85fbb964295edad79fd27528

SHA512
b9fe759ba6a447ebf560e3ac6c79359e0ad25afca1c97da90f729dcd7af131f43c1f4bfcb2cd4fe379fff2108322cf0849a32995b50188b52258bfff9e5ca34d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\el\messages.json

Filesize
3KB

MD5
32886978ef4b5231f921eb54e683eb10

SHA1
9e2626e158cbd26a2a24a50e4e8cfd98a49984e9

SHA256
728d8cbd71263680a4e41399db65b3f2b8175d50ca630afd30643ced9ffe831f

SHA512
416832f007470bf4d9d915410b62bd8159029d5ddabed23d2bbc297e4bbae46f4346feb68c54163428a6932c537967ae9ef430b9fac111f15cfb001a480799b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\en_GB\messages.json

Filesize
708B

MD5
c4e77421f3361277f7e3aa3472b5eb10

SHA1
f8ddd7cd0cce742e68443d173196471e8a23bd83

SHA256
c7255e9b784c4b8df7df7b78f33a5737a9ab7382f73465351597b1da9b3d5fe7

SHA512
6c11cccbfa6e841d90fa5b41f46de5489359335dd59ccb06d5148e7d2ce3af1422b93eb574360be4695e69d851befed8a2588dd411a7b0a553cb621238d474d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\en_US\messages.json

Filesize
1KB

MD5
578215fbb8c12cb7e6cd73fbd16ec994

SHA1
9471d71fa6d82ce1863b74e24237ad4fd9477187

SHA256
102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1

SHA512
e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\es\messages.json

Filesize
878B

MD5
59cb3a9999dfbd19c3e3098f3b067634

SHA1
bcfdf1c9c7f5d0ce35d7918060ce704a99803bf4

SHA256
02168993a23e074e0800cbb338fe279f99ef420e326bf92916ffed83c1f06533

SHA512
9968acb9821bfff6f427aabfcde3023f5a6f588bbfc0efd2275f201930ec5e16d64ff228c76f77958d36091a3dbd510e95385f0cb99a3e4dde693f34e9e3ebf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\es_419\messages.json

Filesize
880B

MD5
94bc2d5609f6d670e181e1ff0d041869

SHA1
58d2c17878e7b6e73daa544b8ca7774e5d902a17

SHA256
e848603b7a73a88e3fe7bffa20e83397f5d1e93e77babb31473cc99e654a27b7

SHA512
04bf79f675888c79b270c82e3a0e7a07e24205e2159e2d98eb4585aee5c0d14c6be3a3d169d4ea702a74a76f9e622e70a181dcd9ae0cb9f2472550fb33e9565e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\et\messages.json

Filesize
914B

MD5
b18007bfc2b55d2f5839a8912110b98d

SHA1
842ecac418424b2fff4db81e4385d59e098b65de

SHA256
7ccc7b17bfe01c3c7dd33eff8f80d0b57fc9b175815e766c9c1c1e893725e20f

SHA512
166937891553597d585d17fda2e7ff2bffbd3731841ea6cdcb7add528a55aa7c257fc191d029dd1f57afd4349194c0cc7413c3752641e8217d465674b62b8ae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\fa\messages.json

Filesize
2KB

MD5
e578e08ee604158d674982ba060396fd

SHA1
fd601092203317fe9f576fbfd675e274001efa80

SHA256
e758273c25fbad804fe884584e2797caefbbd1c2877dfd6f87ab1340cd25252e

SHA512
131c75cdbc4a40068cf97d7becad08f49e77a9bda3fb1cc50501b0007273ee5c6eae2f84047d97f72b6fd9f28f65ae544eb807057a54a6e009b9bd8fb8ca4df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\fi\messages.json

Filesize
840B

MD5
1d4778e02337674d7d0664b5e7dfcbbe

SHA1
fe1763ac0a903a47446a5896a2d12cce5d343522

SHA256
a822b0e66d04644d1cfbd2517736728438743162c3213f15d986e2db85bd0213

SHA512
771c7ba7f93a6e9db94593897d495e190e58a9b9c490523cc410059e72538005e2de96864dbbed8bd1f01eaa4d1cd022443dddbf759a606e2903c9ddecac43fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\fil\messages.json

Filesize
799B

MD5
f954b2e970dc96e5889499db7392fd59

SHA1
39f56f0ebfe92c96e8bf91f82cc4fddbed1e0aaf

SHA256
41ce6a7b18364efecced0419b42165d4f86c43643bbe1043014d4142cf86186a

SHA512
23610477834ff51e93fe9467df997f9aeee63ce3a8a51464b87b1828dce25d50e0bf2f28df139ec59e6c6425b81613258de211735ab2e470dc63c9cb5a1860e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\fr\messages.json

Filesize
902B

MD5
85718fe4820c674c5305d33dfb5cbddc

SHA1
d4170743349f3e037718fde17bc63a369c2e218a

SHA256
6713b69b6c9e80b03e0a9d4a7d158197b0c7ec8a853c64c0af0b1a05ce54d74c

SHA512
678e934f8d4a1bf0b98844b796eaa2471a78911d4020bf755871650dd0adad6bf7b475d9e5bf68b6a911ed330308a08698706d9460df003648b612d97848e652

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\fr_CA\messages.json

Filesize
901B

MD5
681422e3fcf8711af8eefbb75a607c8e

SHA1
3d3576a989c8010a397888429476f2800052e79a

SHA256
af889c1deb6f9248961c2f8ba4307a8206d7163616a5b7455d17cead00068317

SHA512
2546c274749a75c09e8255b6fa53a080a14bb141c748a55ebd530b6f2ac8adca3111320511628d4eec2b39a8710578ff16929b06ffb1f9c2093d3f1ee4c6f601

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\gu\messages.json

Filesize
2KB

MD5
86de754c2d6b550048c9d914e55b5ff0

SHA1
5b6654101b3596742be06b18ef2a5d81da569ee5

SHA256
cc3e9077fcc9bd0dfc5dd3924c6c48b8345f32cee24fccc508c279f45b2abe61

SHA512
3a8d326b91141b18cb569a93bcd295075e94a0488f2ffe5afb80a4cb36e4523e28c87d91a64ed255445470ad6c8a34948fe091e709e8097dcdd06eba1cc52887

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\hi\messages.json

Filesize
2KB

MD5
4a9c9f947b479e5d89c38752af3c70ea

SHA1
799c5c0ba3e11ad535fa465ab87007c36b466c6a

SHA256
14895bf43ce9b76c0ff4f9aef93dbe8bb6ca496894870cf0c007b189e0cef00e

SHA512
293d9fd5b207c14d1ffc7945f80d3c2dc2d5450bdf1e7b7962767b8d330c9255da16dfa677234198569f4ddfd00bce82d70086df974afe512769597039e21cf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\hr\messages.json

Filesize
863B

MD5
eb6c5133c1fe7f9e8e4449a917d185d9

SHA1
9be42ac75487a77dfbbf01ea2098886e69956356

SHA256
985976b776e729835e047c81d3d731a6c488a6459aa8918dbc8ec808c0bf73a1

SHA512
1aba115b30c99e786845c137ecb8beec4b5162c59d10724dcc083ff6b91a47af45ca850fc0b3072d44be189b31abb67423c88369171b0c411ccf7ae884fd831e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\hu\messages.json

Filesize
1KB

MD5
fb8d08676aa88683f27a2759c5837529

SHA1
80badd0de6a8d87a8e14232f71fbcbe231eee443

SHA256
cf26310b073b0891996ecd761c6cb53f00193dee524213a9fb34225d636ec4b7

SHA512
5c4307b653cd841af14a4b57f225938be54d718c979fa4008513461fa6f8409bc82e050f0b32e587f8e52d5580aa7c6d667aa94b30a588cb87de585b015fe176

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\id\messages.json

Filesize
718B

MD5
3fefe403f5f537d9a2d28ab36b2c1a94

SHA1
dd674520092f333aff63138f660987fbd8fa51e0

SHA256
35872a3343d4b4768fe4702a8dc18b749933e81210db13466ad172bd2880f6eb

SHA512
45182775ac13b1f9406bc9595e822f24a9d8b854254e0d71514e1d99625b12b9cd8bc3226f04b1dfc79248f786f925b9b88a70e0d57bdf9a8dc48d79175ec60d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\it\messages.json

Filesize
756B

MD5
88a9acd41521d1d00b870e2da3044a88

SHA1
36716937ce047463dbfa5cf1f5ef4277fe354d9e

SHA256
3377a873db531113d79919e7a89369a79a602bac6ae09b9864b9378dc285f345

SHA512
a56ffa200c5f8b312d8ed77ea40df931b86074adf1577941726d184497531d1c89d77382983f01797604e6a5c34029fa88f3aae0d52c368e2046c0c6f21cd956

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\ja\messages.json

Filesize
1KB

MD5
113a674f2e4c66cc4d2a9c66ed77adea

SHA1
f5d38b743efa022d6f886bacd3afa850557e2762

SHA256
c1094a1d8457e782f229910b70fc7aece356aa779a423e869104946814660d35

SHA512
e7cd847d87dfea3228a1899aab7f27f59d7ba2919e81520501a9236c55fcdea418f1d29c3c9eb36e34cdfba3278e3bbd149ddf324c94295e029031fcd5a75677

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\kn\messages.json

Filesize
3KB

MD5
f55ce2e64a06806b43816ab17d8ee623

SHA1
27affcf13c15913761d0811b7ae1143e39f9eea4

SHA256
5fa00c465c1c5eed4bea860ceb78da9419ea115347ba543ddb0076e5c188feed

SHA512
a0e7d0f7beeca175c67a783adf5ff614c8e3b731311f82bc24eb0f0798938d79f15a5cfa012b3cf06d7a138d88e6f78eb3d3d57a3edebb60116de2dc706e2b0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\ko\messages.json

Filesize
1KB

MD5
e71a91fe65dd32cac3925ce639441675

SHA1
91c981f572497a540c0c2c1d5fb28156d7e49416

SHA256
57f81a5fcbd1fefd6ec3cdd525a85b707b4eead532c1b3092daafd88ee9268ec

SHA512
2b89c97470bae1d55a40f7f1224930480d33c58968f67345ca26e188ff08cf8b2f1e5c5b38ecfdbf7ebfd9970be0327cbfc391cf5e95e7c311868a8a9689dfb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\lt\messages.json

Filesize
1002B

MD5
8047409dcc27bfcc97b3abce6dab20ef

SHA1
d85f7a7a3d16c441560d95ce094428973cbad725

SHA256
b42ebfe071ef0ec4b4b6553abf3a2c36b19792c238080a6fbc19d804d1acb61c

SHA512
4dffe23b4168a0825dc14ed781c3c0910702e8c2b496a8b86ca72fdbba242f34fe430d6b2a219c4a189907e92b1a7b02ce2b4b9a54088222f5af49878e385aa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\lv\messages.json

Filesize
959B

MD5
20fa89ba92628f56d36ae5bd0909cb15

SHA1
52d19152e2d5848ebaf0103d164de028efecdbb7

SHA256
80d64f03dc2cc5283faf1354e05d3c3cb8f0cc54b3e76fdae3ad8a09c9d5f267

SHA512
5cb534fdba0f66a259d164040265c0e8a9586bb41a32309f30b4aab17e6a99f17baf4dada62a93e34cc83d5ec6449dd28800ee41c2936631484cc95133e3956f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\ml\messages.json

Filesize
3KB

MD5
ce70315e2aaeda0999da38cc9fe65281

SHA1
d47fc92d30ec36dcc102d5957bb47a6c5b1cd121

SHA256
907f2709d1d3c8fa26294938f4080bc477e62281c4c50a082c22db0195cda663

SHA512
af5c78feaacb689d9d50d0196ba9428e4f02b07876995e8b77e3bc0fee7fbf43f3ad2848d58940f193966c54f13652476e1fcfd6a827465caad32b0b2d3f97e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\mr\messages.json

Filesize
2KB

MD5
34ce3fa84e699bce78e026d0f0a0c705

SHA1
5c56d09af53d521fe4224a77aa66e61a3b0165ca

SHA256
275e7fadb93a810328e3adead8754dd0a19a062d5d20a872f7471ffab47aa7b3

SHA512
3a6cd2ea06b664689f089d35fcfa41b36c22b1d77cf78f66d0f5dcdc52a6bb29f7566d377b81edce6001b71cb7f1e1247d3d71965baa2e8ea9e6deaa208cf25b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\ms\messages.json

Filesize
796B

MD5
db4d49231c88c11e8d8c3d71a9b7d3d4

SHA1
4829115ace32c4e769255cf10807f3bdb1766f44

SHA256
9b32c491d0bfebdca1455f73c3c6f71796d433a39818c06c353da588de650f81

SHA512
c8b4a982abf61eabb1b7280f3e10fdf1350b20f38ca9878f33ddaf979fd617ca8e5ff4df6099c395fbae86c8affbae77653ba9cb736af22466e3cb85d4d92e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\nl\messages.json

Filesize
771B

MD5
d448e11801349ab5704df8446fe3fa4c

SHA1
6e299363c264fa84710d6dbeaedc3b41b7fe0e42

SHA256
e98c5cfe277a338a938e7277deec132f5ea82a53ebdb65ff10e8a2ff548ac198

SHA512
49c2c05207c16f1c9393f9473cc77fd28e1b1f47686ae1eeb757676019a0ad4a6478e5a76004911f4ae299b3b7331cb6dfdca3eed2078baa5da901ea44cc4668

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\no\messages.json

Filesize
758B

MD5
66439ba3ed5ba0c702ef94793e15de83

SHA1
2b3ca2c2be15207deae55e1d667c9dcdc9241c74

SHA256
b3ece279943b28c8d855ec86ac1ce53bdfb6a709240d653508764493a75f7518

SHA512
8b393f3be96020181a12a16fafdae9df555b09a7b03cc855009b26a48b0c7d583476a72bb28224e419d300013fe272316c2cb35de8d67dbab454b7cae8df6b94

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\pl\messages.json

Filesize
978B

MD5
10ba7fe4cab38642419be8fef9e78178

SHA1
fddd00441dccff459f8abca12ba1856b9b1e299b

SHA256
6538f562bd1baa828c0ef0adc5f7c96b4a0eb7814e6b9a2b585e4d3b92b0e61d

SHA512
07e490d44f8f8a2bdc2d4ad15753ad16e39d17693219418b02820d26558fbe3fce8a8583bae0ed876acc6326080867d05a732cd9a4c24b620753b84bda4ac031

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\pt_BR\messages.json

Filesize
832B

MD5
8e24ec937237f48ac98b27f47b688c90

SHA1
bf47d23436a890b31799fff14a1d251720eced00

SHA256
a6ad5d5fb7c90736e04f898970d2cc9d423415b54b8e572f18c05d6ebaf46f68

SHA512
060f9713be6cd4262e0c490e50198a33026b00a80c8a3c7c87f2b05893280e1b32d1df2536054f4544f7a014ecbaf5f2e299b49dd6f45705cabfff068ef50d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\pt_PT\messages.json

Filesize
855B

MD5
aa431ec252b4339a49d172c6b9292ba3

SHA1
26fd7003368d5342620464a53af547ddea7c7328

SHA256
156fc7ba9b5728908e1a74950b97474f73d8f58933d345c8eeea8284565c8357

SHA512
c47c2e530ee2dd0bcc1ed1c2f8c54aeea3dcfac277bd85026dcc6c07e2da693b35577bac4924c45bb8423ad9aaecba324eec74291ef5cf2586a8b0b9f0084cba

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\ro\messages.json

Filesize
930B

MD5
ee122cf26ebe1ad0cc733b117a89ff3b

SHA1
a7c21e40ab7c934b35d725b3e21e4cb8ea85bc1e

SHA256
4ecedb9c1f3dd0d0e3aeb86146561b3d7e58656cbdbed1a39b91737b52ec7f2c

SHA512
4866fbea6c8698eb3c8923b9875186c800519488784683c18e5e6523681c52429e7ba38a304e0d1b17a3997a2f4c8c3a5e9fb518466a910b119f65d7dd62b77d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\ru\messages.json

Filesize
2KB

MD5
f70662272a8fc9141a295a54002f644f

SHA1
23397edad4bcc4a1bb8f43f9c2d1f08a7e3332b0

SHA256
df379187b7f6de700e5c53420336e6b31b7dc31015f77b2b256256bcf9be54b7

SHA512
b6ca9a8f1a83c71ed8eb8f46a102662d22eb13700660cf5c8841e5fe92dcad11a252555f169ffc4d6a97c399dd514cdeacbbcc27fe39da784bd9c1ebe85f4508

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\sk\messages.json

Filesize
947B

MD5
a46e08b45be0532e461e007e894b94f4

SHA1
387b703c55af0cf77874a1b340969ece79c2705e

SHA256
5e886e7b616fbff3671dab632d1b6d8dceeff9004218485f1b911dcd8c9694a3

SHA512
388992752bd1efaebbd420fd5a8f2c6c775f2be4c61d690b46a418c72abaffe44ff8a4c332b45a8b75a243ae8d61f3d6da6e55fa768d17d2635079b03442a55f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\sl\messages.json

Filesize
855B

MD5
9cdfa5371f28427f129d200338c47494

SHA1
19653347e92967564bd8df14fde2eea2dc87bceb

SHA256
75d018cc8525605ddc591f6bfe5bdaa2efb164934e9d5438972651f8c818d581

SHA512
e6122fd5c8d387a999ef57c877bb70c896c1012b592333bcf2b93e44f7e8ba487f264e83cdefbbde972040cf6dc8f14a4a9e0e0bca85cf1f9eaa35b817dd2869

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\sr\messages.json

Filesize
2KB

MD5
c2026342237e7686b1932af5b54f8110

SHA1
5af235b29947c7f770070f0a693979d9191fadb5

SHA256
a3eb276fbd19dce2b00db6937578b214b9e33d67487659fe0bf21a86225ece73

SHA512
2ce6fffa4ea16aac65acc8b5c1c9952eae1ac8891589266735c3ef0a0d20e2fa76940e6401d86eef5c87a1d24c1cc9a1caaf1c66819c56505b0b2860bfe5acfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\sv\messages.json

Filesize
800B

MD5
f008f729147f028a91e700008130da52

SHA1
643fff3dc0694fd28749768314150b30572caa54

SHA256
5f4229d18e5606330146ee13bdf726e10c1e06cbb15368c47f1ae68abe9ce4ba

SHA512
f5890cc08a9a40366cfffbbdb9b14e8083897a2950deb4bb23566d641dd4b06ab02479a2b83bd5001c179abff889506a3292cd92e31a6b92cad917dff760ab27

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\sw\messages.json

Filesize
840B

MD5
84eb1d6e827e40c578469eaab778e368

SHA1
3f53de16ab05f7e03ae6c8605c2339043c1a385f

SHA256
2c6b42d122943dc0ca92a33074d1a607351d3bc7f9768e174617fa7011a3de9f

SHA512
7a7ce81fa8be309d347ae0975fd6fcd904bc1ee86342dc0e88e789e7cf5967edd0ddccb9ba156510e74b025a23d479b6058101ffbb648c5d30c311f5ba1dfc6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\ta\messages.json

Filesize
3KB

MD5
24626ad7b8058866033738380776f59b

SHA1
a6abd9ab8ba022ea6619252df8422bf5f73b6a24

SHA256
3fc7f56f6d6d514b32547509b39f6380fc786efbcca4b9859f204456ca2e7957

SHA512
4fa2f084175d71923ae3186c8195781e1946f6c19b1a4bf659d3ae2dc45f1ac2f84d794b4487ec5e030ea899ee1decf07b3cdd3eb0d3dda996c5ff8a272cf97a

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\te\messages.json

Filesize
3KB

MD5
50ab4deabad394d13c265b8b80d9f9c3

SHA1
ce9c786cc92359ca34483bd57ce121f699920ddb

SHA256
90868a8a4a4dbf48770c14a161faea406ef9a453b75f4cb7a53c1b4e96a88599

SHA512
3ba6498cde1fe4c8f012a75ee546e9793b812cb7306c927054427fc697cb729549196f8e45db1a7a7dd1e485e6a3d3950168e33b03b669f5d4676c372f519a6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\th\messages.json

Filesize
2KB

MD5
0875b0bad81161ccf2c16e13ee49af9d

SHA1
686663983a022689dedf5ba22c0f169e1a654e64

SHA256
d299aa0c4f29c5c8248a1c51afdb7439f4cf7bc28ee02408a598f8aad9f70810

SHA512
d569dfda9f0851fb0d5b2b8454704461e0185b573f3839416f3237f2d89c372e58fdce7d871f44f6f3777c7f4177009bb1fd3cdbe2f4f3d62015bd130851e8ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\tr\messages.json

Filesize
1KB

MD5
3104bcd0d4ad6b47fe36f36c1b5aa333

SHA1
36ec46c7230487c0d26e185aa82f340d8312a265

SHA256
ac2894cea6332450095a7f8fc9b97550da87e4b4b6e6fb95df1a1f49f25e0e35

SHA512
873a8e1ec1eb2b482794c51dbfdd5b96cb9e8e2b5a74db3c3b54ae78a396585faec402a054ff332551b5ebcfc4a57bfc5bd92d08f9f73acb433efe9a18d89cd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\uk\messages.json

Filesize
2KB

MD5
ae938164f7ac0e7c7f120742de2beb1e

SHA1
fc49041249eaef40632f27faa8561582d510d4e3

SHA256
08978a1425dec304483bbb7dd0e55a7d850c4561abd41bac1be5d93d70465174

SHA512
b3f252885f9d7e4d74a5880b5fa60447511d4e2dce64db8ede5bd1b144f0f09a3c784649c2e1623a034ddd50b6b7ff990a3a6fc58c3ae124646c31f35b0b20fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\ur\messages.json

Filesize
2KB

MD5
f6e8fca4fd1a7af320d4d30d6055fa6d

SHA1
1c4aae49c08a0e4ee3544063c10fe86e7fdab05e

SHA256
504549057a6a182a404c36112d2450864a6cb4574cd0e8f435ca556fac52ab0a

SHA512
241e8505658e09d5559ec3a91fc6d1a88ba61f1b714d3cfc0e498e13908ba45aed8b63b483ecc5008a5ab07b24e1d123192fbd90b4a2289d52ad7bef4a71c9e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\vi\messages.json

Filesize
1KB

MD5
1e54afbacca335be3a050920ddfbe863

SHA1
fabd5e9d6bda46c9708a0ee26302156ca413a1dc

SHA256
f1da95e1d58e933050cd8a4fea12f3d1b9a2759479ffdb74fdc1cfbf89568327

SHA512
dfe60c51c043da92dec81fedb250dc60bcd97daba831261de92cdee35c0760610c1d436d04d74b65ef0a22e8cdf5201e3dde176cd9b7d5ccf1cc1ff9c884870c

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\zh_CN\messages.json

Filesize
1KB

MD5
e910d3f03f0349f5c8a6a541107375d5

SHA1
2f3482194c98ecbd58a42bd29bb853267c49a39a

SHA256
3893c066a36fe95f06f3c49091a20290d4e071183755f40af05455660beda2dc

SHA512
387ca0727ad0869041296182f17555f55552245d38284a1d5d2652b72959cc94dd345f8a1d6d15f7f5477817df9afa045f2267269d0d66938c7d401b4ca2eb4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\_locales\zh_TW\messages.json

Filesize
1KB

MD5
b571e4cefd96a2651ffb6621c4d3d1b4

SHA1
9fce97192139d1ec0885fd62a059fa81e473f9c5

SHA256
16b8f7be42b982d5ad9f638e71da38d134394b9bab9255f73cf514abbfaaf146

SHA512
6a315031b7c3e7b2cdee7a835aaad7fceb07d2889e4401e3be6b3a8c6492a47a9a065aab85fe2a69a1eca6bfe4a733f8ccfe8c5ec2fef681aadb77c9f5e57eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_548995598\CRX_INSTALL\manifest.json

Filesize
2KB

MD5
1048f1f4d861f5c812e5bc268eb68a06

SHA1
4c9495a3202f63fd0878086f27310db6d3bf5be9

SHA256
8b3b5b96a5d6d7c613052b4a751c6632f5f91cb0a912c96e515978999b6f43f5

SHA512
158ca9fc4e59568c8d04b8f6ad16fd8216ee10d8869ce1e2dec844e52d3d3b19bd98433665fa003552e8896a2691531141ee11fef212d8d66283d7002ece8c76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk

Filesize
1KB

MD5
3e95e93d45ba064bfd63340647b199bb

SHA1
407661e92ade0c039cd6bb7d25943006e598b3b6

SHA256
a947ae6b7058968c053e9469802d0c28d548ffe7de633cc95274625df98de374

SHA512
bd718d08100396c8963c3e47959314db3204c4c84bd58e6a46cd8a9336dcc4e06fe89f776c04df4c4df88b369efab9a48efd66fa97d37c7f24910f1a3c199a06

Download Submit
C:\Users\Admin\DAAECAFHDB.exe

Filesize
634KB

MD5
d62b289592043f863f302d7e8582e9bc

SHA1
cc72a132de961bb1f4398b933d88585ef8c29a41

SHA256
3c5a551b8fee65ffc444a3c0730b990591c3a95e442426563539f0a2ca3871d2

SHA512
63d389102c1b78ea5157aad0a3f45f351a5752ae896729d85be81b70721f19869efdb8dfa87906f891be9bec0d9154b7498e4ac4216fd3ec574fae64707e258c

Download Submit
memory/436-373-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-386-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-843-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-783-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-782-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-781-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-780-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-779-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-778-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-777-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-774-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-773-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-734-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-29-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-395-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-30-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-382-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-381-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-380-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-376-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-72-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-370-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-371-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/436-372-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/820-1798-0x0000000000940000-0x0000000000984000-memory.dmp

Filesize
272KB

Download
memory/5740-795-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5740-794-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5824-822-0x0000000000300000-0x0000000000344000-memory.dmp

Filesize
272KB

Download
memory/5880-844-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/5880-807-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/5880-806-0x0000000000400000-0x0000000000650000-memory.dmp

Filesize
2.3MB

Download
memory/6256-1810-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6256-1809-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6256-1804-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6256-1803-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6256-1783-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6256-1822-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6256-1818-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6256-1813-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6256-1823-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6256-1817-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download