xorddos | a6ee6130d83bbe55e9dacdff2005950d69fc2d3c54e28467b82c148e274d90da

max time kernel
575s
max time network
682s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AutoClicker-3.1.exe
Size

860KB
MD5

c208a15591828ac1b1c825f33fd55c8a
SHA1

bea4a247ece1a749d0994fc085fbd2d7c90a21e7
SHA256

a6ee6130d83bbe55e9dacdff2005950d69fc2d3c54e28467b82c148e274d90da
SHA512

b78d8055fc64bac1cdd366cdb339df2e081228bd998fdb5450a6832b0720c1b321568aabd7535ce62c16067ad20c86e51712c3e78bc40945adc05c63565fd889
SSDEEP

12288:2aWzgMg7v3qnCipErQohh0F4xCJ8lnydQEzFGZ3dRP6yWD:RaHMv6C1rjpnydQEOPdWD

Score

10^/10

xorddos aspackv2 botnet discovery downloader persistence privilege_escalation upx

Malware Config

Signatures

XorDDoS
Botnet and downloader malware targeting Linux-based operating systems and IoT devices.
botnet downloader xorddos

XorDDoS payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024569-4110.dat	family_xorddos

Xorddos family
xorddos

Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
527	5368	chrome.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00070000000245c0-4284.dat	aspack_v212_v242

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
6244	7z2409-x64.exe
5708	7z2409-x64.exe
2332	7z2409-x64.exe
5964	7z2409-x64.exe
2752	7zFM.exe
3944	7zG.exe
4884	7zG.exe

Loads dropped DLL 6 IoCs

pid	Process
3416	Process not Found
3944	7zG.exe
2752	7zFM.exe
3416	Process not Found
4884	7zG.exe
540	taskmgr.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 26 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
477	raw.githubusercontent.com
478	raw.githubusercontent.com
179	discord.com
191	discord.com
464	raw.githubusercontent.com
466	raw.githubusercontent.com
473	raw.githubusercontent.com

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000245ef-4378.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2409-x64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoClicker-3.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2409-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2409-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2409-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2409-x64.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 23 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Internet Explorer\TypedURLs	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133884076567795561"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3975168204-1612096350-4002976354-1000\{464962BB-5DF9-4F1D-936B-C4489E08223F}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "903"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "936"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "903"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3975168204-1612096350-4002976354-1000\{7D1C7F3B-7C92-42C0-8B50-3A29C2F19242}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
5812	chrome.exe
5812	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
6860	chrome.exe
6860	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
6272	chrome.exe
6272	chrome.exe
6272	chrome.exe
6272	chrome.exe
6476	chrome.exe
6476	chrome.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
4896	AutoClicker-3.1.exe
4104	OpenWith.exe
5620	OpenWith.exe
2752	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 50 IoCs

pid	Process
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
6272	chrome.exe
6272	chrome.exe
6272	chrome.exe
6272	chrome.exe
6272	chrome.exe
6272	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: 33	1476	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1476	AUDIODG.EXE
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: 33	2192	chrome.exe
Token: SeIncBasePriorityPrivilege	2192	chrome.exe
Token: 33	2192	chrome.exe
Token: SeIncBasePriorityPrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: 33	2192	chrome.exe
Token: SeIncBasePriorityPrivilege	2192	chrome.exe
Token: 33	2192	chrome.exe
Token: SeIncBasePriorityPrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: 33	2192	chrome.exe
Token: SeIncBasePriorityPrivilege	2192	chrome.exe
Token: 33	2192	chrome.exe
Token: SeIncBasePriorityPrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: 33	2192	chrome.exe
Token: SeIncBasePriorityPrivilege	2192	chrome.exe
Token: 33	2192	chrome.exe
Token: SeIncBasePriorityPrivilege	2192	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: SeShutdownPrivilege	5812	chrome.exe
Token: SeCreatePagefilePrivilege	5812	chrome.exe
Token: 33	2192	chrome.exe
Token: SeIncBasePriorityPrivilege	2192	chrome.exe
Token: 33	2192	chrome.exe
Token: SeIncBasePriorityPrivilege	2192	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
5812	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4552	CredentialUIBroker.exe
6488	CredentialUIBroker.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
4104	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5620	OpenWith.exe
5964	7z2409-x64.exe
2532	OpenWith.exe
4108	OpenWith.exe
3100	OpenWith.exe
2800	StartMenuExperienceHost.exe
6020	SearchApp.exe
2564	StartMenuExperienceHost.exe
6276	StartMenuExperienceHost.exe
4364	SearchApp.exe
6428	explorer.exe
5196	StartMenuExperienceHost.exe
2368	SearchApp.exe
6380	StartMenuExperienceHost.exe
4924	SearchApp.exe
2780	StartMenuExperienceHost.exe
3120	SearchApp.exe
2616	StartMenuExperienceHost.exe
4892	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5812 wrote to memory of 4788	5812	chrome.exe	98
PID 5812 wrote to memory of 4788	5812	chrome.exe	98
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1960	5812	chrome.exe	100
PID 5812 wrote to memory of 1960	5812	chrome.exe	100
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1212	5812	chrome.exe	99
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101
PID 5812 wrote to memory of 1312	5812	chrome.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.1.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:4896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff8ab9adcf8,0x7ff8ab9add04,0x7ff8ab9add10
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2024,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1560,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1812 /prefetch:3
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2388,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3212,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3232,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4216,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4692,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5344,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5556,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5764,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5916,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5788,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5912,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5776,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5980,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5976,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3268 /prefetch:8
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5796,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6884,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6876,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=7320 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=7468,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=7508,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=7480,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=7552,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=7556,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=8080,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=8084 /prefetch:8
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=8268,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=8252 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=8196,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=8216 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=8252,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=8448 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=8144,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=7668 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=7696,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=8148 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=224,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=8384 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=6456,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=8472 /prefetch:2
  2⤵
  PID:6168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=7860,i,4358811880267195548,7509561925501534916,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=7260 /prefetch:8
  2⤵
  PID:6296

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4900

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d4 0x46c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4552

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:4744

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8ab9adcf8,0x7ff8ab9add04,0x7ff8ab9add10
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1928,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2040,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2356,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:6476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3020,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3036 /prefetch:1
  2⤵
  PID:6572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3040,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:6580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4544,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5156,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5376,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5396,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:6916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5696,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:6876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1728,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:7124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3640,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4652,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3632,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5744,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:6164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3592,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3120 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5740,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3060 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5732,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5132,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=3660,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5228,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5236,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5648,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5692,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=4776,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:6568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3600,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3588,i,15701432607331259331,4693193776940110735,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6860

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:6564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8ab9adcf8,0x7ff8ab9add04,0x7ff8ab9add10
  2⤵
  PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1900,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2080,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2288,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=2300 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3204,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4996,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5152,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5340,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5212,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3444,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:6292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3256,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=208,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5708,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3360,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3376,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:7116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5916,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=6084,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6476,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6404,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6692,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6216,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:6324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5912,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:6456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6980,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6964,i,12211187891876180263,11369012647322712660,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:3128
- C:\Users\Admin\Downloads\7z2409-x64.exe
  "C:\Users\Admin\Downloads\7z2409-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:6244
- C:\Users\Admin\Downloads\7z2409-x64.exe
  "C:\Users\Admin\Downloads\7z2409-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5708
- C:\Users\Admin\Downloads\7z2409-x64.exe
  "C:\Users\Admin\Downloads\7z2409-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2332

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6004

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6268

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5620

C:\Users\Admin\Downloads\7z2409-x64.exe
"C:\Users\Admin\Downloads\7z2409-x64.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5964

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2752
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" a -i#7zMap23922:76:7zEvent10603 -ad -saa -- "C:\infected_2"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3944

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:6272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8ab9adcf8,0x7ff8ab9add04,0x7ff8ab9add10
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1964,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2096,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2348,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:6972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3012,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3020 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3028,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4548,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5096,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5368,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:6260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5416,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3656,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3112,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:7024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3044,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5392,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4756,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5132,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5700,i,1106949459130427705,945592668093508909,262144 --variations-seed-version=20250404-130110.652000 --mojo-platform-channel-handle=1160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6476

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5708

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap6225:72:7zEvent17861
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4108

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3100

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\7964ee2994d0400c876d9e3bcd4cea78 /t 3420 /p 3416
1⤵
PID:3452

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:100

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2800

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6020

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\beb8ae7bc7a44f82ad41a01661139c9a /t 4288 /p 100
1⤵
PID:5128

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:6940

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2564

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6428

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:6276

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4364

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:5432

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5196

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2368

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:5956

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:6380

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4924

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:2256

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2780

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3120

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:4960

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2616

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4892

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:3148
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Loads dropped DLL
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:540
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Enumerates connected drives
    - Checks SCSI registry key(s)
    - Modifies registry class
    PID:4380
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:6108

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3908

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:6276

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:6804

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:7100

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4304

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:6900

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
PID:3924

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1548

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:508

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
PID:3008

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:6256

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:7164

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3152

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:5792

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3240

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
PID:2924

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:764

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:7068

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4072

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4812

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3468

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4212

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5628

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:8

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3904

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6608

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:5032

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4456

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3932

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3520

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5740

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5236

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2368

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2924

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6968

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:6976

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2436

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6300

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:6864

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1188

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6336

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5544

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3584

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2512

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1652

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:6392

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2544

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1084

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:952

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2376

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5116

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:7068

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3656

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4320

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:6020

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6732

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:7064

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5156

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:740

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3992

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3840

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:7020

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:952

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:6452

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6052

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:6368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.chm

Filesize
121KB

MD5
a7ba50e8a23bf4a17f827c69bdb8f6ab

SHA1
17db88d7fa4bdb042897cf1b8a8d6620dc4f3b07

SHA256
94561a6dd2e91b42d566846270b9d8915c30dd9200e7aab3a4e37547c0042491

SHA512
16598f7fe5dbad5abac11bbf84fce5a26dd686c1786ddeea7b86ea239fd1fd06587755eee7d376f4ca01a0c61f8b8babf5928222009160949a332fe5e985964a

Download Submit
C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
88518dec90d627d9d455d8159cf660c5

SHA1
e13c305d35385e5fb7f6d95bb457b944a1d5a2ca

SHA256
f39996ab8eabdffe4f9a22abb1a97665816ec77b64440e0a20a80a41f0810ced

SHA512
7c9d7bd455064d09307d42935c57de687764cf77d3c9ba417c448f4f2c4b87bcd6fea66354dfe80842a2fa3f96c81cc25e8bf77307b4ace1bbe1346cbe68435f

Download Submit
C:\Program Files\7-Zip\7-zip32.dll

Filesize
65KB

MD5
6915c13a6da91694aa3bb899439ed996

SHA1
b4a5efaf56051802f6b2e6da3895a66995a69df1

SHA256
15ef7d51e8ec5b05410d66402a8e168777cd007c4217b6c86dad46be167e482f

SHA512
6757407ad07642602eb841558c5535ee83e9775d9c7f639ad231ed3c8d89ed98a9aaaf1e1c1883ff5596955a28b00800c5f7c6a073e59d299687b07c0cfb54ab

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
c4aabd70dc28c9516809b775a30fdd3f

SHA1
43804fa264bf00ece1ee23468c309bc1be7c66de

SHA256
882063948d675ee41b5ae68db3e84879350ec81cf88d15b9babf2fa08e332863

SHA512
5a88ec6714c4f78b061aed2f2f9c23e7b69596c1185fcb4b21b4c20c84b262667225cc3f380d6e31a47f54a16dc06e4d6ad82cfca7f499450287164c187cec51

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
551KB

MD5
b6d5860f368b28caa9dd14a51666a5cd

SHA1
db96d4b476005a684f4a10480c722b3d89dde8a5

SHA256
e2ca3ec168ae9c0b4115cd4fe220145ea9b2dc4b6fc79d765e91f415b34d00de

SHA512
d2bb1d4f194091fc9f3a2dd27d56105e72c46db19af24b91af84e223ffcc7fec44b064bf94b63876ee7c20d40c45730b61aa6b1e327947d6fb1633f482daa529

Download Submit
C:\Program Files\7-Zip\7z.sfx

Filesize
208KB

MD5
c35811927e022b1631e3377be56fb392

SHA1
0d876cf74aa6515d6c6f90a7baf943cae48ba76f

SHA256
97b304ccf831e83ca58b5c99a736f6525f81378125143e92b76baea0988ec5e2

SHA512
5f8f65829051a8c7d0d0ddc98c574a2a58928af7f2ffcaf6d0aa4b414dd65ef78bbe8cee0fa53895481d3ad4cbd2c3f39db850c2d52ba640426fe7b0b4547094

Download Submit
C:\Program Files\7-Zip\7zCon.sfx

Filesize
188KB

MD5
cd3ff26df13ef76463bda01187917fab

SHA1
f1f71022280241b29362dfda57df32464f1e7233

SHA256
1abea0a0cbfbea36809ccd861e25625cc85fe296322676b40f399121075593ba

SHA512
ca49a147a9529f68ab9ff8ebfb09ba57ce21a7e66628a52cdd915c7a4d2c17621a36d002aa87f6ce72c25ac0121a816b8b3165e614c79e9e36337e234043b958

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
967KB

MD5
4eaae49d718451ec5442d4c8ef42b88b

SHA1
bbac4f5d69a0a778db567e6978d4dabf2d763167

SHA256
dc4fdcd96efe7b41e123c4cba19059162b08449627d908570b534e7d6ec7bf58

SHA512
41595b67c8506c054c28ce2b5dec9d304651449464c6e1eb092a049d49326594584900cff4e9b8210ca3ad8a23e9c22d8df1ae8af15f44a69f784cc546fcced3

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
696KB

MD5
d882650163a8f79c52e48aa9035bacbb

SHA1
9518c39c71af3cc77d7bbb1381160497778c3429

SHA256
07a6236cd92901b459cd015b05f1eeaf9d36e7b11482fcfd2e81cd9ba4767bff

SHA512
8f4604d086bf79dc8f4ad26db2a3af6f724cc683fae2210b1e9e2adf074aad5b11f583af3c30088e5c186e8890f8ddcf32477130d1435c6837457cf6ddaa7ca1

Download Submit
C:\Program Files\7-Zip\History.txt

Filesize
8KB

MD5
ccad44b829868fc155d11387f09c4f4b

SHA1
980dc6ceffd5c852f117034da08e14a34a36897b

SHA256
7d6a3d181b5166ffe08f2779903edd2749c3ef78fd3c0174bdc4380f4a7511b8

SHA512
97a0b4ad774a5ea008c67acd094e4c09261f759f82878f770d90d9fa63d2c283e231249815d6fca7fc12690edc55cdad76720125a403a3aa9237493ef0de942f

Download Submit
C:\Program Files\7-Zip\Lang\af.txt

Filesize
4KB

MD5
df216fae5b13d3c3afe87e405fd34b97

SHA1
787ccb4e18fc2f12a6528adbb7d428397fc4678a

SHA256
9cf684ea88ea5a479f510750e4089aee60bbb2452aa85285312bafcc02c10a34

SHA512
a6eee3d60b88f9676200b40ca9c44cc4e64cf555d9b8788d4fde05e05b8ca5da1d2c7a72114a18358829858d10f2beff094afd3bc12b370460800040537cff68

Download Submit
C:\Program Files\7-Zip\Lang\an.txt

Filesize
7KB

MD5
f16218139e027338a16c3199091d0600

SHA1
da48140a4c033eea217e97118f595394195a15d5

SHA256
3ab9f7aacd38c4cde814f86bc37eec2b9df8d0dddb95fc1d09a5f5bcb11f0eeb

SHA512
b2e99d70d1a7a2a1bfa2ffb61f3ca2d1b18591c4707e4c6c5efb9becdd205d646b3baa0e8cbd28ce297d7830d3dfb8f737266c66e53a83bdbe58b117f8e3ae14

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt

Filesize
12KB

MD5
5747381dc970306051432b18fb2236f2

SHA1
20c65850073308e498b63e5937af68b2e21c66f3

SHA256
85a26c7b59d6d9932f71518ccd03eceeba42043cb1707719b72bfc348c1c1d72

SHA512
3306e15b2c9bb2751b626f6f726de0bcafdc41487ba11fabfcef0a6a798572b29f2ee95384ff347b3b83b310444aaeec23e12bb3ddd7567222a0dd275b0180ff

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt

Filesize
4KB

MD5
1cf6411ff9154a34afb512901ba3ee02

SHA1
958f7ff322475f16ca44728349934bc2f7309423

SHA256
f5f2174daf36e65790c7f0e9a4496b12e14816dad2ee5b1d48a52307076be35f

SHA512
b554c1ab165a6344982533cceed316d7f73b5b94ce483b5dc6fb1f492c6b1914773027d31c35d60ab9408669520ea0785dc0d934d3b2eb4d78570ff7ccbfcf9c

Download Submit
C:\Program Files\7-Zip\Lang\az.txt

Filesize
10KB

MD5
9cd3a23ca6f66f570607f63be6aa0001

SHA1
912837c29c0e07470e257c21775b7513e9af4475

SHA256
1da941116e20e69f61a4a68481797e302c11fcf462ca7203a565588b26011615

SHA512
c90ead15096009b626b06f9eae1b004f4adba5d18ccdb5c7d92694d36903760541f8aa7352be96466f2b0775c69f850605988fa4ef86f3de4fca34f7b645457e

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt

Filesize
10KB

MD5
387ff78cf5f524fc44640f3025746145

SHA1
8480e549d00003de262b54bc342af66049c43d3b

SHA256
8a85c3fcb5f81157490971ee4f5e6b9e4f80be69a802ebed04e6724ce859713f

SHA512
7851633ee62c00fa2c68f6f59220a836307e6dde37eae5e5dca3ca254d167e305fe1eb342f93112032dadafe9e9608c97036ac489761f7bdc776a98337152344

Download Submit
C:\Program Files\7-Zip\Lang\be.txt

Filesize
11KB

MD5
b1dd654e9d8c8c1b001f7b3a15d7b5d3

SHA1
5a933ae8204163c90c00d97ba0c589f4d9f3f532

SHA256
32071222af04465a3d98bb30e253579aa4beceaeb6b21ac7c15b25f46620bf30

SHA512
0137900aeb21f53e4af4027ea15eed7696ed0156577fe6194c2b2097f5fb9d201e7e9d52a51a26ae9a426f8137692154d80676f8705f335fed9ae7e0e1d0a10e

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt

Filesize
17KB

MD5
2d0c8197d84a083ef904f8f5608afe46

SHA1
5ae918d2bb3e9337538ef204342c5a1d690c7b02

SHA256
62c6f410d011a109abecb79caa24d8aeb98b0046d329d611a4d07e66460eef3f

SHA512
3243d24bc9fdb59e1964e4be353c10b6e9d4229ef903a5ace9c0cb6e1689403173b11db022ca2244c1ef0f568be95f21915083a8c5b016f07752026d332878a4

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt

Filesize
14KB

MD5
771c8b73a374cb30df4df682d9c40edf

SHA1
46aa892c3553bddc159a2c470bd317d1f7b8af2a

SHA256
3f55b2ec5033c39c159593c6f5ece667b92f32938b38fcaf58b4b2a98176c1fc

SHA512
8dcc9cc13322c4504ee49111e1f674809892900709290e58a4e219053b1f78747780e1266e1f4128c0c526c8c37b1a5d1a452eefba2890e3a5190eebe30657ba

Download Submit
C:\Program Files\7-Zip\Lang\br.txt

Filesize
4KB

MD5
07504a4edab058c2f67c8bcb95c605dd

SHA1
3e2ae05865fb474f10b396bfefd453c074f822fa

SHA256
432bdb3eaa9953b084ee14eee8fe0abbc1b384cbdd984ccf35f0415d45aabba8

SHA512
b3f54d695c2a12e97c93af4df09ce1800b49e40302bec7071a151f13866edfdfafc56f70de07686650a46a8664608d8d3ea38c2939f2f1630ce0bf968d669ccc

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt

Filesize
9KB

MD5
a77210be2527533d1eceb8f0ea49607a

SHA1
807e36fce4dbe269601939a8579ffb43fe43f381

SHA256
da4df6490c7bc8afd804509f696f9afa6f709b7a327044e2781fa6c95770b239

SHA512
54096f332f2a9bd5690c973eae19ef4199a6acb5243133b9065f433830984f91b62a9f1d71efeed5952cff0bbcb1befdce321cbb090c620bfc13a98bcc1dc14e

Download Submit
C:\Program Files\7-Zip\Lang\co.txt

Filesize
11KB

MD5
de64842f09051e3af6792930a0456b16

SHA1
498b92a35f2a14101183ebe8a22c381610794465

SHA256
dcfb95b47a4435eb7504b804da47302d8a62bbe450dadf1a34baea51c7f60c77

SHA512
5dabeed739a753fd20807400dfc84f7bf1eb544704660a74afcf4e0205b7c71f1ddcf9f79ac2f7b63579735a38e224685b0125c49568cbde2d9d6add4c7d0ed8

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt

Filesize
9KB

MD5
1130abf0e51093dc7edd2c0c334be5d8

SHA1
260a373c4df2ec71dcd343ce4cd97b65d18efa82

SHA256
da788d30aa74b3f8b3d920e98c535e4544756e9e4e235ed0221654f3177d3d2a

SHA512
0f7242992c990085b8332c7e072928a17f4fa4e729451600f1abf58158eb1b782ac4a3c200c1db510bf70f13e6790dadf897e1d1c6effb77187ad41b02e16dbc

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt

Filesize
4KB

MD5
6bdf25354b531370754506223b146600

SHA1
c2487c59eeeaa5c0bdb19d826fb1e926d691358e

SHA256
470eaf5e67f5ead5b8c3ecc1b5b21b29d16c73591eb0047b681660346e25b3fb

SHA512
c357b07c176175cc36a85c42d91b0cada79dbfb584bdf57f22a6cb11898f88aecf4392037d5cea3e1bc02df7493bb27b9509226f810f1875105bbc33c6ae3f20

Download Submit
C:\Program Files\7-Zip\Lang\da.txt

Filesize
7KB

MD5
c397e8ac4b966e1476adbce006bb49e4

SHA1
3e473e3bc11bd828a1e60225273d47c8121f3f2c

SHA256
5ccd481367f7d8c544de6177187aff53f1143ae451ae755ce9ed9b52c5f5d478

SHA512
cbbece415d16b9984c82bd8fa4c03dbd1fec58ed04e9ef0a860b74d451d03d1c7e07b23b3e652374a3b9128a7987414074c2a281087f24a77873cc45ec5aadd2

Download Submit
C:\Program Files\7-Zip\Lang\de.txt

Filesize
9KB

MD5
1e30a705da680aaeceaec26dcf2981de

SHA1
965c8ed225fb3a914f63164e0df2d5a24255c3d0

SHA256
895f76bfa4b1165e4c5a11bdab70a774e7d05d4bbdaec0230f29dcc85d5d3563

SHA512
ff96e6578a1ee38db309e72a33f5de7960edcc260ca1f5d899a822c78595cc761fedbdcdd10050378c02d8a36718d76c18c6796498e2574501011f9d988da701

Download Submit
C:\Program Files\7-Zip\Lang\el.txt

Filesize
17KB

MD5
5894a446df1321fbdda52a11ff402295

SHA1
a08bf21d20f8ec0fc305c87c71e2c94b98a075a4

SHA256
2dd2130f94d31262b12680c080c96b38ad55c1007f9e610ec8473d4bb13d2908

SHA512
0a2c3d24e7e9add3ca583c09a63ba130d0088ed36947b9f7b02bb48be4d30ef8dc6b8d788535a941f74a7992566b969adf3bd729665e61bfe22b67075766f8de

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt

Filesize
7KB

MD5
bf2e140e9d30d6c51d372638ba7f4bd9

SHA1
a4358379a21a050252d738f6987df587c0bd373d

SHA256
c218145bb039e1fd042fb1f5425b634a4bdc1f40b13801e33ed36cfdbda063ed

SHA512
b524388f7476c9a43e841746764ff59bdb1f8a1b4299353156081a854ee4435b94b34b1a87c299ec23f8909e0652222595b3177ee0392e3b8c0ff0a818db7f9a

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt

Filesize
4KB

MD5
29caad3b73f6557f0306f4f6c6338235

SHA1
d4b3147f23c75de84287ad501e7403e0fce69921

SHA256
a6ef5a5a1e28d406fd78079d9cacf819b047a296adc7083d34f2bfb3d071e5af

SHA512
77618995d9cf90603c5d4ad60262832d8ad64c91a5e6944efd447a5cc082a381666d986bb294d7982c8721b0113f867b86490ca11bb3d46980132c9e4df1bd92

Download Submit
C:\Program Files\7-Zip\Lang\es.txt

Filesize
10KB

MD5
ed230f9f52ef20a79c4bed8a9fefdf21

SHA1
ec0153260b58438ad17faf1a506b22ad0fec1bdc

SHA256
7199b362f43e9dca2049c0eeb8b1bb443488ca87e12d7dda0f717b2adbdb7f95

SHA512
32f0e954235420a535291cf58b823baacf4a84723231a8636c093061a8c64fcd0952c414fc5bc7080fd8e93f050505d308e834fea44b8ab84802d8449f076bc9

Download Submit
C:\Program Files\7-Zip\Lang\et.txt

Filesize
6KB

MD5
d6a50c4139d0973776fc294ee775c2ac

SHA1
1881d68ae10d7eb53291b80bd527a856304078a0

SHA256
6b2718882bb47e905f1fdd7b75ece5cc233904203c1407c6f0dcdc5e08e276da

SHA512
0fd14b4fd9b613d04ef8747dcd6a47f6f7777ac35c847387c0ea4b217f198aa8ac54ea1698419d4122b808f852e9110d1780edcb61a4057c1e2774aa5382e727

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt

Filesize
8KB

MD5
c90cd9f1e3d05b80aba527eb765cbf13

SHA1
66d1e1b250e2288f1e81322edc3a272fc4d0fffc

SHA256
a1c9d46b0639878951538f531bba69aeddd61e6ad5229e3bf9c458196851c7d8

SHA512
439375d01799da3500dfa48c54eb46f7b971a299dfebff31492f39887d53ed83df284ef196eb8bc07d99d0ec92be08a1bf1a7dbf0ce9823c85449cc6f948f24c

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt

Filesize
7KB

MD5
459b9c72a423304ffbc7901f81588337

SHA1
0ba0a0d9668c53f0184c99e9580b90ff308d79be

SHA256
8075fd31b4ebb54603f69abb59d383dcef2f5b66a9f63bb9554027fd2949671c

SHA512
033ced457609563e0f98c66493f665b557ddd26fab9a603e9de97978d9f28465c5ac09e96f5f8e0ecd502d73df29305a7e2b8a0ad4ee50777a75d6ab8d996d7f

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt

Filesize
12KB

MD5
741e0235c771e803c1b2a0b0549eac9d

SHA1
7839ae307e2690721ad11143e076c77d3b699a3c

SHA256
657f2aceb60d557f907603568b0096f9d94143ff5a624262bbfeb019d45d06d7

SHA512
f8662732464fa6a20f35edcce066048a6ba6811f5e56e9ca3d9aa0d198fc9517642b4f659a46d8cb8c87e890adc055433fa71380fb50189bc103d7fbb87e0be5

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt

Filesize
8KB

MD5
a04b6a55f112679c7004226b6298f885

SHA1
06c2377ac6a288fe9edd42df0c52f63dce968312

SHA256
12cc4a2cef76045e07dafc7aec7cf6f16a646c0bb80873ec89a5ae0b4844443b

SHA512
88c7ed08b35558d6d2cd8713b5d045fba366010b8c7a4a7e315c0073cd510d3da41b0438f277d2e0e9043b6fcb87e8417eb5698ab18b3c3d24be7ff64b038e38

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt

Filesize
10KB

MD5
a49801879184c9200b408375fc4408d7

SHA1
763231bd9b883692c0e5127207cbfc6a2a29bc7d

SHA256
397a3af716eb7f0084f3aa04ad36eab82aab881589a359e7d6d4be673e1789a8

SHA512
f408203907594afa116a2003d0b65d77c9bca47663f7f6b26e9158b91dad40569e92851bf788a39105298561f854264a8dc57611637745e04e68585b837702f2

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt

Filesize
6KB

MD5
06b08fe12c0f075d317cf9a2a1dd96bc

SHA1
0062ba87b9207536b9088e94505d765268069f63

SHA256
6ba88938c468e7217bd300b607d7a730530e63d1f97562604ec0bb00d66a06c9

SHA512
9f9fb1c045d92c1f8035d547554457e3466ae861a04f1cd3f57965e4a92f0fc433b2a7b3e9e1e71588e97f8c73d5914a750deded5d3056e327d7efe19a220198

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt

Filesize
5KB

MD5
03d38f09189799a0d927727d071c54b6

SHA1
17ff3a2c83e6a0b0733f2a9a8ce6b83af4f1b137

SHA256
c1c050ed6fe2f8fbc048fd7d82944b8ada784415b6e62316d590c3c7aa45e112

SHA512
e511c1a271a3d78cb7f6111759eec4d7cfc2d46f71f87aa3c4ac1bb11cd4e55e7d4dbe54f9c5107025ffe8c5fcadad4359dc673bc802b82388e74a8f2fa60ff7

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt

Filesize
7KB

MD5
236cfc435288002763c68c4bbee7b39d

SHA1
e74a2402c2cb744dbed8ac1c2154fb1de38148f9

SHA256
b18730124208d26e5e88b76bb99985bf61938d7a994b626b2de5230557d2d8dd

SHA512
fa6941594454cda55e081f15f367f430559849d218895b0b157a2204e8b30ae95db99c62981a9c30a152a63d1bdb8edd975bf06ee5adf1f31b42a2c10cf11580

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt

Filesize
8KB

MD5
6cd7c2b4d6bba163b1623035feb4297d

SHA1
5df07bcfd1edbd448b566aea5789ef251303de69

SHA256
9280ab90261b0c8f206eef7196d7531e4e4932c9174ab899cee4f8ed97cc87c6

SHA512
7ed13085ebc2545b434f5671f958f7a5faa1bc29f7c10721a972afd2c886fc39f0a6e290e70f1f8ea798199ca26974257eaf9b8445652c9b02c789e198191a3e

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt

Filesize
16KB

MD5
93cdc8832328a22e198920630d597268

SHA1
315e5b1c77fb4e2d0c3cc1f48b6db4c79ce9488a

SHA256
c6e54e2a93b821bc974209cd7e2d10e9fbc4ff07d238ae84f552e4ade271702c

SHA512
e8355a42f3a3b5f21d5d4c7a21324433c997ad39412b3bcdcf26edbd5ef882179168b2b5618f9fe631b88407608ab1a83bf139db05c09b608fddf01694b710df

Download Submit
C:\Program Files\7-Zip\Lang\he.txt

Filesize
10KB

MD5
0771f160d56b1890a1cdc2ca040d2616

SHA1
36e69202682bf6993273b521424ec082998f6ca9

SHA256
03b4ea89cce3aa4193a7e3e1e6180dab8359388df3b574379935ea39d7b8d723

SHA512
b452c75292c7d365aa5759fb3f49de674255e839caa687436474b782f615b2ad86a11a58809a5bb60115b070c9b738a461db24e70502598a3bfeccf373220dbb

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt

Filesize
17KB

MD5
18d9c82f12e07b71e03d6086deba0dc3

SHA1
c6c11c6f1fc00a25dd53e1c78f207f6c8c8b8b13

SHA256
5f79ae167a917860f95f73e5ed007fe250f30af794bcfce17941f9ef87d22a05

SHA512
196a859d52a1a742b98460eaf113552dce2cfc63378b19d2902beabc1e66cbd9e26bf37fc26453832aa10929aaf0196ed9211332e63c830b0e5946013c82bdc1

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt

Filesize
7KB

MD5
9d8216183493ac2190a4d6e142ecab9a

SHA1
e534ebb714dbae2a9e12accbe96c6f2568b814c4

SHA256
210af273246d30cfde87295cd5f4ff135b0bdfb04fe7173bb60f935e685b8e10

SHA512
5b56560ad70652c9c6287f939b25676d8149c000c2388365197354dbe38c5cba5c25f0a3a529f0601a5b5d964b7278ab3a668e8469cf0ec718821fdabcf044bc

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt

Filesize
10KB

MD5
a41e4d16c3b29603832ffd1bbb82283e

SHA1
15695a0bd98d429e9ab191cecb185b70cc492668

SHA256
486a382483096e9a86ccf6ca02123e48025de5055f1880af7f001c5c3fa25114

SHA512
413dd8c87015ede7868f992c25d568de66e1bd765c7a43066d8da8cf350f3620c77091f075020862ff6bf7c980c6091e92c5c843b3d57957c7516f5b0f51bca0

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt

Filesize
13KB

MD5
fe73c2aacf07d5120aedd08792cb8268

SHA1
2c6e7d2ff42c5f65ef5f4c27600819354caa03b0

SHA256
91aac9368bd116ab11fda0b70ee4d75911a65713a272a3ba55d1435c33250f5a

SHA512
79dbd84fe71888b7c9fdbcd23f2d4735f731e3c2c7724fbd531c3ca531b1992e756b13b66889af30ec46770d350fcfaef2d7abe607594a2b4b92f60ed326d537

Download Submit
C:\Program Files\7-Zip\Lang\id.txt

Filesize
8KB

MD5
ba3591ccf26438cbe93e9c1d56bd1818

SHA1
758619a702d5a0794e4412aa6ae93fc46ea3dfb9

SHA256
90308689870ad079e1206a877157f7389bc4351a6b104ffa2bd9311409d6d92d

SHA512
2e9066bd733caaa9cedde2346be543d4360bd796e01bcb669602c9e6450ca5a2718cb67613469c11a4d2aa8c458d7fe9c59ab8eb9bde39846c195ce2cc22686b

Download Submit
C:\Program Files\7-Zip\Lang\io.txt

Filesize
4KB

MD5
0861ae63da2d00590369bb11b3857551

SHA1
8272f4761a3f2aca2bfaec6fcf08c82a9f36a65a

SHA256
b87a4fca8a0024a915ae86e36951cb7cea442948d9982d4247e49492445ba664

SHA512
70997d6775e1c91d021fda2143c831fe8396094e50337da3c4897da70636b7f10b363f35b997213a462b467fe6754d2c33e009e84363063eced871a2591cce88

Download Submit
C:\Program Files\7-Zip\Lang\is.txt

Filesize
8KB

MD5
c8f31d6adee368ca0aa00350df0d82df

SHA1
4146c7c62dd46b2c43c92cdf33e45fa7e2272d04

SHA256
dc61090369e1269a68c75e472d863aaf42207f702b3d3e12ca48d2852e1478e3

SHA512
758af54a33dc243992324974f01707c8027be7bdc7d07187a28038f4c9d8f7681d989b66f56a13b86e99c8bc74d80a70fa44bd5dd9532c99b78df7985b397ed8

Download Submit
C:\Program Files\7-Zip\Lang\it.txt

Filesize
9KB

MD5
aa7b46b6ddd673bc06bd90187e552743

SHA1
2c11a1e5f97ac1415073c2c953cd92018cf3eb93

SHA256
efb1aed5c52af731a733c720b6f5479898c9de28367a5de4c80f697fb745546a

SHA512
10c262122417b081d0403f9c917a4beba34078ca52e88478ebd2c0b6956aa6b61b34511fac71e87578d56ae1f5acdc265cddac8c92b9f14757daa75042dfc7aa

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt

Filesize
12KB

MD5
a0c7eb5d5a5dd7ab6f4c1e4fef092256

SHA1
f121129211dbedba3c440267fd9bd1c636e263c2

SHA256
9f70f1943a8e0a9b9040d1f769ca2494c2b83ceb8dc55b08db1fc3e6973ad835

SHA512
f864c9ac99edc97968feca96919a412e87c27457f5e0a8956dcecf37351ce7aeaf0e745343a649743d665b46be108b3cc5bafd92029d25d5a5d9bf6c390e5149

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt

Filesize
17KB

MD5
c99e6572f5638599dbca2ceac337a320

SHA1
73c64554a00c6d5a3dab8a2e7bd50426d6c7b6f4

SHA256
8dd6073b585dd2e9d8cdd8e0fce7dfeaf2f5a2d8bfc3059f67eaa3d8b5eb2d9e

SHA512
cde3d44793d1abab3b8d0ba71d1af85c7ca49b37f4331b43d546d1f2022fc9cedd1188869acee5bf9b74046788daf26f4e4658af86663065339103d2a602f7aa

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt

Filesize
7KB

MD5
ffc17520fb68fe464650b2f78e15ab5d

SHA1
2b83034ac04640160ddaa8e797faa5d8c80f956b

SHA256
24f7325271dd7ad2b63e977841d2f06ed0194bd9257f0db460df32baeeec4746

SHA512
4f1483796a8ef95b2be61811a6566ea2e19564f37733647b6eb4e1c82a8da8fa927afdf024a247fc7e70088f63133a7843fe6129b77b2ada01e39a1e814429c7

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt

Filesize
7KB

MD5
5af10c5616e0487d236c8cbe2f23a7a4

SHA1
2049e1a82a0af13a8ed2cf9e4eb51f1dfd377480

SHA256
f249930089c374eab59078cf16b8652d443cf2a47485d737ae5a9fca2957d6b9

SHA512
8e2db2769d8c9d4af435986bc58f66f570c4d85bf7c8a2b9369f546cf45c0848a07986582e8e7f76a9aed569da2774e5b19706ec77bfd41bb6b4af86abcfcefe

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt

Filesize
10KB

MD5
407130a212cfac68fa4873b0381b2cb1

SHA1
c0c9b84cc79619d27536e9f50f25d81237b234d3

SHA256
f813eac0b284edce156dd1e6b7ea75b027f4342e04d8b8db1131894a227a4562

SHA512
e80afdf726ccc5d495f62a9b289ee31703f151ea01eba32ad7d2da306c2c07de2f9049dc6592c3c962b7cc2cbe352b8b7a19e9dbcf7b3c6b61dcc4026b70c151

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt

Filesize
10KB

MD5
e85ae412871344211d00326d3df2534d

SHA1
4a770eee2ef9f302b8190c8bbe3988a5d7c90e5e

SHA256
3ea103ffd2ff97e211c7ade3a79a882b494fe416bc56bd05f42f2e82158a7a03

SHA512
09eabfa3997f201f8402dc803319ee0ddc4007ef268ad44309fe78f9e2710d1a10930f2e89f2c0b201d1094c53f5cb7783e492503eb4737b2e3fdc1f39b69ef6

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt

Filesize
11KB

MD5
8c3f9ad9c824dcf74a09c9d406db22e7

SHA1
0c683bb56a13c3fbca664f1e4c6c98d0f7aec8bc

SHA256
b8b7db8c139b19d414cef35ae96d854d5a8364c32b0c3fdc4cac331b5af44c16

SHA512
da33d4098679a14d2f434221ef968951407727126b12404c8b6c3e2ad6fa346d9d515dea940f9109d5d196e648583124f31a1d27cf518ab19e3dcad673c027cf

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt

Filesize
5KB

MD5
28e69dd6e397fa98c07088e4cdbef1f4

SHA1
56e4a46b5c7360f609683562e617c75c28cd447c

SHA256
57ae544f3f9e8bf5d96ce1f9cfe5648eb6c1e2f5604da6eb0c80ae24bc1a40d7

SHA512
6bde04f3bbd42e73ea3e0a93e8ef69149f25dae491051d1655a85718af4d51f5247c610d87c20227f94beeeba038d54f7b213b0443382d080e87722485941aae

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt

Filesize
11KB

MD5
e50c04d913dc92251aa6781c02e0bd45

SHA1
57e68c80b23a9b1bd689ccd81cbcd91e0cae6aac

SHA256
9a9e4ddacc494eaaa386f1220837020f332a49e7fff7f0bf8c38c847390dab18

SHA512
c428caf314f79d533246cee4015411102ed836d0173f67f3b2f4c61c3f3f81be7fb2fff7d3e863e999617ba05fd6f7fef4b67cff8557e1d0c86035ed29daa2ce

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt

Filesize
7KB

MD5
58ff044fe195453f797dd1ac6903abf9

SHA1
4b8dae21dd14ac6daa1decf804336a1aae169aa9

SHA256
d9bb6bfc127938c47b43290241378887085314ad1326095934a362cd9836b560

SHA512
861300fe39ff0daca00b4cb56c4075afba2bb3a1654bcf35713251237630206f06bc63d7f339ecff040c9ea1f5b7094a11fe57c5848e91db9000f48d166ab1be

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt

Filesize
8KB

MD5
b8056cba4edeb98d298d16edbc34d678

SHA1
a4d39c3eda31f8ce72c62e1db91deeabc884ceb0

SHA256
9c15db408e32dc699f598aab30f539f91a212e5fbaee2095022e24b3f1f09ecd

SHA512
5c3fb76a5502c7c0312a32cff38f99c303225c31c3e5c6041765bc2beb0e9d5ac9cb4f543b80eca969d54723a52122601b2074afa8991ad64b92cfda91104dc6

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt

Filesize
4KB

MD5
056327042b9cfd5fcb5f788f22112d62

SHA1
fae6324417dc88e9a9bb0fbac9b4d4ce61c1980e

SHA256
533f9ff016e7bb36216665cca1065139a35d8da71651678814415ff457a9be7d

SHA512
fe853c2042251b3987c169f8241e0b3b0f1c3ae039dc7786b07e0db07e8a6b0f89e1d478f27d3c8dfd69473e6c6118ce13a39d7de84a22a3c2a660652b852660

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt

Filesize
8KB

MD5
c16e6946f912b49963bfa7e44be2f7a0

SHA1
496922ad3e59737ac64289ee685f2fadaa942755

SHA256
90efca5f6b8e37b963f7e42f700938440171942e0de0ab8baeb08912c0952957

SHA512
55feea50104ed2249e6f5018b6883f89acbcc0396e80349653356f40329c4a420584b29734cd1ca8930e9a383da427ec979815cc3da3f6f59ad8948b2262e874

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt

Filesize
7KB

MD5
1088565a362ebad250975f46f8a94328

SHA1
406593ac2e74b8911dda720952b7aff6c4b5c145

SHA256
c6a6cc400ee7420bfb680d71b43a9be1fbc75d7b98ae2b6ffe98229d5eefadca

SHA512
500093986ef49c23829d99251f0adcd20a6d348a91c74362e95e6d8e73b83f7ad665cb49da3e47da1ec671842abcc2d824850d243ee8d39c41e3568f9c2c89c4

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt

Filesize
19KB

MD5
a10d62cb5875cc96d53e4bc02724f366

SHA1
bb8d2f73109084a9a11246733e5da148d964d6ea

SHA256
2e488ef05895b93aca2b5f72ea08da887722215d1b4cb85b12942ea32641da2b

SHA512
b01fcfa48883431ba98522c74a8ae9511bd6f122613e80a0439a049b8f509d689b89a59f280335532af284a351c52f44313a4961ea5acbfaf7ea2617af75e797

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt

Filesize
20KB

MD5
2be2f9c77556ca413b590b8477df5499

SHA1
dd5ce617642c977470aa20c6dc6815728c779245

SHA256
5a85cc532f802da683374c3f4c98e3f37425cf304d6772ba554d2c49bac7be0b

SHA512
3ba82549752e6bfe6c1f1706b205747d70f2f3106c49ea08d35e82047166c3d5b26457d6bf00fbbd0e9cac4ae8ec38123f533de3f68ed466f219c551b5417c40

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt

Filesize
10KB

MD5
b681f52bc54b1b340a3184cde7ff59c2

SHA1
ba8d38155c0c81416233a360f7387eaf48c57db2

SHA256
f6d67ce2eae4c125bbf54c04ac783005bddc07007398cabd3b9603020af67bfd

SHA512
82fdb75b2f2a06e3cbbeaf1dfe84b196908286b9518194485dbbb168777181fa86a7e37136756544acc98165860e8ca61b83545f6cd1f13ee91bfa995a5df0d2

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt

Filesize
4KB

MD5
e3267c5ed8158da2b7e2679107ce1394

SHA1
6550cde7359a1b3450d8c0937affbf0252fa4b82

SHA256
c88bc7ea0c20769847a0403e188e273a0897d1c77dd72cc4b45471fc67e0d5e1

SHA512
63c185613c5855379dd4cac3d2cf264d6bb2a0e9b483b22eab93b7e8b9abda88bee2f80fcd24f0e9be0972a04f6c725cb20cae678e3e4f61251721b5bdb1cdcd

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt

Filesize
5KB

MD5
3b1958da0544a6c318d18ef5779e81f5

SHA1
67e991a6525da165145c4584c3d9b398583d7e68

SHA256
f349529ea4584eba51cd519b8a1d535d2daec762cd7369673b237fa03a526cc7

SHA512
e9b5e76fc908bc193738781fdbebd894ae310f6693f7b52d4369bc4f979a8ec9e2201e5a2056fbfc380fdad3143f3e5a3bc00d7ccb00cec078bc0e8caf318861

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt

Filesize
12KB

MD5
04cfc22f9293329c5ea7ec5c4a14d3bc

SHA1
57aa51dec6bed50703054060f46918aa26ae0e4a

SHA256
e016e8872f2de7cbc1f4fc786c747cc26b2e250e6c1b8f1c46040b72c523d90f

SHA512
5099e2a8b6be04e2124280711af1bf5807dca5df93dd33cca416d56337adad19903aacef3872f550d16a82f8f1471ec5d821d6e4e096e817a8c4d8340291d402

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt

Filesize
9KB

MD5
e888911310c0b6d7a1932de36ad27250

SHA1
928d9fbdb0c0c83042cac9059ffdde48ea4e9f71

SHA256
4cb5f08449b5e22ed15f8a8cc038d021cdbcf56548587023d1ab31ab6cfc232d

SHA512
56308e46914fd3b0ef62b33331f815fe95ca4a3cf122934dd0c506a041898d94a9ed6f3e1baef386efb9aa949cd47002fa859b4843f2e32c186ecdb6055ff85f

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt

Filesize
5KB

MD5
780514af9e967d8aa65005365efa7d78

SHA1
9e060f149b110d0a0675b75d4a7b960563acca05

SHA256
db540e1a6b8ffff2497f9c1a63f85cb5f345f8cba767f05377c0365abaf7b7d4

SHA512
f85feeff1e89a371eb1143d695c76fbf84afee3699221e6e6ce7703a91ea80ac01af27d34635fa2b61b1d6d979cb91bb98affbdb1cdfae6cd04251a095eeec84

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt

Filesize
13KB

MD5
c9ad9d02c661644f79820e779a6d3f0f

SHA1
92bd000af1ea18b2fe8941ca4df15858b4b53106

SHA256
e542c19640d39f3c56bf11a9eaadb554d7e74d8ec525d41a321e97c5ae5191c5

SHA512
40d178a217dd51a188e5c2ac5eb59db62db95dd0a7063e39b1ecfad0943bb54a118767890d3aa7a753d7316aa2f0494cef8bd81512d611ac2856256c524a5d0f

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt

Filesize
9KB

MD5
f8821c75507199f4ef041eeba8b82281

SHA1
96759a3b826bb5dbc18730378d0f8ba08c1df7e1

SHA256
b4b96fdaa023a3988d514c1cb1e2914817cd538d3bb7f062778360338b73ba67

SHA512
173d6f0437a4e315f4f890f67ef93936e53205f950a9b718b8b232f6faf0ed7e33e6c72531e0c2613611f4b02f5fd1ed7cde8cbd05f2256a68fe577dae4d3a90

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt

Filesize
8KB

MD5
23502d5cdd3671b634832d5f722cf5ea

SHA1
443fb98df15b8bfd081802938e180a87ee24104d

SHA256
fa12ca0be49f4921d06268fad673838c3a4644a70dc374a931997178f588e8f4

SHA512
e1fc00a7ad4a817b32370f2c03ea10473070b9d2febc29bb87d95ff2670e8e47ff27b2c2b6d63396306dc0185e127a49f602e969166cb27073feb735cfa47af8

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt

Filesize
9KB

MD5
f0cbdaa70d567ee71c685250958ec194

SHA1
2db013e6608739aa45453d0f69ba953fcc78b14d

SHA256
6b21924caea51b395efa0b8fa5d7e2492ce6a6b86dcc08565a5a4dee5c182167

SHA512
3ae68cc6be78d6bca7304516b25733a516aaf2121fb8e62ebb9b6fd5194d261117f7ab0c142dbfb2efe2016e189e7ebb1f5be4a82253f087a34a59cfc41ef7b9

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt

Filesize
9KB

MD5
f868c8fe0f1cbded1aec5cd29754b289

SHA1
5e0113e3d5bfb938441cae077034e7735b18c324

SHA256
3c76d190ea88cc339392fdb46e005e72e16658cf07fa83487e1a77250e027f41

SHA512
6c83c388460a3dfcdeea369523678867511b8fa360caaa72dc6e042f4a281f4764f137880e5369e06e60c3b3f304b3bb8df7e6c0edc3992972e646729bb240f5

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt

Filesize
9KB

MD5
9a2fc6431192e6fc18871da5d4adc467

SHA1
eea02faf56e746dfadf67c5fe4e12a79ea2fb089

SHA256
4fd993dbae9606c062dc3511292274631335956a016b74b3061bab55f7d9c736

SHA512
a4945cd1522fd2a57960959c4937c55920520be615f3cb84cbe74842479d426aff28f3e041fa61a338b121ca3be64efc4c128ca94a48b4d994eea79a42aab7f9

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt

Filesize
15KB

MD5
447e681a030c82c3832dba0b51cc790d

SHA1
401bf38c2122ae2493470820c92d069f3f6c7606

SHA256
3e76bc88db5cb108cf8750b01bdabbb3772dbf2bf14592c6ab18b7339817d6ee

SHA512
d17ef32a1de17ec1c9d6cae6199e6623db700b18e43b3b85ef403a60ec11b9efc0ac0bb188b03d13f7895dfcf4ed37d1f40c1bfc4bee469742b712ed5de70722

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt

Filesize
18KB

MD5
fd1b984baea0e5a905f756e9fdc54e86

SHA1
4da8da9154115f6bf0962fd02db9d7e166285c8e

SHA256
02cc9032c117a7818865af3dcadbdd3c7b348be3507681cd0032dd9bd15b76fc

SHA512
1595742cccfff001c7be0a7809f2e700460ad4cbd684d5a0cc53c5ccf615046e2e94efd96ceeaca3d6fb20aaa5249d7677ab1f6faf8dab0a1b559a0c0951913e

Download Submit
C:\Program Files\7-Zip\Lang\si.txt

Filesize
18KB

MD5
5203e172ecb9f384bce04d243684551f

SHA1
5f6a09b52d729f3f6c95aba9d29bfd6c7cd0340b

SHA256
5405e5b04e670ff7a5b5242a3872803725053324ffdc31f71511ea6b2573f6e0

SHA512
ce6b058891375577eb726a15e5430bce4450a9c06d3f2d3361ffe5d39c0c47097b6d0e7cdc7b907a8e5f23fa8fa5a1866661a2aa3167d982fd5aeec33fa39077

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt

Filesize
9KB

MD5
3fdecae1ff188894295759380b0378da

SHA1
935a4797540ce26828569c50924baae230f2d41e

SHA256
b53fe26795b01f3347b614eaa499d28770d94eb5b51005c842386e97d8344cb6

SHA512
f5b87defb1837e98ea46e1e37e13180976c5910f13e18a178397c530e6f15c585cf55e54048206d1a343c298bfe136e0ccf259657b29d7a8c5a9ee2537288aed

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt

Filesize
8KB

MD5
722551a008a99008006af6ce4161537a

SHA1
294abea21d393bf624a4a97c1b4db63d3332c312

SHA256
6b53fb390da88bd79d76487ff30466ae972976d2eed030ade6d9b93991b99cbc

SHA512
4bde588e3add4b20b3dd89953136a655e0521cf3ec97e72a7ff337bf64e41f3da75f60e4e56c5b833b86d6c23fafaa92ebb0effe1d063d499ef3992c60bac8f0

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt

Filesize
5KB

MD5
69720a6d09230d9747bb2aa3c0ef650d

SHA1
4750e61ec19ba905d6f2bc5828510fd08d915af8

SHA256
b6ee3c8a14230aa7d1a17c5493e0a410c5c5c638ba7a9d81681ffed4a8de6884

SHA512
92230fee3e5bc4b57013e359e43bf5f921dcfd9cad4522e09b11ef8bf2f21f96555fc3af72618a06d953f8d68050629358a8a7312a649489d6ca82780b793c88

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt

Filesize
11KB

MD5
d95e6ff9dae7fa22083d9ed73588fe1a

SHA1
f061e9e1afe02b7b92d626432cd9da55bd8bc2dd

SHA256
817d7a33f2adb19f47f45f78c314f6ae6df4ca4da133c1f7a82703e0cdee7e20

SHA512
210bfdc206c2173bd680b6f319afda3228ac44caf611c3846ef9ae0ad11701306ba923ccc9715086ff3ca5222f80713bf9fd6abf61141232834dd95692edc7c6

Download Submit
C:\Program Files\7-Zip\Lang\sr-spl.txt

Filesize
6KB

MD5
9e08d57d48b4d8cb16f98736c5c0511b

SHA1
85a597b74bcb1cbf918d6366705f0b0c0727de31

SHA256
d8c5223fe423129145c5b55a756e499d4680b1df0a7115d72736f09e51c89c1f

SHA512
13e431e00f5ec0373de201897c68a55c91962bd3df6cd693448d3d5d6ebb478b51a1834ecd37b456761dce94dbc4e5214fd421fa7bad3b5b8a51051d0d8d6964

Download Submit
C:\Program Files\7-Zip\Lang\sv.txt

Filesize
8KB

MD5
9a27f7e51e2143f4258aac9975f78f60

SHA1
49dffbd91fe27a81da38becde87de6b2df28962f

SHA256
233596e0d29dad356cd31c302eb1eb3a263736f166f5a7628a753bd808668ebb

SHA512
83c6464e05c776910552591d6d4b8dcb5cd0cc8c627519aefb7b61672f4478e42fdb8e023b5bfd29c313a22deeee75fcf66bf638f8d48156e98694f110b7d324

Download Submit
C:\Program Files\7-Zip\Lang\sw.txt

Filesize
7KB

MD5
baac3ff9fc4b6a656ac7c51d44117bd9

SHA1
feacd226efb71ee149424f39ab47ebf6f64cab04

SHA256
9fed3c0b4e67673bc1d8bbd67d1f6651fade030f98d12173c3564f2c492a67f8

SHA512
44413a73cd0de02f245cb5d8b35bb457ae136c1c2bbb76934f120f6d0b14fce928b4763475730f018c6e4b4ad4881a32cf1c99879c197cc4e70b8a992b3bfca4

Download Submit
C:\Program Files\7-Zip\Lang\ta.txt

Filesize
11KB

MD5
dd0ae446ad4c5d6f20db6ece80f21606

SHA1
cddb5dc08da094ff69e48c1af7e329f6b83fb6a6

SHA256
ae1a795105574bf2674a5de98a4f06cadd9c79debde9fc288f64b3d607fa329d

SHA512
543777575d32b9e1a67afa2380b7953b79f3031ad6421314ba1dd957ec356fc0446903e09ca70a4e61f1264fc87846c968574d3adf90f1563bae3ccca875636f

Download Submit
C:\Program Files\7-Zip\Lang\tg.txt

Filesize
14KB

MD5
ea08a1d73a4a150d7ec590b094d4e0d5

SHA1
e4f3172cf52db8da27f7d95cfba2eacfab12d533

SHA256
e029f34ddea8b1358e1f519526ef643d79be37cfce55bb5ea21b4bd0d026f9d3

SHA512
3661ec554c82f3608099e08808e5151b8d7bcca385cf09d0fd4181073a52e1e835485df0684f5091d0f5ef487a07298286db463c3971e3986a6ad9b0bf7784c2

Download Submit
C:\Program Files\7-Zip\Lang\th.txt

Filesize
15KB

MD5
6be5ba977c60f103b54c4289399ce43e

SHA1
48dff625438573a366d56ecef43bc43a10e124a8

SHA256
a1967002746961cdc4f3ad4f5f081bba6db231660cdfd5f2ab4a572eb11dd67c

SHA512
da61aa3c5389b5096f1c899ad17ebc20125b18d959f8c74aae10665f65de4a3c2069afe47380c093926180c952336fcbeff71329809d7fa59ab490849b647dbb

Download Submit
C:\Program Files\7-Zip\Lang\tk.txt

Filesize
8KB

MD5
1f610df86538a3ed788d6a8024c1982e

SHA1
3180f829602b83148c73a47ef4daf841bb379a14

SHA256
a0f485755cbc6356cfa4bef5cb6134653dc6743f4bfca89ced92d43ec31c5649

SHA512
c184e3898944b2c0a12806e0b0592fd19be05a75e7f3b2f9a69b8d39fa847e90aebe93e1e96588aaa38dcdbb9ff89c1667bca1b5a5fdfdb7f77e37a574981309

Download Submit
C:\Program Files\7-Zip\Lang\tr.txt

Filesize
9KB

MD5
cd44ef9f1c6526a18d9956517e510c16

SHA1
dd65dad1b27f26b538cb3c8fc11895a7c6a81f20

SHA256
d8ddeec7a1d5f98be9fe727d47f8bdf733e21693e988dcfe48089ac3344dcf30

SHA512
51676ae9c163686dad3748e2dec7898ed218673d15af741404c4eb30e8e8c23cc8c5bb7e33e1b7cc40de56c1acfe2639711f47bfac9ef9fae5703eaa889f924d

Download Submit
C:\Program Files\7-Zip\Lang\tt.txt

Filesize
13KB

MD5
730c16345e2a2366c2221d5f22980666

SHA1
41e92f0b3aee2436183e1263aad85787ecbabf34

SHA256
813b5264f3f2d2b632b346e800e738e04dc098c7b3a1a2af64bcf3a6acbca037

SHA512
339a9b6e5788b6b2d627c16b6dca5a942133b2f113adc21225c693951d87ee5c476a684565c2a38510a23c42e1dfa0689a62450cb2d741d4ac43a53b9b691606

Download Submit
C:\Program Files\7-Zip\Lang\ug.txt

Filesize
10KB

MD5
47c628c679ff488ddf4e14c457d2fca0

SHA1
e8da632e677a92224b5095271087a68c60504b9c

SHA256
7fd494130f9b96dfca492d495ef3fd7b4eaacf59f075172898ece5aebd1f6fce

SHA512
a4a22d6fe3c01a3e3d93c6d555b840eeecd72f396f0bcb5afd871292bca5b86f2ca76e3cf44fa71dd6c1b08d6672c50d16d0fba679a4af4aa677993a9900e497

Download Submit
C:\Program Files\7-Zip\Lang\uk.txt

Filesize
16KB

MD5
a2aee165e60fa2c7b48fba9cdfcc8766

SHA1
8ede3b75e841c8e1820e8b40a66ad6cc14d11e3c

SHA256
ca1557c69453b1354279682cf1d3e9d65a0fde56189939ec3dc359ad18be5fe7

SHA512
10e74e0dcb6ef09b4b9b7ff9c47b915ad6553ed82d7da1970aa7fe95cefcffb5a8e6dd9fbf9d109b65fe03e9027559011a18144f7f936fe504613e092543cd5d

Download Submit
C:\Program Files\7-Zip\Lang\uz-cyrl.txt

Filesize
14KB

MD5
0e053b461b1840743441f2b74d73e3ee

SHA1
c3f211f45c0702531c0bb09c13eafe32634ee9cc

SHA256
dd414d39f8da2fbd5caa0c7a7a9155c5f802b4d45f2e8828a79c7b4b63bd1179

SHA512
8e2144242e9000290dad52008b3db9878b35c1c3182b74273965a5f7b4dc4afe146d2c97a5318525ade263753f08413a6fa45b7ec38f9c56d5042787d9e6c78e

Download Submit
C:\Program Files\7-Zip\Lang\uz.txt

Filesize
8KB

MD5
4479712709b19297483d020d11164745

SHA1
adbf9f8ef1c44e7f7d13ef5e0abe1f49c4ed3f1b

SHA256
d62f8d3e7aa1f2636a1ad1b2aede0da9fd725941a5f81d24a9b0b7599caf0f50

SHA512
a857b93e9991aee4cdd6730de538ab3bfd13620d0a99aea1f49859b0d479ef4f757c4d99846fc1754691802b5dafd044fc306bd31c0429dcf15eb5dc3c0b9036

Download Submit
C:\Program Files\7-Zip\Lang\va.txt

Filesize
9KB

MD5
1651078be7ce617922904ca7941fae20

SHA1
1fe33f74aaa6af59b5055b968ef6424107544538

SHA256
c0d985dea02778276ba3d3df96b50b33f7ba0c1ec7c62761f0dcd67a05b62270

SHA512
e1721ee191e1ba24212e85c013497c66d35db0e48df464d2e86762b4a0855ac04ffec59af8c259f91dff0924d977ffeb1fba92a7c9a951d5f8fddfd0b02bb67e

Download Submit
C:\Program Files\7-Zip\Lang\vi.txt

Filesize
7KB

MD5
a0612fa9eb8196659d15c67ac965a5e6

SHA1
ae733bbaef962f3a10c5855ed30b6d084c8c5d5f

SHA256
c73634402c3effdb2750ab5cf6f1083abd8771529bff6f7e513d646e0fcdae23

SHA512
74991149573fbc7b5d9bef36b0f8cb00951bebe959f2d9058c227f3e75a874e22c8aa6219bbd643e483e0d969674a9ca9004e33f116bc923a30c872fc3f7909c

Download Submit
C:\Program Files\7-Zip\Lang\yo.txt

Filesize
10KB

MD5
5d90f9c7771022e43c15a4393a0670ce

SHA1
689269a4b3aed23cdf59ed395732c592b515ac83

SHA256
de2497946932d806f822082c3cf9f2f26a18752d9973f9d09e0889a94ce4c28a

SHA512
7a8bd040989cf66dd0f15be68dfcf2799c34c491fdf900315ab82619938c79be9f18c6a5b1a4ac7df6bba951b3b309ddaf4f5ed628a69b8b893406f68fbc9510

Download Submit
C:\Program Files\7-Zip\Lang\zh-cn.txt

Filesize
8KB

MD5
d13839af103477df8cfd0bc2eb876eb0

SHA1
93af39ebeb9677003db67b386588409329104f4e

SHA256
d04e5bd3bf1e3f3754c3603889aa1b659d1dac518c5c6b5c1c49ecf16dca1c01

SHA512
dd79b5a8790e906e8bbe3fe69476126ab76ed472b4374e5fb7f4b272365bc305492832a1e3b95d22fc7d3c9edd9b013c7bc8871c6bc85a717acf3b361da1900f

Download Submit
C:\Program Files\7-Zip\Lang\zh-tw.txt

Filesize
8KB

MD5
e6c38c199079be58ee81e8da55e783ac

SHA1
1ad09b0146f317786afb0a09c7907e6ccb5c207e

SHA256
76a17b0a97925e5d6deb1ebe8ae14f83bd49957c492c3733a0ea178e28b0d74b

SHA512
014d3fb64b22da94d5ac7626b3e4bf9321fb05647bdb1be3eef79add3efb06ef6b0fc1590031d4e781489afc96ba4b7e4a86590bce98c901812e890a4680ed02

Download Submit
C:\Program Files\7-Zip\License.txt

Filesize
5KB

MD5
761b393dac39374a072e58aa6a4872fc

SHA1
fa049f28e907ab6a0489d1fec1746df3a26d22e2

SHA256
3a9a7bca133a8af4560f48dfa351f941e110d80a2c2466e537ec6680b9fc2dda

SHA512
93c5a05469d4469c713370ac8d711caf57bf87b91b4f77aaa6f950552180548624890ec0e910c0f0e2fa1e05417edf37e31e9c128815a3811110bca90885860e

Download Submit
C:\Program Files\7-Zip\Uninstall.exe

Filesize
14KB

MD5
e03115ee7530777231a0051667ab23d3

SHA1
5ded32077cda52b5527f75017552a598b0523db7

SHA256
cccf6f489961bb78c5c4baecd964442b14593799403e2b6e4d50082c3e64803a

SHA512
053f81c647b55df05bef067f26be1d25b44cdd1d5a59c4341904f0b9173a1ad6cc3209035ed4782626b150f090f52276c7d99e77eaf108b2fed52f2179e959ee

Download Submit
C:\Program Files\7-Zip\descript.ion

Filesize
366B

MD5
eb7e322bdc62614e49ded60e0fb23845

SHA1
1bb477811ecdb01457790c46217b61cb53153b75

SHA256
1da513f5a4e8018b9ae143884eb3eaf72454b606fd51f2401b7cfd9be4dbbf4f

SHA512
8160b581a3f237d87e664d93310f5e85a42df793b3e22390093f9fb9a0a39950be6df2a713b55259fce5d5411d0499886a8039288d9481b4095fabadddbebb60

Download Submit
C:\Program Files\7-Zip\readme.txt

Filesize
1KB

MD5
800e525e791ce8ca84a9200ddcabd6b2

SHA1
69800f0c14111fd0ca7f6a41268ad5f4d8ed24f4

SHA256
7687c86d1096d2587a8ee0a9e585725abd1ab7a8af98fdf1cc8234ae94624f33

SHA512
095a707bbe3af79cda2e77799817ae979f72233c92be0ca2f1b089aa285de6498afcd44f84c328b094cbfc733f16c664135bfcaa9a93e5af73bb90afabcb71f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma

Filesize
1024KB

MD5
b0366599d64b0fc1adb2a712dcd02ee1

SHA1
b7a1c09ccd2846664cab5f76bd80b8e9f107acb0

SHA256
ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189

SHA512
d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
fbea9f3fbf579c979bc1bd5b5c2c41c5

SHA1
3ab2294a45de7633ee30cf90a8cba2b0b8be50bf

SHA256
a8a21249c0bb85754151fd3df615c3deff05c69f40e4db70a5254473bebc45b7

SHA512
6de1b7b5d8774147e5089adbb7a1fad9c60f58048d3d96a2af8a3790b2363921e60f89adaa889b02a77e6f82916bd33ec03d13ad68c5bd2eb0b9ee9fc37d6d91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3f3caacf-778d-48a1-afd0-133080aa909d.tmp

Filesize
17KB

MD5
3de0b11b560fb83775995999e20342a2

SHA1
247515aaa403c40298ffe82a1b6949ba79dab0a5

SHA256
965e8590a109a7280ccca3bc8a3adf09abcb470a0c36b74cbee75de10ba6833b

SHA512
788cbf87868abe19d5f42a6342d5e79adb7dc65b1dda9a3582f3e6820688f815fa5260bd78c5e3a4628e280ac44b3da75c003fb9f82193d7fefdcb5c1d18c8ea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
59150196a79a684c484e276c9ec01a84

SHA1
775ac5ef52cc9eb65ab7f605bee3e8cb0c997809

SHA256
efefd9dd56ad17d5664fd7e841d983d7a0cd414b430a0b97e42c8a34022e5d10

SHA512
45a51ba61520a223af276a5a156c79462f28cc581af02c3afe546e810ac068dfdadb77987aad613c0ba1d1bc73dd5749d6554f88568086208a54724f73aa2be0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
5004cc3a20f67008b889405454fd04aa

SHA1
29d1fec4ab8b4c377221e13b2cba68101153ebfb

SHA256
c06b23021108db4a544e9879e0409ecf407e9fd204e201fbca8fde4405c963d3

SHA512
78c9b212d2e7135e911e2b645422fc2f7bce750b126d3010cb13ef72c76fc6fdfa754fc6a34b6f9e962baed9eae09e09224d774fa19479255925f6dbff794a4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
ad30991f3babdf3aa90a71739eb52157

SHA1
7f83981cdd7b78669af37e8614c776615d44bf35

SHA256
9b3ebe0fb1256d4a42ee306a0c19f18177a21dc09f4cebe24286c3cffc344fae

SHA512
272d8dccc7c281efc9f21179dc50d9c98cd276981be7552bb6af9c86df76257565c69585d60b1e8c5b2c0b8ec8a06103b15f31cac7b64d54d52f8429c13e9f19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
b8a0e7611863393991043238b0c25c07

SHA1
f5eb6acb3de842fe1e76feba570dd12fe93fbf17

SHA256
1c6e2c027e97f5d171946204ce8e13a7a4fe0b05b9cbceb55de871206c95d186

SHA512
c4c7f31aa15a799b44e65d89dae2ca69ca830577dab0b9f37e34ac3f5e9fdd7a3ab8bf76cf2828168c465382afed34626b62747c6a54084fa950b2f172c208a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
5f9655c27742690f9c64af220defbe4b

SHA1
82d50129ad355faf27f620e6c39a44b38a96bc48

SHA256
a5f12f992de57628d5b0af1cbdba79791af2a82735882f76dd8d69670c05dad8

SHA512
e131fbdb4354ce56d1c20851e90751f6752026695c34a61b7181fe28483ed08aefb1cea0b767bc40b53eaad1d7070f98bfc530ed18912e90ffe3905dd20f3fb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
35KB

MD5
33e4cb5131c8a5e99c0c13d83d58be44

SHA1
5a95e06624a9660c571fac9e37f27754dbf8f0f3

SHA256
543dfbb5d770dffaa7ccf226e19e1d1d3bde477ad2d5081f45aa214bfd256d6c

SHA512
0c2f4b9cf01608627f84f32ba09c2f91b00d7236032962137aaf83c6dc627f16704ace437ff4b9a3382ca6baa3da05ad11a9673fa354c7d4cf9994d7c30416f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
63KB

MD5
00a34503c5efdf7f4815c3bb9cc9cd68

SHA1
a85d51a8bfe01bc2c26bf0cbeae56c057788e452

SHA256
95ac4bfd07bbab1602f31faf2b3a3ae4064bf191917b229440a6cc722af24764

SHA512
c52764de41844701a47d0eec201649f20813a51a7b68feae77b47fe32bc90771c809682de3b12a94f37c2d41c8adca5a3707ad50618b402cc49b2f78d23c4259

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
38KB

MD5
f53236bc138719b68ccd1c7efb02a276

SHA1
26b7d3eea5d3b12d0b0e173ebf2af50a7d7e56d6

SHA256
787c14f8cc865430c03c96a345044b7c5b8dc8a032511a500d4a42228533acd8

SHA512
5485bc7ccce8ec75f60bca3be846086a4bd4466009c8e22da9cdd16bb1154529af2fb2667cd3a97485cc4f6635fb79ac0fdda4f3e1f39f25f6196f708a92d740

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
122KB

MD5
65477a88f59fffcbfb0836a4354b9f1e

SHA1
adfb98e6996fc69036fda17c6267bb6262f42f20

SHA256
103eec3e9e19b26d4e366c86f1b7b2d53ccf6c81a7e184dc63d32fe4459529cb

SHA512
b46b2c377e5f6d4c9eff0fe1d203efaa1c7a920d45f1d0ee5c76194d194e93c515f9fabdfba364afda4dc3d3fb97eebec43ba37e16bec014487a036327053d77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
538KB

MD5
123810d150f819ec4557e4014f676276

SHA1
0f370219e7118823c85f7279414ce166ef338b1d

SHA256
c1f5700414e125b7426fcfe1f2c07478c784b49139c4d3fee921b82ef0d65eca

SHA512
2812a5862da37d7e561ed9efe1b1954ef1b8f21980b4fe53027ec97dd2c4978e3ac9882bf7ac4ad47f92913db809c1cba2c4d97c8fd285ef7f608a631cac15aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

Filesize
2.1MB

MD5
f07560124b929743aa9b07064f032c06

SHA1
bd37dc1e267d3227462899af4c60ab5eb575aa8a

SHA256
8fe7d71555794122f787091e6a462d11a1aa17f5e6c6e7328ca176b49eb19056

SHA512
8f40f03c72f924c6d173a71b9f3bd8802503d4f74a221b4f80ca3c252b075e545bf101be0abe1039b89f4117652d974974bc212e08aa9f286c0518e93b8e2e98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
40KB

MD5
b7ca84e6fcfd41919a92e38ea4fe994c

SHA1
e6713578c473feb8c95ff10a1b878b41adb3f3de

SHA256
9d350b110c930d5d0e74aba073052b6018903d18ff8d887e7a8d1c9dc0dd2fdc

SHA512
98c51da5dbf96cc2e93b5bd00663a4268f1046e59df583523b4953b3763cf609abcbf80ad3b9524d5d184fe6d2e0b83ce43c4e5253de5e7512017eb69add980f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
38KB

MD5
9436affc97843765a966b3568fa7e5ec

SHA1
7bfda74bb30589c75d718fbc997f18c6d5cc4a0b

SHA256
7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916

SHA512
473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
149KB

MD5
f7a6918de037d2a4b563b20a524846c5

SHA1
65cd59eaf248e479321178f70a5a08206a337966

SHA256
fa3a36694ed37400d36405a6216360a7eccc94a01229ed2ca5c47f4621a2896e

SHA512
953d5ef4554a49fb971546a2c7082f40344430bc62f8c351982c25f402fa8ccb6269d4c40d456fba08af0d04a2d089444e64595bd7e1d360596e4be766030c18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

Filesize
72KB

MD5
fbb5c013c329001e8eca105dad5453e4

SHA1
818796e6ba546861c004cadd32b18dab138fb1e5

SHA256
009013573b801be76124cf4bb84e9e86ac57f98d8edb677c1f3b6ba02fc3f283

SHA512
097e470ef5791d2ce95c3504eefc57f7d4e41a83443b4232ced084a3d6bd7a67ef60af1a5ee980a1aaf453f92f0344e8477cb96ac72f98a9ff852ee052f7bd29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
445KB

MD5
9d22de62fa26bd09222740e50ec5c2cf

SHA1
ba5fe487c42e090d5a7fb2afbced7e4d462ee3d7

SHA256
f98db3456fc0d479c2320cd13c7142238a9c4b3256d1acc3fde6a748a29deb82

SHA512
cb51fbd91681551c630c8c9924f6b0c064cc2fb6663f023bcf780d9297430d17c4eef5d84ad6d76af20736eb524503b813fde16c638bc9f12d381b1b40b13ab7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

Filesize
77KB

MD5
48d75ab792dc45ed4b436ed73691b7ee

SHA1
705053d187c94c87b5d06583ff93e60a4787a94e

SHA256
d12f4019bdd8b440a1b2805de4207a626f8148f8b9b11fba71194c034b61a77c

SHA512
81fe193a26f8128e4152e9d7156bf445bb67428969ebef3c678765646cababd7bed3bfb5fec246a2bf8f3f9202e2ab3eabf447e70d05e0f217d571d40bee37a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

Filesize
37KB

MD5
3e6eabf02cb4afb246773e6447ccc568

SHA1
03c3f0eca4917eb483cd6a5d0f358867b0c13b58

SHA256
c274a839a70ddd9092fd16c2e01b74c68c6bdbbace2afb0b4fb0f70bbcba6cff

SHA512
37f355a73020a534b2b4b37c2761e9d2d5a0e89ced7c9107f7ed8317cf33a7e578517b588752adca96e1ddaea1c998e55f0c953acd52c17b917501d2c2c2da80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020

Filesize
442KB

MD5
036b302f73d6226d565f17430184cbe3

SHA1
d946c0dbcf63d8a7d9a60b288a92822c2af5adeb

SHA256
586e1508f02854d3204ae77d021d98bcdbdf54746af3c0a4c3e95d20bc2b7edc

SHA512
27a185df75c7cab2eb16f318d39053d11891dca4d1513546fabde4f52d2493d227709163b7bc34609000c3484505b19f61a4f29999189b4458966f603e339084

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ebf6ced64358eb6c326ba253c45a17da

SHA1
fcbe2ff833fc1dc93a6e16889cc3dbcf49715056

SHA256
1ec4c71b0aa6310cb0620232fe8a64b70834498e59abab0df2296fcb0d27fc16

SHA512
bb93898e796790af6335a848fa894f2831bf0927357d05c71818ba2a7bbd828e3a8ba7eccf86460dc894bdd75c5127da18f1f2fbcc87bde497890f3fe8330700

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
e3bc971fd1ad04aa63bea65580680434

SHA1
fa307f8d13e843c0da4fb245de368f23e39af87f

SHA256
b2e0805e19dc3ab0fc7db0a3fde279ab813db4c70026711367428a30a6a678ac

SHA512
27a467eed0edc31e04b0616b1614236e953c064d4eda94affa5e957a4b4576310114b0334739c85f1bb579dd31ddda3f5067b24bcf8dce6e53fa42b2a221ef79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
a995f1c759cdabc3e012ed0fa7f0d59c

SHA1
7c90a57509c76a78b0a8a3c9eb004d9d826fa10d

SHA256
5d6bf7088ce207232effc20395c6cd1b544b979bd187efa7e4611769f0835235

SHA512
b7b954a26f982cee07a88eb4b9774a65e721249f469dd66b78f1cff9f9de3dcdadef5ff678e14e2202deeebfeda4eff43185b3a8304617684d5cca223767d4d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
8e35cc16d91fb7354f5edd1c5450f6a4

SHA1
bd3eae662c36198cd489c6d09f60d8a1ea887039

SHA256
1811599999a5ba848ba66f10f9b7a021dae4551d1cff5521bd09765755f34aa6

SHA512
e8bd5dd3318c5a84d58ce0852fcd2d1eb3f7584b1e83a9acb50d056b871337486107c7b4751beaeb4ab84fc8d989cbc6036d3c5eb4fa339fec2cf4fdb4c1eb3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
5fa5b88fb1fba7c26c38030f868b821b

SHA1
3d4a551c142cb0f93e5965a6328cd653b209c3fd

SHA256
db4dc84bda8398c7af758936805f6255ca0cebe5aa87efe1d6e08976581e13e4

SHA512
819108022ea736cd5f9a58940c135dd17cc620e01e1234282072e3960e4073c64e45abd4ac44a74b4c8eb64140b6d28ffd59ef80fc51b8f7f859c8b1c44cd2ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
533c173265d6f2b4f4b8a48803eb7157

SHA1
3bba9addb95b85faf5bc5491e2f284d4dfe523b9

SHA256
68dac78efa9037e3536de22bcc4850fb8137ee315d1b479c7feebd7072410e09

SHA512
cbe17aa9637f69886e8238b6cd60cd749cb1981c506a412a08e66aaa716e79600a3285e2c5202a9d6f8d38cc494452180bf7122c92654c0c2bfe1192bf131eea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1

Filesize
264KB

MD5
64613a932be554196b8030a9bd37dca8

SHA1
e20ad92aa7c3697a278a1fec11831035360005bb

SHA256
51b8ecb1a6c8ce5bd6fd7a96118c8516be257f4d96086122d3e16af3983282dd

SHA512
560f9e0e2c3a6f215316da467cbc9608a58e9b13bc0004fa1b511e3ed84a30fd3b305c2c938a688782ec21f942413d7194618f2bebdfa940de0b0f93e1939e89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0

Filesize
44KB

MD5
9b77ff1498ffbb0d7aa1de1e44bf5f67

SHA1
409a5222b2b1d4cafbb04aa8c0eff7aad0a90002

SHA256
aef2f601892c25c798c2c08b90e267c3b3e76a6a37e5148d390f4d367da3afce

SHA512
985b3e4cc2ac3559f045b0e170a3b5127a84c029e80749bc1213f68048d9d4020e396580ca831f60af8f8c70071a10aa5655a7e9105f6f04d7c19009060be1f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
d3f411bffd25f03c22167a34c50bf404

SHA1
10978b5b130bc0fffb269d7f9259eb11ad4292d6

SHA256
72918e7ee73bf70b2647786af4ba908e334887386cbd1db86ab84af6189bdac2

SHA512
ddc7bdac7b2ea6f53d682f5a589ba0286254754daf5b4cec6b17ea27aa1c8a3361045a0a1df3e525917a3a996bbbb838c67b9c5c5bb11dd854935768c569e6a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
384KB

MD5
f947b3a1a1f34ffc9cd2709a6ac68b47

SHA1
5d75b08bdf4675f90cd49cd27fe64ab88fb97aad

SHA256
75203b9776a4a8aa6eb2c60c6b6fed36562fb75033b801082e442fab5aa90352

SHA512
c93807c9ffc47f768dc6b9577febced82ab2b920a7767c4a58633dac6b335936fd7058d72868a4bdca3ffa2aeb7728421586e73f7df160625e5a422f04a544ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
13KB

MD5
6227a2693ef2563b5d891dae74b1f7d7

SHA1
333744fe121cf092944e9a1ca9b8f059a06405d5

SHA256
8962db6cd04ea62f7043e05289389b1f6ec6d2d00e4f660cd87dcbc7a0975aee

SHA512
9bac26dd944b1f5002ac2d0d8df86ffbd85335c523baa35e3c275cc1f23127cdc6ac38a9234bdf4201aed583fce15d1bf3942144501d45c738a5be2e4660e156

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
16KB

MD5
250731e467f02fd81dad71c089d1ebd4

SHA1
e7178cbd4f04b3bbb9845f110e05931507dbde70

SHA256
48c18cfae31d71abb58f8b542d0b00f428cc81eefdd2b74d3ac03d0f44b0a676

SHA512
c1bc92edf02f589c1d724dd480bc6b0dfffedd8b71239bc61ebc4f0e73ec29da3fd0b4a97bfc95aab0d51a53bf123a23bc98cc6ad7cb8f87dcd5ba5db6903ff2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
12KB

MD5
c1fd3f49e2f7b9e65b48a574a5b03d0e

SHA1
8256f1d5f8e869a4164ec71a318eb2f7fcbd5666

SHA256
09c726753fee2bcf62a170accaa8c8f25b42556055b35913f1af3e3c2396288b

SHA512
6e7a808858378e73d579c29ecd93f4419e117ef47a1b48d129515fed1d65b021a4cd2fb8c68dd3b95fca91c61b006fcef356c564b18c2c3cbc919efcb12167ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
3cd62502d1712c1d663318d1f92e9860

SHA1
4f2392855d1d42b0a37bcf64f1c4b40fe0743d57

SHA256
e756ea60c4af8b972fb748b32cf8e2f767913f13b2e718c334e3b375319987d3

SHA512
6315d66b7942285684c8f088085a45ba361957599856572b5a0456c7112339de272062e55c837f5d261c37c6847a331540de616350daa75ce3dae1a1c29be524

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
4fc350e830a656380a8ec360d1e797f4

SHA1
dd57a1bcefe63c2af6f0ba27b1d32da79ecf9686

SHA256
b84a990c7d3431a012f906133c81239a45c589cd47a8b3e20fb0975c036bf7cf

SHA512
53076bf7f25e6697191b3edeff15f412a508ee7c00473394b32ff83b9192843432cc99858e87a0730ec470d1441d75309a104c3d85b3f6f8d5a0fdb3b3b9c039

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
e9c8124373a1fa6d3d1f8c27b1692917

SHA1
cb162aab8eaeb359471801ca5fc600420c7cfdc6

SHA256
f463e4b995e1b7bc77e6216e93a7160a65d337bc34fa683d177fafe2d7cde3e7

SHA512
fccb2c15203e7bef5b421046af17f1589d660e663dc9bbdcda5767ab493dbe0b5d61216b38a136430e7da496bf33e0325e7bc46c792d2db64d372d568390b9d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
09422e141cf1698c6683e8c7e411f0a7

SHA1
4ef381221a7f722e2eafa865cde938501a684af9

SHA256
0ddfdbaa5b9c001ed705ff1624926700b2ddd1cacec04b4c2121451e025e3866

SHA512
d4d1f4f1c23df039f489495acf1b765c1685fd7865b9570382069973115c69aaff6141b5efb35c2ce52d43a11f3c621f41405a4867ba13317fedec382a7b2c86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
e33de071c7114a1c93c71ae9c39a2640

SHA1
171d4c7ce66eb30ffcd8dbfc3fda272cf424aa13

SHA256
bd18d14fa5964c4e0091ef8b07c0b558d3238dfec1b2cc5acb4f53d3351bbcf5

SHA512
7e12bfa01a586cc3061d4b0dc9cec6731dea4ad08e2b62f0e0b206ec3cd0ce88a792b0cebad2cb3159d36ceb8c926804b17d961b394be6ccede0e7a8c49a5626

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
0ff20d9f4522dd26303afc28245f971e

SHA1
b26a884d87f9712c0093537d100b2b2572dcea61

SHA256
636248aa90d12b20ab863d6a531e6784cbc9046adad8f0e4475dd20ccbf492b2

SHA512
6789537fa1463b6f89aee27bfc4a355817787e418f5e9916c097f97864e7f7a5b056b94a4b339cd8e99901cfe6f79afca69b4bdd7799f05335d536ec01dafc5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
0686e36bdd0398d782a0c9bbd039a9d0

SHA1
242943e62181fdb6c7d824344430d23ffd71ed9f

SHA256
aaa0c3a88c528bb1b9a0f34ccc90b81d97222ea440ca20436d044e9735e12485

SHA512
de21e2f6d4b703b15148c8e5389aebfc2a4fc3432cab2351957c690e8c65f227c088d7ce69acfd4c04884f4acc6692d1ca236c2d411f18dac00ea4e0f0e4e662

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
012d11400aa72353b9e87e3ace0a95eb

SHA1
9633dfbe532d78008817498dbb6dc68a83ec63d0

SHA256
c278f72fec12189776dbc8f01e3b3f1fad02dc4afee320e740b2771fc1dd38f2

SHA512
46f68a3bb7f3374dede7904d3125cf5ac2f83273a8b91bb0482262cda284ef4c0f5c378a829e40d7f796bdef91145ce124904cb14f39cf5f1c4ea10c324e5d76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4a7af466ce873a505925510bd6072255

SHA1
fc4017f08218c70a41aa890fc8b9e56d01bc88e4

SHA256
0fd4e35488a074f4004fe88363c30ab534b1d549633a1b2a4592d65397c5b498

SHA512
2cc1e67aaad1b64a9e87c96419c3c3ac239403ae3a92f0f2dcd3f93fb5feaceabb69fab2371c43c6f694fd87d642be63ddf6b215ced4477221c73d1d6263bef2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
b52772b646f3fd88ce8632a43ab6532e

SHA1
d8fce18a237fee7239073762d76867b90c88204a

SHA256
3e260c987b0d1af60aa2010e860fb3d2c16c6a8010a764a523e040f0ac0337eb

SHA512
15d5ff1607d1275ea64c48d8d7919309023fb1f998648c66e9b26821391fa2195af3666314cf7307b59cc6e71b8c10ce8447400cb290a8586de79d46d94f4308

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
78b873e45ff045fdb26369e018d57812

SHA1
c86d4be223792a505e8f751d3c44f7d8cd04c499

SHA256
63dd471e27d604fa5940330ef72a4ef560dd6228f3795cd324ed10403f1cf59b

SHA512
0d00fbce3914ff49df2bd0667eb151cfaf0497f562339ebe33eb8c8597b7f77911afe83d605821c320ec9ebaef8c04fac18d9bc3441c6bf91525c9fbf75db400

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
f6571d1e2cddedb1042e9895019f1f33

SHA1
cef5a0574de33fafb12caae607b022e37f91e169

SHA256
cfa1018960a1fe273a408b73c66919620262fb6479e285b7f88324e80d2041f7

SHA512
bd3e201519aff6dfccd9cda7d82c8fd74b6770f7eb5a10631985ed812c258aefe739a39e70be21f69dd3ce1a570b01ce2ae638ffbee1873c21f98ea7138a8812

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
17KB

MD5
5a906008a1b15c44e45b1d717f41e5ca

SHA1
3fd9bf0bcd33f178496622a75f329b912a0c5a34

SHA256
6f380cdf22e52cb18f930c13801418315f3ffac642ee7a0911b2f526858206f4

SHA512
3a2ec2837a8daff8f39448a45317f6f3196eb7632297b2c083a05e9c40bdd4e4f055c6f95dbb8dc7eadfaedf75504e8c78da5991d0bf522be1b80a3fbf0f64ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
3d82580df37e6d7f10e5081d0e9f2711

SHA1
734c21dbd96d379a5d4c1aa9103774c250a1fd9a

SHA256
89db04d048d858be15413045017e1c5514714d59bcc2b45c26f86ae4bae4613d

SHA512
d0661f2ea2fcee9053f5b743c9bd938f14d5e104afc83467093be4c2cd85609b4f258d49166b0a51012501dab562dedf0eefd4b85f1f9f1efd1e15e398383ba0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
981f44774cc73cfdcd8342af575ef6d3

SHA1
f03338934ebdae54716ccd7d35600f0de5439341

SHA256
a4bd039db00f7f1e2291145421a1ed0a642e1ad8ee90df7ad44a5b9a2b3af4ca

SHA512
87d74fda080dbac469167955a4c2c6e0949bbc8c04f55f30bb0549f4540ba7b00d5575f2f135d9021afa24f4d0be9ee83b3751c18457c63fca72faf1f296ff66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
14KB

MD5
8c38a526804c3eeb6923d285b4bd7aa2

SHA1
94f53a7374432669d9061201c9777ecdc0dfde18

SHA256
1b2c4d1da86c71b4126c65542110d67acd0682bc812f6245f950af20d169fcc3

SHA512
47dc0057b6a4c18ed6c4c76ca87e9e61acdcd1320288dce5f5fcd143599c811ff0a4d50d8bae11a7848fd24440c14e99ba6efabd16dbf416973f9c6964c0c663

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
15KB

MD5
009627b3ab4008506fd329fc4fda4b30

SHA1
70e066a30d2428b52cdad221739ac49b3a1c6f95

SHA256
5a097a605240daa3d612f4a0107afb47fd5bc9337f6d9a3ffc69a5c792c4817f

SHA512
aaa0957df95731f6b0e3d50fdc49c4ff2ec1e130dcedb3f929983177317d523413e50e5df932bb29ee7ec8f01b79291baee887d6d6d1370b99ec731b68d22d90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
15KB

MD5
27f09e4089bfc273295e9b258b0be111

SHA1
dd676e3519cdb6cf831db370f0e307175593de17

SHA256
c3c4ab841a316776cd8bb9783ba548ffd521067bf6eb7ba08e75851de29f7fe1

SHA512
f0b3d23a289293cb41d9678a633805d7a630684b369afa4a6dca7e731cbe4e38db62a51dfba784e004effa7ed6527013ac6a0b817ffc7771dc97212bb1b5ea8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
15KB

MD5
75edba2457f8171660b1050c5d886566

SHA1
9f3da21e9643d5479f4c56453696954abe876710

SHA256
f73317aabce6cd725cfd4a608145f4a69bee2d3ef715369bc5e7f70818b8cbb2

SHA512
7a379444714c9aac0d0ee137412e8e71e09d6a40e4e21998ac339ce2fbf1fc072d01ebdbdb14eb05beea1f65ddee1106b8eb199c8e0037fc763b8b9f896d62fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
dd29384e6dc5e175e24a542d67306c28

SHA1
f2e36f829bfc02ef3a1390cce5a38a46b3eaa7f1

SHA256
5f344a531c305a2a846b21565051a2045cdddc3e2f9a95d46d18f64359721e14

SHA512
4a559ca0d45d3e6c495b03f75c0bc9c19df6f0c844450c33f6ae658b321bfbc68d07bd2de673a8a4c1a46b94cac3c73591987bc6d0813b779adbc30767bdebc5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
15KB

MD5
cbf4b02bd30dfabfb189d65de890b701

SHA1
5d6576093e4e88f5ebc17ca9c68397349322faa8

SHA256
3eb3f2a5ffc91a8059c6a92bd13ff25b4929ed0189fe94347e27fb3d0b3201c8

SHA512
3fb3ecddcc324757cc931f52c9b8c744ec448801deca4a056395e7f84531a222f96dbb4f3d8acfe2e5050032fcf601021221669722c0eb136280e559879ac3f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
ecd7874db35e50c0bfa75badafd67225

SHA1
5b0ff6715dfa18e7a65a5c890a25a484216ecb26

SHA256
6433c493fa55e1a4e05be323e2be9d5bf14ea59b65ec9ff7dd371c9ca1509f10

SHA512
86298617bb529af6020229fc9c78aab8fd89701e267e039411c64c627ab5c03864d07fb0ffd89c02d27ddf06259deb21e961bb948b3ef3aa0d88c7bca730a33b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
15KB

MD5
871c19e44e1508c156c83998db8d15f0

SHA1
5e6170c8166a406028ecf77dc2c0cb195f94b2f5

SHA256
dc5bae5f688fca41ad3d967baa9f80488c12befa347d9b2ae87f7e664f84df57

SHA512
6f7f5983e174594e336abdc95544fd7452695f8ddfbcfc0d344ce217f0f314384494805f73c8f637d9bd47c0544ab1b96260ebcf3260a8a443aa7b2fb49489e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
0de285f0b8e5545fba604491c8a6a057

SHA1
09b8e267724a64cc12c1e62b0d6db589ce53478a

SHA256
7ae740eae2cf2de75b390eb8519bdb258fd5a52253ce668c2a698ea5e4c777b4

SHA512
1c93e9b17cf2091fe3f6ff34583e52e25bd4e21d18ec3b9b068395759b8bb2f92c4764b5a76df6874b0997c327f60b63cbaecc12301c7957201c500a9f36a8be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
16KB

MD5
10d8ee07bd6eac8ae6efb6e16ebc9858

SHA1
7b107f039002c3901de029d44b6067e93572ca79

SHA256
83c992fa10279baab944a5b26bcf1df8635ba61ddad2bafd9ef43e88e488471c

SHA512
9862661469f0c6352e1aee223e055e7e3385e1c74648454c25c6e7f0458d36347c8ba3ed2b05b414a69274e6f56c617a885f5408aa821f98cc7836c0a86b56ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
17KB

MD5
1fb65ba18cfd0185191f037ec3fb5163

SHA1
0d71415cb9bace1bfe5fd6b7c99d2b7dfe94e8dd

SHA256
3799855363c74d6bbb8138aedc51707c46c4657b542f4b577741055257386795

SHA512
e0e2d25e84de508fcfd0d9263dc4504c5b78da6ed81ddf716d5a6af4e033c362f58b944e18b72dcd209b92f83ae32ba635a8e4ef7b744c2ce30bac441d37b642

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
86589126f708a676ebfb423f9cfafc3c

SHA1
7cf75d2aaaac1898fc7f1ccd7f498045422f790a

SHA256
4e29d6e02436e95296fab916a317964076c4afac3a05836b783a1c202dfc3093

SHA512
a506e93e448fb2a8e4414be4a3c7fc8839eb156608d1c87bef4db18c5c82a1eaef79feece9cc6a364bc5255314a1c8d951ea29ecfa9413dbc8c2adcf09fe5e34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
17KB

MD5
8e90e9194b25eea3aea96f640efddf03

SHA1
a632102db36ee84c716e531e3486dfbb0f5b04e2

SHA256
6acbb1118fc1ca690312ec628b097ded306b28ddf68a6d3255fb395214eb4c07

SHA512
50d7c88404b00165497090d7fb0f386797b00b749c6d63159c0223d6b3176f3f6f47c50e835eb16d7fde862ae402365efb08939a8c8981c1c913fe7425972169

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
2c58a3f249bc98c166922be423b7ddcc

SHA1
de584daaa9f0440888df0b18b99453548d148728

SHA256
1254d10eaea78b41d2e7c8d9969270a80fa781c0b41cdeb9e9246374241c4d5c

SHA512
dd8bd5230b21b984120ee7a4ce6f2cb78d53e99accdd331df53ea7f9c760be104e3c14fd9a5b40112375347808201343d79ecf90458a5c273da7ef5901248a17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
17KB

MD5
13d0708c71458cf6c8a0f87f473ae295

SHA1
aa3546b3ff3140f6d68646daab11f5dec688152a

SHA256
1ab5d3aaa0f1f0532056c0803cac60c175428f308a2d8bb9067aa714426dc175

SHA512
f94403239a6fa7794ab299394a918e65907239a089a0b28f4f74689ccaede5ae792bc026fc09c421f934aaec4c587a6b57f3695e7544b82e68d1bf14f5fccf08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
17KB

MD5
2ace8f5823425ae127e62b14e3508243

SHA1
1d6fe8b1b3893d27cd9146233ea152faae47062b

SHA256
8a85faeac56d964c2505bd6b18299c09b2eaf99f916246ddcf35d8f6522832dd

SHA512
8535ed4174eeed1440f751b857f2db59b218d87b2e5918ad82d840fa364f28213fda4d347fe5493b2ca079db59b8f70d1dc1e6c6fa5d7e2237884906d4c47f97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
18KB

MD5
982541c3a6cbf1a2d84a2d2f2e911810

SHA1
a5a785da9981c1f8bb6e6da6917011d1a5b0350d

SHA256
92441ece0250898b3dbe869727c3ce64d4fdf53639fbb9c4de564d702076fb24

SHA512
6a26ed63b347e0baf223cacde0ba07e8353c52d1124c88c9cdbbf3a954edfc8d10ef955066793d633ea4e611635f32b254c39070895cfafe031679f7f2186757

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
0e0dfb50261f2572bc5d46f4744a4c26

SHA1
aec8c7cfe98504a15d48b59d5a596951f48989c5

SHA256
fbc54212a531035cae8d615cd64150304678bdd0a346bc1fe28d78876ba00601

SHA512
0c667eb680f557724dc84a29e375866be9a2251c0cd2584bde376704e75c373a404186c45d584cf481c41d29957e76a60b2e7067356680b9f5fb4f950eefa7e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
767dedc7d5ca842812d578d9f1a96ddf

SHA1
6a858c6012278691a6436f80a0cfbe1d16b1e064

SHA256
9be0dced659f2f33fc489f817b05108c817beb3eaf43f1230405f6ddb7ef3120

SHA512
a6690d36a6b35c4f57d7dc4ce2f712d0690ce6fe64a7c946876fdf9b4d4b805c8e1f68ab0f4b2cc2b1d44e01e06557a66cdcc1450e1e11455a179abbef79839b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
a865cf6f8c5ee0794e22267501cef1c2

SHA1
e86238ae051fdfe955e40462d044649092ddc680

SHA256
5338558e6e1169e08117d0126012b9fa91c6e0be0bdcbac10f27047f7e316312

SHA512
2809c227dcff5d12cde5b22e35652b452f6c8a73ca38e8235aa9c3e3951fc4c57d9aa362c77df7a775531b866d87cab327e834d81823bd95e75d4dabe26b0122

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
d6006bd8bb23add7bd696158c44bde54

SHA1
d30ffe0e029064648d9a0d3b8be3dfa70ed15fe2

SHA256
8a712532713bcf3e69e4ca27122d15730b9bbcdfa05d0342f552a58eeef1b617

SHA512
17952c29fb9fa460cd0e80ec77c60f28125ee3a3d0702e966a10b433fb46e8b440bcadb4bec72251ae5e5fcdaf98e3c4918b5fd4a7464e490c37d54f622fd76d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57e203.TMP

Filesize
48B

MD5
f68e82ec5c3cfbf3d3f012c0a92a848b

SHA1
5b1ec7758f389fff93a16ad27a4572d82d21d6b9

SHA256
233ad240b3e6f861dc858e0ab561547bf1107d8756f170d8038458937cd2caac

SHA512
84e2be72c143af7462578cbabc814c5421247ffbe538abcf5bf607097f0a142f576dae371000c5090864c0a0585f23cefd641a66ae399fe99975ad6a4022e38e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
324B

MD5
187c23f54084356222e87ab6baf34f76

SHA1
0d9316c936e1f406273e734045a29b4a031b080b

SHA256
28ce3d23d19662c78a444dccc98c5e833a6ecc2248d03200263f8ef19a441aa0

SHA512
043b12bc18c1a03e3f300eeb9228b1f838eb218ace549fdc84ff8671d439457d22e8d51fa01ffc6e51ab444026d98bb1e44a39ad63286ddc5f487b575f3c769b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt

Filesize
76B

MD5
46cb7641be727eb4f17aff2342ae9017

SHA1
683a8d93c63cfa0ccbf444a20b42ae06e2c4b54d

SHA256
944fff1dd6764143550534f747243ef7d84fdac0642c94135ab40f584520f63e

SHA512
dc1b5f363e90abff5c1663a82764296922c842820d2819805e87da6da1081f1b5f2d8debc83ac34a26ce289b7b22588b022433686b19b039074ae184968b9fda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5b7972.TMP

Filesize
140B

MD5
d918463b9a5a5e04779da0e59240b190

SHA1
4c5aa7d36004672c6afca2ff865b29bc980ea722

SHA256
5a3c3163686812bd871f523b5aed1851e2317f035732b3979980cfb8c989d099

SHA512
f86b1eec37b89427cf0c6b7917bcb1b66839a0d477553eb98cd92a0690a1b9baec8d1a4f5798bef1f6a1238853ed96d4f9e8133a2aca2ee3171acdd3648abb2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\43f1b700-6e9e-4984-8927-bf81fc120ed3\0

Filesize
28.8MB

MD5
7620ed914a2e72059cc79fa8097f8f54

SHA1
dec9f8e249f23c449bacdb95097b6ac926271ece

SHA256
ddcd9ab64cbd20408dade5169a52f57b63e73345a7d7ee44fd1a0e5e034ef849

SHA512
042f514e290a3cb118eb50e99986fc07db1b647ac4e7ac9f3c89da4b83b77c245446505d63ab95aa849b8d4e6477438e8345be5d6752799adac85e41db78299e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dbb88f52-d657-4413-b576-37a386b07ff3.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
13B

MD5
a4710a30ca124ef24daf2c2462a1da92

SHA1
96958e2fe60d71e08ea922dfd5e69a50e38cc5db

SHA256
7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7

SHA512
43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
118KB

MD5
ad82bf27762a7759c9d7c51dfca135ce

SHA1
f5b62e4e2476e6884c1550c1f251594c4563326e

SHA256
cf4595cd58c41ed87085b423128b012cf081529111f9ab90d896fca7ae6e3218

SHA512
3cf0b093287d461005ba72c89f486470c2286c98db4bc776439332ca0cf3e72a439b2f167565708f9f6d4d69000236a6504898c997ca7ce7206ca44aec809c23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
d0abaf30ec5719ee471ccfd2042ca34a

SHA1
23062ad97b760c61b071c78dca3bb63530319b42

SHA256
8a67e403c2b17708494f154f39128b2256492fd962a4d33dd519034353d1d025

SHA512
75f8e0de31b80c717b48ec7206cd3c527813cbd1302b6b410b3d4cfe068e0c965d090a33b6af5faecb2e0a690c9ef49965b69a9ca39c419b4ca89a021e8c0373

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
153KB

MD5
9ef0d84c3f28b32c8454749e7c423010

SHA1
9f09182aac440b9d591bfb99d77bc9ed9d546107

SHA256
8ec338ec11bdc02f774ed34ecaf887f156ed795d689a241812004b64ef0a0485

SHA512
fd5b52c799ba55c29a9c88510fb74b279b94dc9b3494a72a20afa05328fc50f91f29cde41baf211f51f5025943768f1777a92840a011025d5102d69c57ec7093

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
196KB

MD5
e6c08eca49bf9cd95ad07a62928afbdc

SHA1
41dfddfe5ca5b091c79d4fe38b27c921567915e9

SHA256
634b301fc493d0aebf0a362513f2cd1b8c60a48708c5d2bac423c29e3d595ed0

SHA512
61a04c47ecf0bff4340e3b7fc36e9200a8e28b0e62b221edd304efccef453bba545fd5ef46ebdd628174bb23df4c3658aed39e691caa0728d4f5ba92f6f9fc46

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
153KB

MD5
0000b03d82ee89034106a744f789aa3f

SHA1
8d2bb2ca2eb7453faf3ca0846a569d5842f585c7

SHA256
a389fb6c84abcec26a5627aa0286e00112ec767ab28db5001d2c6064aa717545

SHA512
8d39ca05abbd51fe2f8e210b32fedcd8707027ea0dfdf5633be690329f6c43857c12574a38266e6d41b13cce4f344d01aea7fdd390350c107dada8e4ca0886c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
84b1f5ec1d71e672608a83cd73bbd492

SHA1
beeec99a2a021fed29dce2da259a38a02a2bcb77

SHA256
ccc2f3ed310bf1f828dc5f412878bbb93e406d4085af88e1843f878d949f4c34

SHA512
535ba9f8520e22a6c05f84714d175d40c7fce6ecec1bb50382facf7206ffce2f777805053cbbf7ca9c4a008fb5701e01c4f08e3cfc8d9fb1983081093002f1e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
153KB

MD5
ef7ad870801397877e3519d15dab691a

SHA1
2bca197db8ddde8f30940d9dc2bc538852ab22f1

SHA256
30d4643e932928c847380dca79bfa8b28d6004278b1432c9d662d3e7beff0824

SHA512
d42033425aea92ec0c40c2e1dfba4afc45ef6b29beedfdbecb322610c88713b67cb648b4ce6d2ace8924519b3b494d91e7077b446984251c2b62cb273e99509d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
d3bb8b045219f0f04fbcb4e0b5b373f8

SHA1
f1614f76c7cb97307c3e702a1ac2d2699fe79224

SHA256
5881c8499a77a469690e165cf1044b58dc5857d84405ed5182d31f413d273dd4

SHA512
5bf6ebd69df860909eab0e600f32d29ed4e98689bec8b7eede527e7f2001d879931d7003e10cf129be0a37c49e81c1508054a835eb40d0f5c8fb78b4ac79179a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
153KB

MD5
5a60d2a08f6a5c9a1bd12fd91d869e97

SHA1
030b9b84d80b9f3f19ed7cd6cefebb7e348f378c

SHA256
24e15e38d323e371886382095eff7d50191471915e68eeb827b8c4190ccf0faa

SHA512
7154897e10af85d737921c78ff52f0869a23fbb85b54ff71bc38a44fd5592abd0b8c5e717d3ebebd9bc16a36191989a9990bd3746faa867ee34dedd7ac369598

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
d3c77096b2356f7139d07be7b28ae02a

SHA1
652c8c8d33cdbfbb5fe17eeaf5f44e307da336f2

SHA256
a0ce296df9ead5807cee993d777859bc80f3e4e259407d4e8cd12a216f30e99d

SHA512
3191e419ddc6730537dfbb193b7b17cc77178759d41286c4779571a34e06a3277bc4ddc9384c0d66c6cdf039aa1361b827fdb90627b5b8fc7cb947a87d009c45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
79KB

MD5
4990d9334d16069a0037a971ec8444eb

SHA1
980c37254de15584a73969f28eeddd3a3152682b

SHA256
1c93779c584f249a90cd8c6180aa44924980f39408e9963c9ed71e520775257b

SHA512
f70b1053fa5e758192828fed3f2668586453787faa0d598a0723217c061a7ca6f3262eae6889f324b203baf2d53bd20aa7b6b5ac2747d5320059a81c953ff2f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_0

Filesize
44KB

MD5
da5b8d660f3f70d1e01dbcc972155e04

SHA1
5dff26eaf51467494d27c7be762165cf9c213a60

SHA256
2c0965754efa2cdbe2d29a84de27b100761b24c63579745dc6450d4986f9876c

SHA512
cb9c2a5fd7f0fdb6bace9dbbc23ca21f6172798e53cdc25f116556adf471f0c371a4c7b7eecf66e8e9758f49c590b8c16b51aca99915c0020e1442bbe677dab9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
86dcd0c2a257f0742276459dfea8a254

SHA1
0b1bcac0ee728546d259370c1cf769f0a2be27b0

SHA256
4d381b79f4b721df3bcaacf20e9dd5af3b3dc5859741323e17358524ce50131a

SHA512
014a0e4791e5fac110ee921c03431f0bd6008ee746d1bb0fd7ecfdd71977af70410a381dc0614fbc3c2c99579757e8170ad32fb2ee0f3928aaa26a2103f287f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f175d15b5aefed4a252abfba40b73b75

SHA1
36065c40677ddbbc29b99b1f74d92c3d4cb29a40

SHA256
01821762c61d4936395a5ea44638489f65ecb49c131569ab83d27f605111601f

SHA512
a9578afdae99d3bbd9e3ee05c0f80b0e22c399a5c74add52b0c0a107a4a34035dc97a85ccd86a28faed4c114a2d6777fe8eeba5f0b843790c6456908d8598fd6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2

Filesize
1.0MB

MD5
6c5201f337641cee957641132609e2e5

SHA1
2e75f95d6fad7402b6009a034217286518a83ca2

SHA256
77caf148e46bf8848d70ffdfa8a274195fd00e0262ed2dda4efa6932b5d987c3

SHA512
2329a53e0a23bbe62d772365068d1fe266e7e10fc0955036989a803f222bceb595f2383b01719fc2b47e26056a376beda0f7519ba8095b27021b7eb1622e4979

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db-wal

Filesize
1.3MB

MD5
031ef47939e56ff19f8dcf0fd58c2aea

SHA1
5f5f132fa98fce7ef55338f6ec00c499c98286bc

SHA256
182995bdd9bf968b29c4821a2797809e70e94e9c40f44eb186aad59bd0571847

SHA512
780e08844856afbacbd8f5fd7b451180dd2a8f097be06ad4f8a3b127d331f7fec033cc4b21bf6425f603910419cc9b77a0f17b9308c922c89b7b505b8d5ab6bd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\TRZE6I7N\microsoft.windows[1].xml

Filesize
97B

MD5
5f20566632409cf5766e4a9bc1ddc989

SHA1
39d40c974e76857957ef966ba650519b0a5b2d6c

SHA256
acc2ad05e0e666a4f809dabe7e8124e825c5ae8dc41195cc05b1dd2c5442e7d0

SHA512
11ac109902f8aa21ec877ad44d6982a004dcfa46198a7650bdc40ab0713ab546144234a67edf4bff45e1021c634aaf2fd73ef347c2dece2ce2db587e167d23a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5812_1470946521\e6cd68de-7bee-429e-aa3a-c923d21d1c3d.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\Desktop\20ca1f8c5fcf963fbbb10b527d041847.vir

Filesize
252KB

MD5
20ca1f8c5fcf963fbbb10b527d041847

SHA1
e6444518f375bc8d874d221d7f5661e80f740662

SHA256
393ecb019a145a62b32efee66c6086943945e869f848b42d4c72f4a0d3fe3ba3

SHA512
a0a78c8ef3793fb631ca3da1cbd49f517c360301d07db352228ceb30458db520402bda28784ebf6371592743f16e3dcf5034997c01806ff71b7b6bbef58d93a6

Download Submit
C:\Users\Admin\Desktop\2a6db6ab86ab610982ba517dfcc73d91.vir

Filesize
420KB

MD5
2a6db6ab86ab610982ba517dfcc73d91

SHA1
06969d60c0c153f4a4cfcd32417d02498948c019

SHA256
88384f143df60d5ae4a2fcee570d867754c292efd96f2bb90581e8af7ac6bb58

SHA512
09fa8e1ab24953595a26f4c9575265b8b953a9492145d75f0a3a09e4e62210ff65dd30f02335f4111e27d523368a7a8f5f24ddfeec8e8b1bed77020dc3798651

Download Submit
C:\Users\Admin\Desktop\2ab252c9b35bb25faabb4312f5df87ec.vir

Filesize
156KB

MD5
2ab252c9b35bb25faabb4312f5df87ec

SHA1
b6e17906d46b5c72f20851d665bff0bd3e7a89b2

SHA256
ef488003dd1a25457db9362cdd4b0747e441f7e8da37053b0318a0e205f575f0

SHA512
7dfc7b04d63489718eda236faaf65fbdeac0b76777ba2316e7526d973c605117b543629a260172b7b801b995bd9a6ee7bd1bc1ed709f000181dd4a2445dd2d7c

Download Submit
C:\Users\Admin\Desktop\558b05e59b333aef5224e1da7d03f2e9.vir

Filesize
120KB

MD5
558b05e59b333aef5224e1da7d03f2e9

SHA1
d68e616cbf0b22680de34c4d3615cbfc866176bc

SHA256
55120454e6afa0416c07b905d38434768542cd93b36279bcdbc0a894854b7d11

SHA512
5ccffff98ac76452c802ff92cd566fff0ede3312ab2fcf5e379906c20412c56d4f6a5be71c2bf9f2cec90ec718fcef3bdfc321e6b969e556692c5f3b2d1d3fa9

Download Submit
C:\Users\Admin\Desktop\6567ee3c90682ce956df2af88ac6d0d0.vir

Filesize
61KB

MD5
6567ee3c90682ce956df2af88ac6d0d0

SHA1
b907e266b4af7cdd5fe96488cc365fc4e41e31f6

SHA256
63bc229bdc039252c49a63b31d8c3a73542535c51153e408de55c8490a3ce24d

SHA512
23fa8de59c14c2abeedf6ba16dbcb15bc0f1a065335bdb57fe8cd42005197c5cba748af3ebea39f61c74583c45479d88895b93e797145af8a3de5a8e93929acf

Download Submit
C:\Users\Admin\Desktop\6fdb9a5243232703b13cadc5cccfa253.vir

Filesize
288KB

MD5
6fdb9a5243232703b13cadc5cccfa253

SHA1
694d077a54a46daee4880633a38e0804fca88060

SHA256
16f97b141fcce54f677ab3c97901059705244b5e09f5c353b3ae99bfd9c8aa45

SHA512
929df3212c7e7222008e8e944e5a778582aa09c18e0afbaf4fa45bfda617dfa0d8a9a9381c4ab0ae7b7c75168b295483930326e0a7ffe2e3fb7957dab4a05e67

Download Submit
C:\Users\Admin\Desktop\8b71967467522258a92a8d5dd734d565.vir

Filesize
120KB

MD5
8b71967467522258a92a8d5dd734d565

SHA1
5b40b3789f5fd3ba26493fd7a6b4c46848941914

SHA256
ee9a580245ff7bf4465b122a2bc3ef9c731daeb06897ea34579c009bc9fe988b

SHA512
81d669c56464d2c3c302360bbeafa5a7443e20c3cd4dfb80cc3cd28b736434d2b66789bed02571c4ff62a91e82bc811edf38202a4f3fa135e5075550d2035450

Download Submit
C:\Users\Admin\Desktop\8d1d6e7c36bc9c97338a71c862dc52a0.vir

Filesize
153KB

MD5
8d1d6e7c36bc9c97338a71c862dc52a0

SHA1
ea0cd6c2983a4fda97302cf338b3fbac20a3cc1e

SHA256
636f404892310f7f7cbffd013d5ebd5895b309af2b0bb18814e52c5548e4d4a6

SHA512
fe89091867ddfb2e9b8a94edaf5c5d56d61fffa5dd9f604013ebfd19498625d5d0a8c7db0ae4c215bbe00c2c6682a90137abc91de24c89d16dbcd0f961194923

Download Submit
C:\Users\Admin\Desktop\8e300a75d4dc0bb5ad7ca16f3b982c4d.vir

Filesize
1.5MB

MD5
8e300a75d4dc0bb5ad7ca16f3b982c4d

SHA1
acb3a0014a41c7002507281fa203051c2bfd6df7

SHA256
0e6b7297e0d268689c958889a39733a7367e6836eadd82c475f577f26b64d7de

SHA512
f0f5b84911bf027b2af783d10b23e2711a43fa7492dc7058d0a64bc109f06ed5f4f32c82bea73861c3786956783c7bd73cff5d1c359729a1a672dbb5312c725b

Download Submit
C:\Users\Admin\Desktop\a99c10cb9713770b9e7dda376cddee3a.vir

Filesize
611KB

MD5
a99c10cb9713770b9e7dda376cddee3a

SHA1
1f1dd4d74eba8949fb1d2316c13f77b3ffa96f98

SHA256
92a260d856e00056469fb26f5305a37f6ab443d735d1476281b053b10b3c4f86

SHA512
1d410a7259469a16a1599fb28cb7cd82813270a112055e4fbe28327735a2968affbfdcba0a2001d504919e5ef3b271f40c45da6291be9c5f97c278418b241b79

Download Submit
C:\Users\Admin\Desktop\cdb1365059c0e4973843dc0d0955bfbc.vir

Filesize
3.0MB

MD5
cdb1365059c0e4973843dc0d0955bfbc

SHA1
eaa991e3a9c57302f31ac5faba09d7f00f65c8b6

SHA256
1a880b81f53f4c162e7c90d098c185da9cc936988f0ea4fdb278c661d68f9996

SHA512
17d136b87efde90b50daccb84bd85dd09706af14ee5a2a963655ec2df06aa3173915ccb479010098061dbf079c716197d6a311eff3b0c722daf46c00295af4eb

Download Submit
C:\Users\Admin\Desktop\d11cb523b9e2dcedff41c5346a48cc1f.vir

Filesize
180KB

MD5
d11cb523b9e2dcedff41c5346a48cc1f

SHA1
ed5458e2e82effe7c2eef1123956e108ed71c4e1

SHA256
7b86c29435cd174c8ac5bd80e5b77206d0fb7f95774e85ff407e644e0f46fae3

SHA512
28a4e41a729cef7f16a82595e9c69b70c0836a44c66b7381facb904a2845f403a53b39e1ed76ccaef6571eed029f158c343486f2f16b6b1103623efadcd852ed

Download Submit
C:\Users\Admin\Desktop\d1955d1092f0615321bc60e5abd0d8cd.vir

Filesize
2.6MB

MD5
d1955d1092f0615321bc60e5abd0d8cd

SHA1
7e6d20b24d216628f0e7f81015a4f518af075575

SHA256
e1c0d8c1dddbf7cab773d14a60e8e342456a7c80f4b8cc7630927824506819a0

SHA512
cbf7c61868f9a97bc2aa2dc3b72f0227024e7bbf1d0e0c6f899408e6e7fd9202912c817a32bb6d917f1caa27be7c1749eb4681f91edefcfe41a31ed87fc57b14

Download Submit
C:\Users\Admin\Desktop\d872770d3857a675142f706098e45fe8.vir

Filesize
1.0MB

MD5
d872770d3857a675142f706098e45fe8

SHA1
22ac9e35784e8804a1631556bbfca4801a92b322

SHA256
4f5ad84afbc4c814cac687912c528bbb0b6b926f94a0d7352fdd72c503bb6c61

SHA512
3c55158a2fcf92e20d2498c76c12ae887380b6b6293a83992e5c60e5df2c140b06b45c2f367de79fa961e5cfc8f46ed2c472d70c6fc0c5eb26263dfa7b11ab75

Download Submit
C:\Users\Admin\Desktop\d9985f2669dadd11b529f6492198bde0.vir

Filesize
2.8MB

MD5
d9985f2669dadd11b529f6492198bde0

SHA1
401cde3ac2615da2ac121a297a79877e133ceacd

SHA256
227471b4cc68a25874e21e585bdcdf4e42905a291f293f8c549499df0a6cda56

SHA512
a2b53bcb111f326e5475013a0b5babfb95e2edbecabd7bd8120618cbb74a14172e39e5d0db2af6fc6776ec25992fc36634485c177a4f40ae84ec5a2d622c5c84

Download Submit
C:\Users\Admin\Desktop\dad3b507b3519774672e6221a254f560.vir

Filesize
138KB

MD5
dad3b507b3519774672e6221a254f560

SHA1
6a7715c7615db96a73d41f32d0298a476c54d46c

SHA256
64fe980df1cb38cdd29a1d27b70719241b3052281795fd1654638ff47e37aa27

SHA512
85691b29b64b985d0e55872e52e6de7069a9f60b9f4ff1a7795c90290ae9bf06c9379dc857685041635ebbef50ac5e3160cd74ca2bde49037d5e92ee1a198264

Download Submit
C:\Users\Admin\Desktop\deace9a9a08bd89616a9cc3ca1bac700.vir

Filesize
745KB

MD5
deace9a9a08bd89616a9cc3ca1bac700

SHA1
3ed1cf370a297fb653a8331ad370ba6f9f8c919c

SHA256
29a0b87b8495891215d3f7f2d9a7299ff5ad1c78aeecd078a4ee22c67abca3a5

SHA512
695612512c2e6eefe24610cd1f7271e79a4173d8a0046da14a5f90b847717b468211f4ef0bbf361fea954ff1491afc42ebe71f64d54fb269a3bbd7210f2fb30c

Download Submit
C:\Users\Admin\Desktop\f77f8f2151012a32813ed0181c205882.vir

Filesize
560KB

MD5
f77f8f2151012a32813ed0181c205882

SHA1
6d652b36b38fc352060050f2608975749aae32b5

SHA256
dbd4052fc52d018d93db9ace8d02f3642320305677e070516fdcbf7effa34d82

SHA512
feec9974d0f5f3dc927d22b075d3dc7a3f7d33ef24d111be7d428a287dc3d604f14714a81144eb8ade7677d68a79c474083c2838e2c7735132dafdf4face5581

Download Submit
C:\Users\Admin\Desktop\f9d77633d4548da678bd382fb41d33c7.vir

Filesize
484KB

MD5
f9d77633d4548da678bd382fb41d33c7

SHA1
18da4ee8292d3c3ef91a27ea3812802ab91a001a

SHA256
736e213b45a7a12511b3a7ce3aba2510996802ab14ede208817e85eb38e14f1b

SHA512
f8f965383b7e706ccbc959ecdc6365abc6a415c560b0e8bd9dd913b4e53116565779d89ea9f079775aae434d0682399b104bc3beb99962bc9ea05470a215dfa3

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 186243.crdownload

Filesize
1.6MB

MD5
6c73cc4c494be8f4e680de1a20262c8a

SHA1
28b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0

SHA256
bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e

SHA512
2e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85

Download Submit
memory/100-4442-0x0000000004A00000-0x0000000004A01000-memory.dmp

Filesize
4KB

Download
memory/540-5547-0x000002CD2A7D0000-0x000002CD2A7D1000-memory.dmp

Filesize
4KB

Download
memory/540-5548-0x000002CD2A7D0000-0x000002CD2A7D1000-memory.dmp

Filesize
4KB

Download
memory/540-5558-0x000002CD2A7D0000-0x000002CD2A7D1000-memory.dmp

Filesize
4KB

Download
memory/540-5557-0x000002CD2A7D0000-0x000002CD2A7D1000-memory.dmp

Filesize
4KB

Download
memory/540-5554-0x000002CD2A7D0000-0x000002CD2A7D1000-memory.dmp

Filesize
4KB

Download
memory/540-5555-0x000002CD2A7D0000-0x000002CD2A7D1000-memory.dmp

Filesize
4KB

Download
memory/540-5556-0x000002CD2A7D0000-0x000002CD2A7D1000-memory.dmp

Filesize
4KB

Download
memory/540-5553-0x000002CD2A7D0000-0x000002CD2A7D1000-memory.dmp

Filesize
4KB

Download
memory/540-5552-0x000002CD2A7D0000-0x000002CD2A7D1000-memory.dmp

Filesize
4KB

Download
memory/540-5546-0x000002CD2A7D0000-0x000002CD2A7D1000-memory.dmp

Filesize
4KB

Download
memory/2256-5156-0x0000000002F80000-0x0000000002F81000-memory.dmp

Filesize
4KB

Download
memory/2368-4770-0x000001AD71B00000-0x000001AD71B20000-memory.dmp

Filesize
128KB

Download
memory/2368-4740-0x000001AD71B40000-0x000001AD71B60000-memory.dmp

Filesize
128KB

Download
memory/2368-4736-0x000001AD709D0000-0x000001AD70AD0000-memory.dmp

Filesize
1024KB

Download
memory/2368-4735-0x000001AD709D0000-0x000001AD70AD0000-memory.dmp

Filesize
1024KB

Download
memory/2368-4771-0x000001AD71E80000-0x000001AD71EA0000-memory.dmp

Filesize
128KB

Download
memory/3120-5194-0x000001941B5B0000-0x000001941B5D0000-memory.dmp

Filesize
128KB

Download
memory/3120-5163-0x000001941B1E0000-0x000001941B200000-memory.dmp

Filesize
128KB

Download
memory/3120-5159-0x000001941A100000-0x000001941A200000-memory.dmp

Filesize
1024KB

Download
memory/3120-5193-0x000001941B1A0000-0x000001941B1C0000-memory.dmp

Filesize
128KB

Download
memory/3148-5437-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/4304-5593-0x000001A472400000-0x000001A472420000-memory.dmp

Filesize
128KB

Download
memory/4304-5589-0x000001A471300000-0x000001A471400000-memory.dmp

Filesize
1024KB

Download
memory/4364-4597-0x000001B915240000-0x000001B915340000-memory.dmp

Filesize
1024KB

Download
memory/4364-4599-0x000001B915240000-0x000001B915340000-memory.dmp

Filesize
1024KB

Download
memory/4364-4602-0x000001B9163A0000-0x000001B9163C0000-memory.dmp

Filesize
128KB

Download
memory/4364-4633-0x000001B916770000-0x000001B916790000-memory.dmp

Filesize
128KB

Download
memory/4364-4632-0x000001B916360000-0x000001B916380000-memory.dmp

Filesize
128KB

Download
memory/4892-5325-0x000001F3C92B0000-0x000001F3C92D0000-memory.dmp

Filesize
128KB

Download
memory/4892-5310-0x000001F3C92F0000-0x000001F3C9310000-memory.dmp

Filesize
128KB

Download
memory/4892-5306-0x000001F3C8400000-0x000001F3C8500000-memory.dmp

Filesize
1024KB

Download
memory/4892-5305-0x000001F3C8400000-0x000001F3C8500000-memory.dmp

Filesize
1024KB

Download
memory/4892-5326-0x000001F3C98C0000-0x000001F3C98E0000-memory.dmp

Filesize
128KB

Download
memory/4924-5019-0x00000182243A0000-0x00000182243C0000-memory.dmp

Filesize
128KB

Download
memory/4924-5014-0x0000018223440000-0x0000018223540000-memory.dmp

Filesize
1024KB

Download
memory/4924-5016-0x0000018223440000-0x0000018223540000-memory.dmp

Filesize
1024KB

Download
memory/4924-5015-0x0000018223440000-0x0000018223540000-memory.dmp

Filesize
1024KB

Download
memory/4924-5027-0x0000018224980000-0x00000182249A0000-memory.dmp

Filesize
128KB

Download
memory/4924-5020-0x0000018224360000-0x0000018224380000-memory.dmp

Filesize
128KB

Download
memory/4960-5303-0x00000000015C0000-0x00000000015C1000-memory.dmp

Filesize
4KB

Download
memory/5432-4733-0x0000000004320000-0x0000000004321000-memory.dmp

Filesize
4KB

Download
memory/5956-5013-0x0000000004580000-0x0000000004581000-memory.dmp

Filesize
4KB

Download
memory/6020-4481-0x000001DAF0CE0000-0x000001DAF0D00000-memory.dmp

Filesize
128KB

Download
memory/6020-4468-0x000001DAF06C0000-0x000001DAF06E0000-memory.dmp

Filesize
128KB

Download
memory/6020-4445-0x000001DAEF800000-0x000001DAEF900000-memory.dmp

Filesize
1024KB

Download
memory/6020-4450-0x000001DAF0700000-0x000001DAF0720000-memory.dmp

Filesize
128KB

Download
memory/6276-5444-0x00000230301C0000-0x00000230301E0000-memory.dmp

Filesize
128KB

Download
memory/6276-5445-0x0000023030180000-0x00000230301A0000-memory.dmp

Filesize
128KB

Download
memory/6276-5440-0x000002302F100000-0x000002302F200000-memory.dmp

Filesize
1024KB

Download
memory/6276-5448-0x0000023030590000-0x00000230305B0000-memory.dmp

Filesize
128KB

Download
memory/6276-5439-0x000002302F100000-0x000002302F200000-memory.dmp

Filesize
1024KB

Download
memory/6276-5441-0x000002302F100000-0x000002302F200000-memory.dmp

Filesize
1024KB

Download
memory/6428-4596-0x0000000004360000-0x0000000004361000-memory.dmp

Filesize
4KB

Download
memory/6804-5587-0x0000000004690000-0x0000000004691000-memory.dmp

Filesize
4KB

Download