xworm | a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6

Analysis

max time kernel
1799s
max time network
1798s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sv.exe
Size

63KB
MD5

c095a62b525e62244cad230e696028cf
SHA1

67232c186d3efe248b540f1f2fe3382770b5074a
SHA256

a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6
SHA512

5ba859d89a9277d9b6243f461991cc6472d001cdea52d9fcfba3cbead88fbc69d9dfce076b1fdeaf0d1cd21fe4cace54f1cefe1c352d70cc8fa2898fe1b61fb0
SSDEEP

1536:unjFXblMp3wgDkbivVSm16KTOKjLIJXc:unrAwgDkbicmbOKj0JM

Score

10^/10

xworm discovery evasion execution persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

amount-acceptance.gl.at.ply.gg:7420

Attributes

Install_directory
%ProgramData%
install_file
svhost.exe

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource yara_rule

behavioral3/memory/824-1-0x0000000000BC0000-0x0000000000BD6000-memory.dmp family_xworm
C:\ProgramData\svhost.exe family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

resource	yara_rule
behavioral3/memory/824-1-0x0000000000BC0000-0x0000000000BD6000-memory.dmp	family_xworm
C:\ProgramData\svhost.exe	family_xworm

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

Processes:

setup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\126.0.6478.127\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

4472 powershell.exe
4972 powershell.exe
4308 powershell.exe
4632 powershell.exe

pid	process
4472	powershell.exe
4972	powershell.exe
4308	powershell.exe
4632	powershell.exe

Drops file in Drivers directory 64 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\en-US\battc.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\BTHUSB.SYS.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\tcpip.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\devauthe.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\UmBus.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\wacompen.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\luafv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mrxsmb10.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\werkernel.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\hidclass.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\filecrypt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\netbt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\urscx01000.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WindowsTrustedRT.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\EhStorPwdDrv.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbccgp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WdFilter.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\CmBatt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\iorate.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\gpuenergydrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hidusb.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mssecflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\afd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\qwavedrv.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\tpm.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WdfLdr.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\winhv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\disk.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Dumpata.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\http.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\volmgrx.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\scsiport.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\msfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\rdbss.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mslldp.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\sdbus.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\raspptp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sfloppy.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\stornvme.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UevAgentDriver.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\storqosflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\volume.sys	cmd.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dxgmms1.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\isapnp.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\pcmcia.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\nsiproxy.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\xinputhid.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mmcss.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\netvsc.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\usbhub.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\ipnat.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ksecdd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mausbip.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\Microsoft.Bluetooth.Profiles.HidOverGatt.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\scfilter.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\msrpc.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\umbus.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\rfxvmt.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\drmk.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\kbdclass.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\synth3dvsc.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wacompen.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\irenum.sys	cmd.exe

Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\System32\wintrust.dll cmd.exe
File opened for modification C:\Windows\SysWOW64\wintrust.dll cmd.exe
Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
persistence

Print Processors
T1547.012

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\System32\spool\prtprocs\x64\winprint.dll cmd.exe

description	ioc	process
File opened for modification	C:\Windows\System32\wintrust.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	cmd.exe

description	ioc	process
File opened for modification	C:\Windows\System32\spool\prtprocs\x64\winprint.dll	cmd.exe

Checks computer location settings 2 TTPs 36 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	chrome.exe

Drops startup file 2 IoCs

Processes:

sv.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	sv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	sv.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

Processes:

svhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exerojmhh.exeupdater.exeupdater.exeupdater.exeupdater.exeupdater.exeupdater.exe126.0.6478.127_chrome_installer.exesetup.exesetup.exesetup.exesetup.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeelevation_service.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrmstp.exechrmstp.exechrmstp.exechrmstp.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	process
2452	svhost.exe
4960	svhost.exe
4888	svhost.exe
1788	svhost.exe
1356	svhost.exe
4680	svhost.exe
4668	svhost.exe
4284	svhost.exe
4156	rojmhh.exe
5084	updater.exe
1784	updater.exe
592	updater.exe
4068	updater.exe
2340	updater.exe
1832	updater.exe
2148	126.0.6478.127_chrome_installer.exe
316	setup.exe
2292	setup.exe
3988	setup.exe
920	setup.exe
4288	chrome.exe
2436	chrome.exe
3628	chrome.exe
4180	chrome.exe
424	chrome.exe
408	chrome.exe
2268	chrome.exe
1896	chrome.exe
3092	chrome.exe
1348	elevation_service.exe
5020	chrome.exe
3868	chrome.exe
5032	chrome.exe
4016	chrome.exe
3624	chrome.exe
2116	chrome.exe
4380	chrome.exe
968	chrmstp.exe
208	chrmstp.exe
2944	chrmstp.exe
2544	chrmstp.exe
3012	chrome.exe
3788	chrome.exe
4304	chrome.exe
948	chrome.exe
4896	chrome.exe
4888	chrome.exe
4132	chrome.exe
520	chrome.exe
436	chrome.exe
4216	chrome.exe
3928	chrome.exe
3624	chrome.exe
3112	chrome.exe
5768	chrome.exe
4848	chrome.exe
5460	chrome.exe
5288	chrome.exe
4308	chrome.exe
5368	chrome.exe
5808	chrome.exe
5820	chrome.exe
1880	chrome.exe
1796	chrome.exe

Loads dropped DLL 64 IoCs

Processes:

pid	process
4288	chrome.exe
2436	chrome.exe
4288	chrome.exe
3628	chrome.exe
4180	chrome.exe
3628	chrome.exe
4180	chrome.exe
424	chrome.exe
424	chrome.exe
3628	chrome.exe
3628	chrome.exe
3628	chrome.exe
3628	chrome.exe
3628	chrome.exe
3628	chrome.exe
408	chrome.exe
408	chrome.exe
2268	chrome.exe
2268	chrome.exe
1896	chrome.exe
1896	chrome.exe
3092	chrome.exe
3092	chrome.exe
5020	chrome.exe
5020	chrome.exe
3868	chrome.exe
3868	chrome.exe
5032	chrome.exe
5032	chrome.exe
4016	chrome.exe
4016	chrome.exe
3624	chrome.exe
2116	chrome.exe
3624	chrome.exe
2116	chrome.exe
4380	chrome.exe
4380	chrome.exe
3788	chrome.exe
4304	chrome.exe
4304	chrome.exe
3788	chrome.exe
3012	chrome.exe
3012	chrome.exe
948	chrome.exe
948	chrome.exe
4896	chrome.exe
4888	chrome.exe
4896	chrome.exe
4888	chrome.exe
4132	chrome.exe
520	chrome.exe
436	chrome.exe
436	chrome.exe
520	chrome.exe
4216	chrome.exe
3928	chrome.exe
4216	chrome.exe
3928	chrome.exe
3624	chrome.exe
3112	chrome.exe
3624	chrome.exe
3112	chrome.exe
4132	chrome.exe
5768	chrome.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

sv.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe" sv.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\ProgramData\\svhost.exe"	sv.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

updater.exeupdater.exeupdater.exeupdater.exeupdater.exeupdater.exeupdater.exeupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Drops desktop.ini file(s) 32 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	C:\Windows\WinSxS\AM6020~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM4B40~1.0_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM4F04~2.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMA2CB~1.0_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM690B~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM11AF~1.0_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMDDAD~1.0_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\X86617~1.0_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM664C~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM1C0B~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMDE56~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM7BFB~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMC6FC~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMA4BE~1.0_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM9DBE~1.0_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM7077~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM4552~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM59AD~2.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM0935~1.0_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM3D76~1.0_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM4CF3~1.0_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM9F84~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMD94D~1.0_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM2B68~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMD7B5~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM0E5E~1.0_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM63CB~1.0_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM3085~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM6528~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM4D7C~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM0683~1.0_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM0743~1.0_N\Desktop.ini	cmd.exe

Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\BITLOC~1\autorun.inf cmd.exe
File opened for modification C:\Windows\WinSxS\X83420~1.0_N\autorun.inf cmd.exe

description	ioc	process
File opened for modification	C:\Windows\BITLOC~1\autorun.inf	cmd.exe
File opened for modification	C:\Windows\WinSxS\X83420~1.0_N\autorun.inf	cmd.exe

Drops file in System32 directory 64 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DRIVER~1\FILERE~1\NETATH~2.INF\eeprom_qca9377_1p1_NFA435_olpc_A.bin	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\btpanui.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\twinui.appcore.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\uk-UA\Windows.System.Launcher.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\appraiser.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\cic.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\tasklist.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\SYSTEM~1\ja-JP\RjvClassicApp.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\FILERE~1\WIASA0~1.INF\amd64\SA216X.icc	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\ja-JP\wdma_usb.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\FileHistory.exe.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WINDOW~1\v1.0\Modules\PSDESI~1\DSCRES~1\SERVIC~1\ServiceSet.psd1	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\FILERE~1\PRNLXC~1.INF\LXclVBW.XML	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\msimsg.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\wer.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\FILERE~1\NTPRIN~1.INF\Amd64\PS_SCHM.GDL	cmd.exe
File opened for modification	C:\Windows\System32\en-US\DpiScaling.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\he-IL\fms.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\migwiz\REPLAC~1\Microsoft-Windows-ServerManager-RSAT-RoleTools-Replacement.man	cmd.exe
File opened for modification	C:\Windows\SysWOW64\pt-BR\quickassist.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\fingerprintcredential.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\wpd_ci.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\perfdisk.dll	cmd.exe
File opened for modification	C:\Windows\System32\WINDOW~1\v1.0\Modules\WINDOW~3\ja\Microsoft.WindowsSearch.Commands.Resources.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\DefaultPrinterProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\mciseq.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\en-US\credprovs.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\en-US\SystemPropertiesProtection.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\F12\en-US\F12Platform2.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\elscore.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\rnr20.dll	cmd.exe
File opened for modification	C:\Windows\System32\compact.exe	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\webclnt.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\Dism\fr-FR\DmiProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\FILERE~1\MDMERI~2.INF\mdmeric2.inf	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\FILERE~1\PRNDLC~1.INF\deCP6-manifest.ini	cmd.exe
File opened for modification	C:\Windows\System32\slr100.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\dnscmmc.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\lpasvc.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\microsoft-windows-storage-tiering-events.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\PlayToStatusProvider.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\localsec.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\userinitext.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\wdmaud.drv.mui	cmd.exe
File opened for modification	C:\Windows\System32\acppage.dll	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\ncryptprov.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\Sysprep\ACTION~1\GENERA~1.XML	cmd.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\GCDEF.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\en-US\hidserv.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\oledlg.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\ndishc.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\urlmon.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DRIVER~1\fr-FR\capimg.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\migwiz\DLMANI~1\Mup-DL.man	cmd.exe
File opened for modification	C:\Windows\SysWOW64\Windows.Devices.Picker.dll	cmd.exe
File opened for modification	C:\Windows\System32\VEDataLayerHelpers.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\CredentialMigrationHandler.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ddodiag.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\ctfmon.exe.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\certmgr.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\w32tm.exe.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\systeminfo.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\AuthExt.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\tsmf.dll.mui	cmd.exe

Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol
T1021.001

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\System32\termsrv.dll cmd.exe

description	ioc	process
File opened for modification	C:\Windows\System32\termsrv.dll	cmd.exe

Drops file in Program Files directory 64 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI7B67~1.0_X\Assets\GamesXboxHubAppList.targetsize-24_altform-unplated_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI0911~1.0_X\LUMIA~1.VID\AlphaBlendingEffectPS_Y.cso	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIE984~1.0_X\Assets\SECOND~1\TRAFFI~1\CONTRA~2\SmallTile.scale-200.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MICROS~3.0_X\AppxBlockMap.xml	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\Assets\HOWTOP~1\Spider\Goal_40.jpg	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\CONTRA~1\HxA-Advanced-Light.scale-150.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI7B67~1.0_X\Microsoft.Xbox.SmartGlass.winmd	cmd.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\fr\System.Speech.resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MICROS~1.0_X\Assets\MANIFE~1\CONTRA~2\SplashScreen.scale-100.png	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\STATIO~1\Bears.jpg	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI20CB~1.0_X\images\CONTRA~1\OneNoteSectionGroupLargeTile.scale-100.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI9599~1.0_X\Assets\WINDOW~1\WindowsCameraAppList.contrast-black_targetsize-96.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI8A07~1.SCA\Assets\SplashScreen.scale-200.png	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\System.IdentityModel.dll	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\it\System.Management.Instrumentation.Resources.dll	cmd.exe
File opened for modification	C:\PROGRA~3\MICROS~1\WINDOW~3\MSFax\COMMON~1\uk-UA\confident.cov	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\DELETE~1\MICROS~3.SCA\Assets\PhotosLargeTile.contrast-white_scale-125.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MID6EE~1.SCA\AppxBlockMap.xml	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI0911~1.0_X\Assets\PhotosAppList.targetsize-40.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI0ADF~1.SCA\AppxBlockMap.xml	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI8A07~1.SCA\Assets\CONTRA~2\Logo.scale-200_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\STATIO~1\OrangeCircles.jpg	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIE03D~1.0_X\Assets\Sounds\Nudge.wma	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\9434_20x20x32.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\CONTRA~1\HxA-Exchange.scale-250.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIE984~1.0_X\Assets\SECOND~1\Work\MedTile.scale-200.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MICROS~1.0_X\Assets\HeroHelp\Scenario2RTL.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\SHARPD~1\RENDER~1\Shaders\Builtin\HLSL\Textured.fx	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIC69C~1.0_X\SkypeApp\Designs\Flags\large\tv_60x42.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIC69C~1.0_X\SkypeApp\Designs\Flags\small\gg_16x11.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MID550~1.SCA\Assets\SECOND~1\DIRECT~1\Place\RTL\CONTRA~2\WideTile.scale-125.png	cmd.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\MpClient.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\Microsoft.Xbox.Services.winmd	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIC69C~1.0_X\SkypeApp\Assets\SkypeAppList.targetsize-48_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\Assets\Themes\Fable\fable_cardback.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\SHARPD~1\RENDER~1\Shaders\Builtin\Bin\FullScreenQuad_PS.fxo	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MID550~1.SCA\Assets\SECOND~1\DIRECT~1\Place\RTL\CONTRA~2\LargeTile.scale-125.png	cmd.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\STATIO~1\OrangeCircles.jpg	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\bg-BG\tipresx.dll.mui	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MICROS~4.0_X\Assets\AppTiles\WEATHE~2\423x173\15.jpg	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI21E8~1.0_X\Assets\Images\Stickers\THUMBN~1\Sticker_Icon_Pipe_Bend.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI9599~1.0_X\Assets\WINDOW~1\WindowsCameraAppList.contrast-white_targetsize-24.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\CONTRA~2\HxMailAppList.targetsize-20.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI97D5~1.SCA\Assets\SECOND~1\Car\LTR\CONTRA~1\WideTile.scale-100.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MID586~1.SCA\Assets\CONTRA~2\LargeLogo.scale-150_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~3\MICROS~1\Windows\APPREP~1\MI70B5~1.XML	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MICROS~1.0_N\AppxBlockMap.xml	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\Assets\Buttons\FULLSC~1\Windowed.png	cmd.exe
File opened for modification	C:\PROGRA~2\MSBuild\MICROS~1\WINDOW~1\v3.5\Workflow.VisualBasic.Targets	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\es\System.Net.Resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIC69C~1.0_X\SkypeApp\Designs\Flags\small\lb_16x11.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI7B67~1.0_X\xboxservices.config	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI41D1~1.0_X\Assets\AlarmsAppList.targetsize-16_altform-unplated.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\models\de-DE.PhoneNumber.model	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI7C12~1.0_X\Assets\music_offline_demo_page2.jpg	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\System.Workflow.Runtime.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIAA8F~1.SCA\Assets\GetStartedWideTile.scale-200.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\SHARPD~1\RENDER~1\Shaders\Builtin\Bin\LightedTextured_PixelLighting_PS.fxo	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIEA86~1.0_X\Assets\Themes\Classic\classic_12s.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI21E8~1.0_X\Assets\Logos\WIDE31~1\PaintWideTile.scale-100.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\CONTRA~2\OutlookMailBadge.scale-150.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIB685~1.0_X\images\OutlookMailSmallTile.scale-200.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MI97D5~1.SCA\Assets\AppTiles\CONTRA~1\MapsMedTile.scale-100.png	cmd.exe
File opened for modification	C:\PROGRA~1\WI7DB9~1\MIC69C~1.0_X\SkypeApp\Assets\SkypeWideTile.scale-200_contrast-white.png	cmd.exe

Drops file in Windows directory 64 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AM287D~1.MAN	cmd.exe
File opened for modification	C:\Windows\INFUSE~1\Packages\MIB685~1.0_X\en-us\officons.ttf	cmd.exe
File opened for modification	C:\Windows\SYSTEM~1\MICROS~1.MIC\Assets\READIN~1\css\StyleFontSizeExtraLarge.css	cmd.exe
File opened for modification	C:\Windows\WinSxS\Catalogs\C1ED2A~1.CAT	cmd.exe
File opened for modification	C:\Windows\WinSxS\Catalogs\57071b988318bc5bd4519d7b88db5a863a2e2aa6bd721d95cf88ee3eab458a29.cat	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AM6633~2.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AM9524~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MS618E~1.0_F\UIAUTO~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO0972~1.0_N\APPXAP~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM994F~1.0_E\TTLSCF~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMEC1E~1.0_E\SETUPC~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM992A~1.0_F\NVDIMM~1.INF	cmd.exe
File opened for modification	C:\Windows\WinSxS\X861ED~1.0_I\UTILMA~1.MUI	cmd.exe
File opened for modification	C:\Windows\SERVIC~1\Packages\MI1704~1.CAT	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM10A0~1.0_N\srmtrace.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AM250A~2.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AMA24D~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AM97C4~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMABED~1.0_N\mpr-dl.man	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AME61A~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\X819D2~1.0_N\ASPNET~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AME9B6~1.0_N\85f1257.fon	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AM85FC~3.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\X8773A~1.0_N\mpg2splt.ax	cmd.exe
File opened for modification	C:\Windows\MICROS~1.NET\FRAMEW~1\V40~1.303\it\Microsoft.Activities.Build.resources.dll	cmd.exe
File opened for modification	C:\Windows\MICROS~1.NET\FRAMEW~2\V20~1.507\aspnet_perf2.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM00F8~1.0_D\C_MEDI~1.INF	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AM3197~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\WO7E92~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\X8109C~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO2644~1.0_N\MICROS~1.DLL	cmd.exe
File opened for modification	C:\Windows\IMMERS~1\Settings\AAA_SystemSettings_DateTime_CountryRegion.settingcontent-ms	cmd.exe
File opened for modification	C:\Windows\MICROS~1.NET\FRAMEW~2\V40~1.303\es\Microsoft.CSharp.resources.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM63B7~1.0_F\SQLSRV~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMD007~1.0_N\WINDOW~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AM8085~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\X8AD43~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AM14ED~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\X8FC5C~1.0_D\WINDOW~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMBBF1~1.0_N\MICROS~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AM668E~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\MSIL_N~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\MSDD25~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM3C9F~1.0_N\DEVICE~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM230A~1.0_I\SYSTEM~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\Catalogs\7a4b90f1be2c7877270676c2342b364ba6903bb965f21f0531294f677f44bf19.cat	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\MS92AD~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO4F0C~1.0_I\MSFT_FileDirectoryConfiguration.Schema.mfl	cmd.exe
File opened for modification	C:\Windows\SERVIC~1\Packages\MIAFCB~1.CAT	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM50B7~2.0_N\SYSTEM~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AM4751~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\X86_MS~3.0_N\normnfd.nlp	cmd.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$7D18~1.CDF	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AM5A81~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\WOD0DF~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\Backup\AMCDAC~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\Catalogs\b02237879d386b9776f92b084522644afdbc32cdb0759d1002fbd184dc099d4f.cat	cmd.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$D756~1.CDF	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AM2D3A~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~2\AME5EF~1.MAN	cmd.exe
File opened for modification	C:\Windows\DIAGNO~1\system\WINDOW~1\DiagPackage.diagpkg	cmd.exe
File opened for modification	C:\Windows\INFUSE~1\FRAMEW~1\MIF199~1.0_X\AppxManifest.xml	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMAE76~1.0_D\SYSTEM~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\Catalogs\5cca82c057c906de2e8786e7692523c20bc7a8c21633974eb0be533838df29c9.cat	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Telegram.exeSearchUI.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Telegram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

SearchUI.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\GPU SearchUI.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe

Modifies data under HKEY_USERS 4 IoCs

Processes:

setup.exechrome.exesvchost.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	setup.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133642713922695436"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 64 IoCs

Processes:

updater.exeupdater.exeSearchUI.exesetup.exeTelegram.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8582249A-7E37-5C77-A5F4-1FBFEAFCBC5F}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\TypeLib\ = "{85AE4AE3-8530-516B-8BE4-A456BF2637D3}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B685B009-DBC4-4F24-9542-A162C3793E77}\1.0\ = "GoogleUpdater TypeLib for IPolicyStatusSystem"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-AU\\M3081Matilda"	SearchUI.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "Female"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "11.1"	SearchUI.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\ProxyStubClsid32	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "%SystemDrive%\\Data\\SharedData\\Speech_OneCore\\Engines\\TTS\\en-US"	SearchUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8FCD652C-D470-570F-9A74-B31F9AB8F368}\1.0\0\win32\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6537.0\\updater.exe\\5"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\1.0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6537.0\\updater.exe\\4"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}\1.0\ = "GoogleUpdater TypeLib for IPolicyStatusValue"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "Microsoft Speech SW Voice Activation - English (United States)"	SearchUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\AppID = "{ABC01078-F197-4B0B-ADBC-CFE684B39C82}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib\ = "{463ABECF-410D-407F-8AF5-0DF35A005CC8}"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\tg\DefaultIcon	Telegram.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\Elevation	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6537.0\\updater.exe\\4"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\ = "IPolicyStatus3System"	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\tg\shell\open\command	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "6e-1"	SearchUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\ = "ICompleteStatusSystem"	updater.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheLimit = "1"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "%windir%\\Speech_OneCore\\Engines\\TTS\\ja-JP\\M1041Sayaka"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "Microsoft Sarah Mobile - English (United Kingdom)"	SearchUI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\ = "IUpdaterAppStateSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ = "IGoogleUpdate3Web"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\1.0\0\win64\ = "C:\\Program Files (x86)\\Google\\GoogleUpdater\\128.0.6537.0\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{4EB300E9-4F8A-5D14-B795-36796C40660C}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\ = "IUpdaterAppStateSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\ = "IPolicyStatusValueSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\1.0\ = "GoogleUpdater TypeLib for IGoogleUpdate3Web"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "{15E16AEC-F2F0-4E52-B0DF-029D11E58E4B}"	SearchUI.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4e = "Microsoft Zira Mobile"	SearchUI.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\ = "IAppVersionWebSystem"	updater.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2896 NOTEPAD.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

912 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Telegram.exe

pid process

1908 Telegram.exe

pid	process
2896	NOTEPAD.EXE

pid	process
912	schtasks.exe

pid	process
1908	Telegram.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeupdater.exeupdater.exeupdater.exechrome.exechrome.exeupdater.exeupdater.exeupdater.exeupdater.exeupdater.exe

pid	process
4632	powershell.exe
4632	powershell.exe
4632	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe
4308	powershell.exe
4308	powershell.exe
4308	powershell.exe
5084	updater.exe
5084	updater.exe
5084	updater.exe
5084	updater.exe
5084	updater.exe
5084	updater.exe
592	updater.exe
592	updater.exe
592	updater.exe
592	updater.exe
592	updater.exe
592	updater.exe
2340	updater.exe
2340	updater.exe
2340	updater.exe
2340	updater.exe
2340	updater.exe
2340	updater.exe
2340	updater.exe
2340	updater.exe
5084	updater.exe
5084	updater.exe
4288	chrome.exe
4288	chrome.exe
4404	chrome.exe
4404	chrome.exe
4308	updater.exe
4308	updater.exe
4308	updater.exe
4308	updater.exe
5812	updater.exe
5812	updater.exe
5812	updater.exe
5812	updater.exe
5812	updater.exe
5812	updater.exe
2220	updater.exe
2220	updater.exe
2220	updater.exe
2220	updater.exe
6124	updater.exe
6124	updater.exe
6124	updater.exe
6124	updater.exe
1744	updater.exe
1744	updater.exe
1744	updater.exe
1744	updater.exe
1744	updater.exe
1744	updater.exe
1744	updater.exe
1744	updater.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

sv.exeOpenWith.exe

pid process

824 sv.exe
4832 OpenWith.exe

pid	process
824	sv.exe
4832	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

Processes:

chrome.exe

pid	process
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

sv.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	824	sv.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeIncreaseQuotaPrivilege	4632	powershell.exe
Token: SeSecurityPrivilege	4632	powershell.exe
Token: SeTakeOwnershipPrivilege	4632	powershell.exe
Token: SeLoadDriverPrivilege	4632	powershell.exe
Token: SeSystemProfilePrivilege	4632	powershell.exe
Token: SeSystemtimePrivilege	4632	powershell.exe
Token: SeProfSingleProcessPrivilege	4632	powershell.exe
Token: SeIncBasePriorityPrivilege	4632	powershell.exe
Token: SeCreatePagefilePrivilege	4632	powershell.exe
Token: SeBackupPrivilege	4632	powershell.exe
Token: SeRestorePrivilege	4632	powershell.exe
Token: SeShutdownPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeSystemEnvironmentPrivilege	4632	powershell.exe
Token: SeRemoteShutdownPrivilege	4632	powershell.exe
Token: SeUndockPrivilege	4632	powershell.exe
Token: SeManageVolumePrivilege	4632	powershell.exe
Token: 33	4632	powershell.exe
Token: 34	4632	powershell.exe
Token: 35	4632	powershell.exe
Token: 36	4632	powershell.exe
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeIncreaseQuotaPrivilege	4472	powershell.exe
Token: SeSecurityPrivilege	4472	powershell.exe
Token: SeTakeOwnershipPrivilege	4472	powershell.exe
Token: SeLoadDriverPrivilege	4472	powershell.exe
Token: SeSystemProfilePrivilege	4472	powershell.exe
Token: SeSystemtimePrivilege	4472	powershell.exe
Token: SeProfSingleProcessPrivilege	4472	powershell.exe
Token: SeIncBasePriorityPrivilege	4472	powershell.exe
Token: SeCreatePagefilePrivilege	4472	powershell.exe
Token: SeBackupPrivilege	4472	powershell.exe
Token: SeRestorePrivilege	4472	powershell.exe
Token: SeShutdownPrivilege	4472	powershell.exe
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeSystemEnvironmentPrivilege	4472	powershell.exe
Token: SeRemoteShutdownPrivilege	4472	powershell.exe
Token: SeUndockPrivilege	4472	powershell.exe
Token: SeManageVolumePrivilege	4472	powershell.exe
Token: 33	4472	powershell.exe
Token: 34	4472	powershell.exe
Token: 35	4472	powershell.exe
Token: 36	4472	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeIncreaseQuotaPrivilege	4972	powershell.exe
Token: SeSecurityPrivilege	4972	powershell.exe
Token: SeTakeOwnershipPrivilege	4972	powershell.exe
Token: SeLoadDriverPrivilege	4972	powershell.exe
Token: SeSystemProfilePrivilege	4972	powershell.exe
Token: SeSystemtimePrivilege	4972	powershell.exe
Token: SeProfSingleProcessPrivilege	4972	powershell.exe
Token: SeIncBasePriorityPrivilege	4972	powershell.exe
Token: SeCreatePagefilePrivilege	4972	powershell.exe
Token: SeBackupPrivilege	4972	powershell.exe
Token: SeRestorePrivilege	4972	powershell.exe
Token: SeShutdownPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeSystemEnvironmentPrivilege	4972	powershell.exe
Token: SeRemoteShutdownPrivilege	4972	powershell.exe
Token: SeUndockPrivilege	4972	powershell.exe
Token: SeManageVolumePrivilege	4972	powershell.exe
Token: 33	4972	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe

Suspicious use of SendNotifyMessage 29 IoCs

Processes:

chrome.exeTelegram.exe

pid	process
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
1908	Telegram.exe
1908	Telegram.exe
1908	Telegram.exe
1908	Telegram.exe
1908	Telegram.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe
4288	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

SearchUI.exeOpenWith.exeTelegram.exe

pid process

392 SearchUI.exe
4832 OpenWith.exe
1908 Telegram.exe
1908 Telegram.exe

pid	process
392	SearchUI.exe
4832	OpenWith.exe
1908	Telegram.exe
1908	Telegram.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

sv.exerojmhh.exeupdater.exeupdater.exeupdater.exe126.0.6478.127_chrome_installer.exesetup.exesetup.exechrome.exe

description	pid	process	target process
PID 824 wrote to memory of 4632	824	sv.exe	powershell.exe
PID 824 wrote to memory of 4632	824	sv.exe	powershell.exe
PID 824 wrote to memory of 4472	824	sv.exe	powershell.exe
PID 824 wrote to memory of 4472	824	sv.exe	powershell.exe
PID 824 wrote to memory of 4972	824	sv.exe	powershell.exe
PID 824 wrote to memory of 4972	824	sv.exe	powershell.exe
PID 824 wrote to memory of 4308	824	sv.exe	powershell.exe
PID 824 wrote to memory of 4308	824	sv.exe	powershell.exe
PID 824 wrote to memory of 912	824	sv.exe	schtasks.exe
PID 824 wrote to memory of 912	824	sv.exe	schtasks.exe
PID 824 wrote to memory of 4156	824	sv.exe	rojmhh.exe
PID 824 wrote to memory of 4156	824	sv.exe	rojmhh.exe
PID 824 wrote to memory of 4156	824	sv.exe	rojmhh.exe
PID 4156 wrote to memory of 5084	4156	rojmhh.exe	updater.exe
PID 4156 wrote to memory of 5084	4156	rojmhh.exe	updater.exe
PID 4156 wrote to memory of 5084	4156	rojmhh.exe	updater.exe
PID 5084 wrote to memory of 1784	5084	updater.exe	updater.exe
PID 5084 wrote to memory of 1784	5084	updater.exe	updater.exe
PID 5084 wrote to memory of 1784	5084	updater.exe	updater.exe
PID 592 wrote to memory of 4068	592	updater.exe	updater.exe
PID 592 wrote to memory of 4068	592	updater.exe	updater.exe
PID 592 wrote to memory of 4068	592	updater.exe	updater.exe
PID 2340 wrote to memory of 1832	2340	updater.exe	updater.exe
PID 2340 wrote to memory of 1832	2340	updater.exe	updater.exe
PID 2340 wrote to memory of 1832	2340	updater.exe	updater.exe
PID 2340 wrote to memory of 2148	2340	updater.exe	126.0.6478.127_chrome_installer.exe
PID 2340 wrote to memory of 2148	2340	updater.exe	126.0.6478.127_chrome_installer.exe
PID 2148 wrote to memory of 316	2148	126.0.6478.127_chrome_installer.exe	setup.exe
PID 2148 wrote to memory of 316	2148	126.0.6478.127_chrome_installer.exe	setup.exe
PID 316 wrote to memory of 2292	316	setup.exe	setup.exe
PID 316 wrote to memory of 2292	316	setup.exe	setup.exe
PID 316 wrote to memory of 3988	316	setup.exe	setup.exe
PID 316 wrote to memory of 3988	316	setup.exe	setup.exe
PID 3988 wrote to memory of 920	3988	setup.exe	setup.exe
PID 3988 wrote to memory of 920	3988	setup.exe	setup.exe
PID 5084 wrote to memory of 4288	5084	updater.exe	chrome.exe
PID 5084 wrote to memory of 4288	5084	updater.exe	chrome.exe
PID 4288 wrote to memory of 2436	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 2436	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe
PID 4288 wrote to memory of 3628	4288	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sv.exe
"C:\Users\Admin\AppData\Local\Temp\sv.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sv.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sv.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4308

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\ProgramData\svhost.exe"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:912

C:\Users\Admin\AppData\Local\Temp\rojmhh.exe
"C:\Users\Admin\AppData\Local\Temp\rojmhh.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156

C:\Program Files (x86)\Google4156_260075420\bin\updater.exe
"C:\Program Files (x86)\Google4156_260075420\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={1E5E5C4F-2824-A1A8-B948-33835CA392B5}&lang=en&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5084

C:\Program Files (x86)\Google4156_260075420\bin\updater.exe
"C:\Program Files (x86)\Google4156_260075420\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6537.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x254,0x258,0x25c,0x250,0x260,0x1472604,0x1472610,0x147261c
4⤵
- Executes dropped EXE
PID:1784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=126.0.6478.127 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffdc29f1c70,0x7ffdc29f1c7c,0x7ffdc29f1c88
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2072,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:2
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1688,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:3
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=1880,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:8
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2972,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2980,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:2268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3652,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:2
5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:1896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3880,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:2
5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:3092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4616,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4864,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4880,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4964,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --field-trial-handle=5104,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5072,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:2116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5020,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4380

C:\Program Files\Google\Chrome\Application\126.0.6478.127\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\126.0.6478.127\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel=stable --force-configure-user-settings
5⤵
- Executes dropped EXE
PID:968

C:\Program Files\Google\Chrome\Application\126.0.6478.127\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\126.0.6478.127\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=126.0.6478.127 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff6e80646a8,0x7ff6e80646b4,0x7ff6e80646c0
6⤵
- Executes dropped EXE
PID:208

C:\Program Files\Google\Chrome\Application\126.0.6478.127\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\126.0.6478.127\Installer\chrmstp.exe" --channel=stable --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
6⤵
- Executes dropped EXE
PID:2944

C:\Program Files\Google\Chrome\Application\126.0.6478.127\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\126.0.6478.127\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=126.0.6478.127 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff6e80646a8,0x7ff6e80646b4,0x7ff6e80646c0
7⤵
- Executes dropped EXE
PID:2544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5232,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:3012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=5380,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=5428,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5356,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5432,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5280,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5532,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4768,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5076,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=5192,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=5064,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4800,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5916,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=5508,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:2
5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=5972,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:2
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:4848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=5260,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:5460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=5536,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:5288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=3224,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
5⤵
- Executes dropped EXE
PID:4308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=5336,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
5⤵
- Executes dropped EXE
PID:5368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=5772,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:5808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=4300,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
5⤵
- Checks computer location settings
- Executes dropped EXE
PID:5820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5616,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
5⤵
- Executes dropped EXE
PID:1880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=4104,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
5⤵
- Executes dropped EXE
PID:1796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=4792,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:8
5⤵
PID:5352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5572,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=944 /prefetch:8
5⤵
PID:2584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=3268,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:1
5⤵
- Checks computer location settings
PID:4628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=3196,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
5⤵
- Checks computer location settings
PID:3336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=5932,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
5⤵
- Checks computer location settings
PID:3268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6284,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
5⤵
PID:6064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6344,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
5⤵
PID:6084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6192,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
5⤵
PID:5976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6160,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
5⤵
PID:3480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=6256,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:8
5⤵
PID:5372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=6168,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
5⤵
PID:5344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5776,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
5⤵
PID:5624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=6148,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
5⤵
PID:3064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6288,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:8
5⤵
PID:1648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6280,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:8
5⤵
PID:304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=6156,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
5⤵
- Checks computer location settings
PID:2396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6324,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
5⤵
PID:2052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5060,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
5⤵
PID:3668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=6740,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:2
5⤵
- Checks computer location settings
PID:4236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=5648,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
5⤵
- Checks computer location settings
PID:5024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3600,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=4640,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:1
5⤵
- Checks computer location settings
PID:200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=6520,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
5⤵
- Checks computer location settings
PID:4176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=5284,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
5⤵
- Checks computer location settings
PID:6028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=4740,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
5⤵
- Checks computer location settings
PID:2916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --field-trial-handle=6216,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:2
5⤵
- Checks computer location settings
PID:5088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=5612,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
5⤵
PID:5468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --field-trial-handle=4076,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
5⤵
- Checks computer location settings
PID:5256

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=6824,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:2
5⤵
- Checks computer location settings
PID:1536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --field-trial-handle=6136,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
5⤵
- Checks computer location settings
PID:4356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --field-trial-handle=3168,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
5⤵
- Checks computer location settings
PID:2280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=5660,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
5⤵
PID:3460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --field-trial-handle=7044,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
5⤵
- Checks computer location settings
PID:5332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=5236,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
5⤵
PID:4132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --field-trial-handle=6620,i,5692819042014307938,18276949546990115635,262144 --variations-seed-version --mojo-platform-channel-handle=1400 /prefetch:2
5⤵
- Checks computer location settings
PID:216

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:2452

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:4960

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:4888

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:1788

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:1356

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:4680

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:4668

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\crash.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:2896

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\crash.bat"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Boot or Logon Autostart Execution: Print Processors
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2052

C:\ProgramData\svhost.exe
C:\ProgramData\svhost.exe
1⤵
- Executes dropped EXE
PID:4284

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#125 S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742
1⤵
PID:520

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3848

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:592

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6537.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x442604,0x442610,0x44261c
2⤵
- Executes dropped EXE
PID:4068

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2340

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6537.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x442604,0x442610,0x44261c
2⤵
- Executes dropped EXE
PID:1832

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2340_1185920072\126.0.6478.127_chrome_installer.exe
"C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2340_1185920072\126.0.6478.127_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2340_1185920072\819504aa-c901-41bf-a515-a1e81b5ee434.tmp"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2340_1185920072\CR_1D35B.tmp\setup.exe
"C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2340_1185920072\CR_1D35B.tmp\setup.exe" --install-archive="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2340_1185920072\CR_1D35B.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --installerdata="C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2340_1185920072\819504aa-c901-41bf-a515-a1e81b5ee434.tmp"
3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:316

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2340_1185920072\CR_1D35B.tmp\setup.exe
"C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2340_1185920072\CR_1D35B.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=126.0.6478.127 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff68e0546a8,0x7ff68e0546b4,0x7ff68e0546c0
4⤵
- Executes dropped EXE
PID:2292

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2340_1185920072\CR_1D35B.tmp\setup.exe
"C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2340_1185920072\CR_1D35B.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2340_1185920072\CR_1D35B.tmp\setup.exe
"C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2340_1185920072\CR_1D35B.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=126.0.6478.127 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff68e0546a8,0x7ff68e0546b4,0x7ff68e0546c0
5⤵
- Executes dropped EXE
PID:920

C:\Program Files\Google\Chrome\Application\126.0.6478.127\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\126.0.6478.127\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1348

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc
1⤵
PID:1736

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
1⤵
PID:1976

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4764

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4832

C:\Users\Admin\AppData\Local\Temp\rojmhh.exe
"C:\Users\Admin\AppData\Local\Temp\rojmhh.exe"
1⤵
PID:1480

C:\Program Files (x86)\Google1480_1324308787\bin\updater.exe
"C:\Program Files (x86)\Google1480_1324308787\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={1E5E5C4F-2824-A1A8-B948-33835CA392B5}&lang=en&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:4308

C:\Program Files (x86)\Google1480_1324308787\bin\updater.exe
"C:\Program Files (x86)\Google1480_1324308787\bin\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6537.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x14d2604,0x14d2610,0x14d261c
3⤵
PID:5664

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --system --windows-service --service=update
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:5812

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6537.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x442604,0x442610,0x44261c
2⤵
PID:6072

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --wake --system
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2220

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6537.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x442604,0x442610,0x44261c
2⤵
PID:2264

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --system --windows-service --service=update-internal
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:6124

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6537.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x442604,0x442610,0x44261c
2⤵
PID:5576

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --system --windows-service --service=update
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1744

C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6537.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x442604,0x442610,0x44261c
2⤵
PID:5672

C:\Users\Admin\Desktop\Telegram\Telegram.exe
"C:\Users\Admin\Desktop\Telegram\Telegram.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1908

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Print Processors

T1547.012

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Print Processors

T1547.012

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google1480_1326702034\UPDATER.PACKED.7Z
Filesize
4.4MB

MD5
beb5a76b664bcdd667925549898ce19a

SHA1
99e3e8bb878ce92c912e2ea5451a91501fa911d3

SHA256
5b2d966e14414655ae14ce9bd050bbaf60b4cd7cb1953424b2f206bf4d5fff90

SHA512
ec77746286a3d22d2b6bd7a93034ed3700edb01a07ee542809378618da8e0be99b315e41c18a5acaaf988783d8549b604e982e7e9e82a4da1914df56ba06a1b6

Download Submit
C:\Program Files (x86)\Google4156_260075420\bin\updater.exe
Filesize
4.4MB

MD5
512a822caed80f9fa3f0dfce20d4faa1

SHA1
16f470de73681ce7ec9b3251ac081879fb37798c

SHA256
8de9266347276d18fe49f84b86f09e6035df2c10e39f22d85bf33d43cf0f5f2c

SHA512
9fc3d74dddd28b325fe3b803c1217d7374b61ae6d7eecb46aa2dafb643b7a45387caba015421da524cc0416c9b3bdbb3d871120c1275e421f86e9d80a3781802

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\128.0.6537.0\Crashpad\settings.dat
Filesize
40B

MD5
732dce7bfa1fd67ebb9389b5ecc94314

SHA1
1358e9a74692775d409649ad347e0c7e8171ebe2

SHA256
bd2f80d6bc04722a5b2ce480176b70462718a92aabcab4f1027ca3f3b1e29fbc

SHA512
c8d7ada6a8281c122c91ea7aa2c080e41a5b46ff9e6183103be12096781e5ab6d93a45396720271dbc76e7e37552e5986e1830d300973c330035d9f5bae2bf44

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Filesize
492B

MD5
b683bd66a45c6d2c2f583bb795eb4c95

SHA1
4fc2c86072c922caa3766a429e0035352cb10fc8

SHA256
780d1806603522fe445e501c97c1b3ed8128c4cf6565e052ab8649d1bb5d4fc8

SHA512
baf65e87273cf948c45cf66299cffe066841c408c99cba562d062096f29da776132c383f2ed370b33f074740d9a95cf7f41ed4f540a9162f882fa70f4683a9fb

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Filesize
592B

MD5
e7894f7165a0e3c99b97b57f45b4e22e

SHA1
3f8350745bbb100625a8b394149c4d07a270ebda

SHA256
73f7a3aba657e0ef657140e00118011697c1a36307adf2ff32219be0812c352a

SHA512
6f7ada3731eeddd7240956b808322d38c830542f0d6d01016dfd371e21fbed8579ddb14bcdde2504bf0080a5454b7a961a1c450e0169772daa41439f1d377a26

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Filesize
49B

MD5
a640ca2e70d5d86ee61c65b5fa0a5de3

SHA1
932854c7284e88d764a5f455c2559430282630e3

SHA256
143f8c59a52692d27d38a2da2d510f37237faeee74850381917768adee0975e6

SHA512
855f3de6bda41d5a015922c4127947bd9ad51b2b137ccdbef5232b2f373c24b7c99f0806466c1cbd49387a4d6984f10f71e69dc7ab9a9274e4ec1d376758cdf2

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Filesize
354B

MD5
2284e51f10d336086e1fd4147567d52d

SHA1
62a1e694dce8ceca5b6ebbcc35298ef2f1cfebfd

SHA256
781ff17406014aa6def5974c7bb33a97c1e504146dabb610c5d390d7ea416a4b

SHA512
480f6974b0f88b0b794b32693edc7613d21098a57195ec559813368b2be24923eb4d62c5272c03cd8a5c2300d4ec62abe8995a230f5663b6127ec760e0d163d0

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Filesize
654B

MD5
998a7c8795e9222e02d52f72fe433721

SHA1
809c31048a187064c7bdd51fbcb2e552f9e7415d

SHA256
f47253dc70cd431281d6433707aa8ce10262b5be17da6a422fb0c8e2a2719ab7

SHA512
3063154a7b67329a708df86053bd0425ff49d26c731cfc2a897655d9b731e01f18c0201da7ca5db8810a2f331b67bf792230324dd13ad0959405d9f695ca8ce1

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Filesize
592B

MD5
ada77c5ab12620d3937ec0d919bd204d

SHA1
632ef335172fdb18010ab4db2733367351014b92

SHA256
c3f54e88593c44bc61b05772ddc629cfe2651acafa471aa2a0e9aa1459582be1

SHA512
306a6685bf4ee4a024a1b9ad7128fbdc10753a2b851eb4ebb631c56f73738cc4e7f8578c85e634233c43d90352a731927f260e70f35cafeb4dc2647d40b4d8c1

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Filesize
1KB

MD5
ba8029c9602e8eac4ee3b7a35719b017

SHA1
a196b60aed7f1445e2307850055ddf6f07f0498e

SHA256
57790befecd88522d4039e99ea4b6a6709a6711e4e6ddd8e1f95ddf8c940a084

SHA512
7f25cdd58f783a7ee23d73d73f4d02344a1f1937c53c4242a9d7376810a3128f2f253698974252209de8ec2bfe8bc6ef220989ef5cead7de20df39911e64c6af

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Filesize
744B

MD5
57c95772c0b10f87377381870228d8dc

SHA1
e9cc55872b0dc5a7205afce5d0593e78ccc04411

SHA256
1753f9185864e62e8305001a176399563afd24e3cc17e1516ca48d497dd656c0

SHA512
228f9dabc556929428395f76a5da37a7c0130b4ada5762763e0c5f0c170ab59b353c8c17efd9f9b04132c660f9e37be70676f3cf4aec969befdd599afb064a17

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Filesize
421B

MD5
2d47e43cef67c3b1a60beef13ad68534

SHA1
2e5dc24b0a3659b04284f1aad86db4d484f9a807

SHA256
8769b7a2dbeb3e6935e3f08fac6b1772bd9b71340bb6425ebd7326cec9a78c78

SHA512
ed60d3a683b4bcff721526fd2f890f14a814d628a4162eac3e458db0e4703609a9bed4a0fbf6ba16f9074b34eab9f5fd4dde446e81cfbefceb1a2919547f40e2

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Filesize
1KB

MD5
e2f8b01b322d3583a7b57b848b2e381d

SHA1
8bc91ab72ea4f0997ad2a64bc0afcd497f14d46f

SHA256
f127a64a2a150053049a6bd65abaf8ae51eb19df9f266f6e3a2b01fd5c33cf5f

SHA512
078a7dcc2fd11c24391c7973632f7e75b29e2f147416a81d481480c6d24782be8b12d76cb96527d18486c79e7acf7f7b27b3c820171cb96a44b04b3eed11a7c9

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Filesize
4KB

MD5
1a659630ca5d2a009cb381bdff08b6ca

SHA1
9f5149150e53872f5411d2308db7120271500348

SHA256
6251150b4214536eea1415eef00ba7d92fad1d0702150c7f42fad97a119cb1b9

SHA512
123069598552fd9086ee7f05d4165e9e70a2fe27ebb8d1cb2975f770832d18fe24b411b6c0f3fa49b9ca511b3b69bc60f1d7d6d1688500685839c0f6fea6daea

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Filesize
4KB

MD5
10724a730d022f73fee9469a08336276

SHA1
50d2dd7711aa75203403ecbc30eca1a7f856fd15

SHA256
2fde2749c56f20c04bcba2abe5ff4b18aa5cced4e9b0415d38b8e6757533d705

SHA512
dce2a0201f235cafc52b3f7b305bb1435e64240ab70d4d7bdbb4e3eb8d1929d9fb6a0432f9546ee95891b1c5814d55a8026ba02826b215d3b134ec7a2e126fc4

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Filesize
9KB

MD5
53569f4d4f766b76101512a29c93651c

SHA1
6647f2dd1320d7bb8b833114ce8d153d69c15ee3

SHA256
059193e07fc6a6395ca5565c581c55e9908714c61b3ff6ddad2828e54733ae7b

SHA512
12cc82f2dc24f23f4f7d96189ad13b9e249104fc947b8305340f6ad68e62da6d8330ce4cde1a046f58938699a0c84ca916f56ae1737448ab9ce7a067f42813db

Download Submit
C:\Program Files (x86)\Google\GoogleUpdater\updater.log
Filesize
9KB

MD5
b2fd0e93e001bec5cd2edf90ece2d9a1

SHA1
0edd37534470eec4e2c38f160c4ada5f813cb184

SHA256
78ed594b20e2d23f0b46ed8756953077140da0f99775a3b89ba5f3fdf1c38aff

SHA512
1d13f077df1b2c011f01d6d6b0f9be8893d18dfa1e42496a63c49a3d594e8bef5c272a73d56ee4ffedd31f6f81a195040ee6b7dbe4b9a156202a0b6bc320b5f4

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2340_1185920072\819504aa-c901-41bf-a515-a1e81b5ee434.tmp
Filesize
652KB

MD5
44c7f06f320e8068a00af6f8930c0511

SHA1
e68c5ff16e0c28a2ec146198b96bfad291743c4b

SHA256
c0dd8ff1c80385821da0fe5102b40420ebe4b476b5832382553dbb6d51ae33c9

SHA512
82343ada963b593fce6718b9d460bfc7d359be629de1b8cf38dc638ba30495d0b5d271d658a9125fe674fe5b3375767e88ce7d8ae6f23d34f89e342d796aa644

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2340_1185920072\CR_1D35B.tmp\setup.exe
Filesize
4.1MB

MD5
0849095a80f74794bcac8b3561fc4a58

SHA1
5b27f31892bb7b04c62d3b1f612a45415a3bc32e

SHA256
27dbc6e6ac8630b50fc5473e9a7f341c7d759806f762aa522698ec10bf2f2e62

SHA512
1f52e20fc2812af55e00b7aea59b00af262ea87bc7b652504a3be9b26e500fffeffbed52dc21132b22645f46f2a59f546485e9089e7cfb5f0154041918f52e5c

Download Submit
C:\Program Files (x86)\chrome_url_fetcher_5812_1592711053\-8a69d345-d564-463c-aff1-a69d9e530f96-_126.0.6478.127_all_kqgvyxebv4r63jac66435t45xq.crx3
Filesize
17.8MB

MD5
1e0eb42893b833c974801576b66ef93e

SHA1
8a066be6eb2426f5d4606a64297fd9696d592b6b

SHA256
ec2e98640751b41654ecf93bd49961e12f10c8b1fc536d85c82a572cddbf18aa

SHA512
b4e652c0714639b2fc6f3633c3dddf256d7af072acec4865f4e2715fd94f0b603f4c6a214529d5b4a674ca498d7e3cac3055f5be3ac0f8a42c134c7b7361bedc

Download Submit
C:\Program Files\Crashpad\settings.dat
Filesize
40B

MD5
03cf136df93cf895a382549fd926c6c9

SHA1
7ed11634cb254a7526def573c1f7f4ce4fa3a7c6

SHA256
c673bac9c8a326764a35069fad4d052183c25ab0efc7a385440a8136b6e29f00

SHA512
77b3edb9bb2c2aff9bebf413b80feaf034deeaec8c6bab4d05922f626e6b04e5ac587126f448adff01a6b4f86e10e4e485b80665d3601600a18f2bd47221d276

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe
Filesize
2.7MB

MD5
d09b0bceaaccb0b4c2fc6b95b9a5241a

SHA1
5ada2eddc6954dfc50aff07276909866418ce799

SHA256
13e2a3b4ddff74975fd41b9a1d4ed57de5ec67c0f377791dbbba5c8402690eb8

SHA512
aec811b8ae222d21108fff90c501278cfccc1d76f4b01469339f08f09514ff31d508e2abec7ed3c53e196f34ab73544be969e5e284a220e0206d680d8e602ba7

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4288_1061877648\manifest.json
Filesize
114B

MD5
4c30f6704085b87b66dce75a22809259

SHA1
8953ee0f49416c23caa82cdd0acdacc750d1d713

SHA256
0152e17e94788e5c3ff124f2906d1d95dc6f8b894cc27ec114b0e73bf6da54f9

SHA512
51e2101bcad1cb1820c98b93a0fb860e4c46172ca2f4e6627520eb066692b3957c0d979894e6e0190877b8ae3c97cb041782bf5d8d0bb0bf2814d8c9bb7c37f3

Download Submit
C:\ProgramData\svhost.exe
Filesize
63KB

MD5
c095a62b525e62244cad230e696028cf

SHA1
67232c186d3efe248b540f1f2fe3382770b5074a

SHA256
a5728f8fd33c77818782d3eef567b77d1586b1927696affced63d494691edbe6

SHA512
5ba859d89a9277d9b6243f461991cc6472d001cdea52d9fcfba3cbead88fbc69d9dfce076b1fdeaf0d1cd21fe4cace54f1cefe1c352d70cc8fa2898fe1b61fb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\596fe3aa-deed-4a3c-bbb3-3ec48eb057bb.tmp
Filesize
15KB

MD5
3fda616d5110161dc4cd8e24de2acb0d

SHA1
6da1e353c92af406160fad367ca020a9057da027

SHA256
d1d23f0e5c95464c0fbbec0378e1ab3ad9459b8791edb08a6973b30cdfaf0fbe

SHA512
b27ad9d9f9cae2ef1960b8bf6c546578be1d030795b369a78629f8cc41aec9a8817bf13f561ee62a273365006fade72c1ba9c2d39f625e9bff86889a4a6665b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Filesize
20KB

MD5
fa48a92b82e67564ef7e05cfbf5f7c06

SHA1
4d0c5b13a050a4b91da5a654b7ff712436142b57

SHA256
2d29025bba0004008342ccba0314890458567fc8e75643dd102faad0d0fcb761

SHA512
88dead8b16beccb93f9d65bea27374301a87262dfa10564980ef64027302fc91555488040b14e79f244d9926f3ba3ff120bf9c6190ff5dbcbf5c5407a89f9154

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Filesize
26KB

MD5
2722645954ed477e385a68987d73e896

SHA1
a93b5c49889e1ead0f09149b26771abc6ecd640c

SHA256
405070f185d598bb95980757d54c0443ec51608fa99f1b1826afafab429548e2

SHA512
c3ab6d65b5a83ee265e23ca66b2850601e2347fbd47158abd6a97541c667d40313f1d84fa6a800b83417a5435131364cb851b40bf3bd8c401725a2a2de12b54e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Filesize
50KB

MD5
73449a2558f913819fe5574946456875

SHA1
5a1f5b2c0b36475cdec8fb453b7db22957b21fc5

SHA256
886d4534e86fba38826123bcdedc804e4d29416d40223484352dec60c076bc31

SHA512
f2a393ee03f3a8585c3a00b877099b9160024b3704a1861f7480a3315a90640deab2953f8400996903d2b70c99296601c63aeabfae39ce5712c95c526e2c48be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Filesize
43KB

MD5
530346ba784698b25a911f970f7180cd

SHA1
fdaa9d415eab4d801da1bb70ed9cf3f2bb0d33a5

SHA256
60b6831c8eb3a3afbf8f53c2adaec2887f9a575cd5f7ac8290de4ed7ba5c0fe3

SHA512
e45bfdc6f2bece29886b7d2fee8da54fa53db3577e96611fa4397b9d1bc4e3f5ba21f34232f415f8cf4d6010261fdb33a16608b6d936c6014449c1d76f06d754

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000035
Filesize
33KB

MD5
8af49d7d1e2c47a8f4d69c1e03c70b2b

SHA1
7d59d1c170dad9af31d328a0a96ba61b96db1446

SHA256
4cb6fa4953b993c9172b1c1f6fb03d23346c1181b08b8e57f1d7f61750cc22e2

SHA512
67290e4ed118f08c10b55f29b2ecb06ebb5aa3b7fe3ba979b5ac6b5d26e51da51a19fe3c16a0b3b3fc09711f34be1407d7cd233db51879802fc968491b5d64c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036
Filesize
59KB

MD5
776153414e02d5d56ce2005feb1f2046

SHA1
78d85185b844f256e76c1ee557b64885b3ff7f05

SHA256
efe1f5d882c13b0bcd75ae2c7582929ed5b89011b58aacdcf9cff5108df48a0f

SHA512
feb08766192b8f20eaa3910c46ae0cac9543f126048ca1a9f0688e0d6353ab42421ec6f04f23879525ce187147bc221962902b4e705c2b0e41ba2e243136062d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000037
Filesize
17KB

MD5
854e4b0072b8fdd48c3374d6dd47fd1c

SHA1
f6b76f85a878bc72d0b8c5ab897cd89efac94e78

SHA256
44391250513388cb67b990b80a0469d2a83ecd77fb62769cd8e582f300f4d75e

SHA512
c64febc1e388a7c1c5bf9403d7a0b58c347a03c9d0cd048f72377da269eff7567081d5dd4e6867fbb3731f54854503ef71225f8f5dde4372a6529aefe70070a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038
Filesize
27KB

MD5
046a2ed1439fc1306d05e4c2133b149a

SHA1
2cd9f7273078a5ac97f43733a9c4a91f48f5a6de

SHA256
5c408ef8aa598dee600accf3d520584c4730585e3b216982febca31ef29f4f23

SHA512
92335ec3e12cfa978454cea4cad5d2b81d50e456f53cf75d7e4a30715cb093c44746ccf7f88968ae331a469a1998508c14ae0f670c0aa15b2a77fec12945239f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039
Filesize
17KB

MD5
42d18b064002ba46bf9fab295eaa3fd1

SHA1
94f2c37d5d50644c95ab6b4727268a2afa4c914e

SHA256
f83f906db90a63bc8188321b25c71fa0d12a7ab8ccdf0548d543a8d981ae5dfb

SHA512
47f4e3747f21a473ea3c62d359bf380c2e9347a72a736d5c469cd4a508fa6fbdc1902feb3fcf11321ab0baaf49fa1837422716a447d53d3d4da59c8fa674534a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a
Filesize
46KB

MD5
d0bda28078ec656c9320d955570468a3

SHA1
adc581fea6fb411cc4a014c108f8a33e3f56caf0

SHA256
b261cba391ecf7f65df1be6d4efcb0b241edc830d4c0ede4fd6374fcb1518f62

SHA512
29206894c9521e40ad931f0db6d39c6dc910ecbbcacab83cd99bc516698b3aea83c3077fb9773bf00ebe54ce2798b3a18eb2be168352f656c71443d05ed1a393

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b
Filesize
24KB

MD5
e9fa2f28bf574783315e539e385fbf5c

SHA1
2c3c4a7f2c38ea49402fc3c7ae9615a3d0467c07

SHA256
a8359f8296aaf50460dcb28b3eb34173c0a320ae86c48f2c92b12ff8e46ec45c

SHA512
b7e564636b703b053d084ca84afb16a015492a36a9513faf90611a945eec3e0006c3d7254d28b509099faad0fd0b7e393ef0834d72d466fa583ce440c758e363

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003c
Filesize
35KB

MD5
acc5eebf4e86b33025526adeac444281

SHA1
b68f903a3854eb5d0d34de16ddc0798e64b2f089

SHA256
37e613d263c725061146a7031ed75544f2a35ebc7ce06c48188e1b47372c1a69

SHA512
f50428ef73c5beea1a1149ea1801eb2ff7891748d29e82da8a03ebd1d9295855fc09755de2c6fdf0a6b2726707c993ec614eac4c432e207b4c904f0da6e4d39b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003d
Filesize
64KB

MD5
717e44bb4a259b9ee4a600bd4f2f2372

SHA1
f08b1dd3e44d5057d6cb942febd1382969f9d605

SHA256
45714612acf08d73a7b594609387b1547add832ed6289a56dd355d3d41199525

SHA512
4a9a93d7d66dc91868ac0d330a645a6a08d35995642888e553ea3390aeb4b783ee9d81eb2b7a61943ad1f44eeabf1920ad33a407a8f4b37e29e6fac9ae03de8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003e
Filesize
121KB

MD5
e57cf83a266861d9960544b652a24ab7

SHA1
bac9b4d8c296d77dde6672d53652c458033ba628

SHA256
80958b3e0fa5952765a503e11f79dd10bb1bc21ee39cc9963d19f4b0b6673e10

SHA512
bf6bdd83a1dd27c102719128d31341ea08c7ea02c1f6ea79bcc7ff5b244bb4becbb2d60120b658f8ae7da3d2c90da976568ec2d3f5ed201a7cf77b629c01369b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003f
Filesize
86KB

MD5
43c2a3da2301435de3afedb25ee9d782

SHA1
dca110ee843e4d38bb812e726571ffd2782e82ac

SHA256
de22aaa1f8db57c004a665f800465e41904034857b514d44499a462fcd5d3190

SHA512
5849c6e41c09e6059a1e05715df9f0d82bcab660b3ccf58ee8bed381d16565b66aa9223ba5980346d8772167fbbe5ecd40dca0f39491c74b03a1678d41899d2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000040
Filesize
207KB

MD5
1b5f7983782bda46c61c182fd54b75b0

SHA1
0f69445acfb0936cc2c75806abfb8c823fcc3b21

SHA256
aab58a4a479a748ff0795f06191af81f8b76facfe3af6d11809df510101f2f82

SHA512
e13f48ed1355dbae70d2e87c3858febc98d1f280168377c44164d63fd6cd853afbd5a6889044609d8d46955bf1131580464be4b3bc83468e21d794b901ea7cf5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004f
Filesize
41KB

MD5
cfd2fdfedddc08d2932df2d665e36745

SHA1
b3ddd2ea3ff672a4f0babe49ed656b33800e79d0

SHA256
576cff014b4dea0ff3a0c7a4044503b758bceb6a30c2678a1177446f456a4536

SHA512
394c2f25b002b77fd5c12a4872fd669a0ef10c663b2803eb66e2cdaee48ca386e1f76fe552200535c30b05b7f21091a472a50271cd9620131dfb2317276dbe6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007a
Filesize
16KB

MD5
7af962c6491cff646dc2dc83b8c7ea85

SHA1
77c57ff99502adc6c60337e4cf2e80ef39aeedb7

SHA256
45d37f9cd0bd140b7e71d5966c090a8cbb9f57bdb9ffd7f60c073f9b3e63f038

SHA512
231eb4da85cff867b0e17436ef706cc86481c8bcbe0a168fc308e08cc6525d7f07c9fa7e64170cf40219229214c17fac98b4c67673537cd1275067177f0535f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007b
Filesize
20KB

MD5
94bacb4154eea30a19c8ca7889041cf2

SHA1
0f535d558bb01ef0a76eb66d7b5bb3c478bfef3f

SHA256
2727164c94571c63b050a514acef534054886ad2151096c534d0e61a8679c404

SHA512
e437c0fe635920a3b27411af9d27e757a17f4e04b731c3b896e0371755bad09d46a7dda1cd7eab0555631223eb21748387fe48f4140c5478a7f20acdc2c26a92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007c
Filesize
40KB

MD5
2ca8245ad813777ef886b78118e2882e

SHA1
def4e50b126d09fff51da2c9cebd7a8e84c1ff6f

SHA256
03065d8475bf56d7dea0a5e59d8027034cc47135912b4c01c14b8b07c6b1de4b

SHA512
088a7a336c759b929a4f40aabe097939be6ec939c6e98873be91cef65417ae95f48887e59bc0560ba472e9c8f54daa4710e26d0e139cee0dea96f15b3c3ae5f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007d
Filesize
24KB

MD5
967e491f02bf6ac1ff26ca2251097a52

SHA1
ac6d2efdcb83b32fa20078861e3aee48d68e6984

SHA256
17bde09aa4ebd8a55b224768a989cfa59ce38ca650069363d269af749d6030ad

SHA512
8e7179a838f0ad73c7137033d55ed9c2b5957fb02f5c7d2e85ccfbb3c83b706847c6b8bd817b48a9a6fc681beb0412ccfa78660c0e80e747997ceed2400604ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\06ac6427389d62ff_0
Filesize
266B

MD5
5079fe5cf4e69bc6d6a0402886adfce1

SHA1
cc14da2558d90793661cc8271b3e1117ab62ffc5

SHA256
e333a7cd8272ad955b9cf0816bc8bdb6622543ec3a5a35895a3f46f49e11b1da

SHA512
6e1248500189ac57992dae02cfbf3995df6bdd82ed945b6b115833e59f1eeea071f48e3a8a56df493e892387cd664db666e931c7a8a12fdcf06b3d37664a6d30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0b9d13a51a412d4c_0
Filesize
513KB

MD5
7817ebfa9d3c969505d9abb255e6a857

SHA1
3df359cee95396aa0410ad1561b3ad077646ce96

SHA256
9a012041d97c5adf0dcd85c1df70d820d098736c58f8801d06e0777866e5c252

SHA512
51ac3d647cd551b90ebe07da763fff9eb91a069656b040a07db324f43def6f83c355a517f11004050d6129aac2664d0f0d395874b5eacaf8ba7628134b084c16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3a139f5d02f4d6b4_0
Filesize
262B

MD5
e52f4c1832583df6b841d8938e74d63c

SHA1
e6e50184634930497aa1f838da343145b6795d2c

SHA256
d161c3d080b21a607c2acf4aacb8ba8fea143255918e8c7f6a520cf80f0ebcc0

SHA512
09247bc16fead3f27d51e059f3ee09a6f825c884563c084dfe378be6513320847b15bce84581209b024974e4657bc4a1123237fd5f11c786c625ead2e07edec7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\4ccd0a6cf2b6930b_0
Filesize
30KB

MD5
79cb541a04a9822256247a3dc43f1c72

SHA1
f880f5c6d110fb2bb278f223157d8af906aac3b9

SHA256
7e4df5946840b4e86fcead166174891ca9699f63ff8c8b0cd1abe4d4dc945da7

SHA512
8d9114b7e0acb0d5d674e2d150598863f902603b6a7db803dedcf83c70f301830284103c1e494d83fcae9e8376e436dcfe699c24baed899bc355b39fd4fefde3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\6902fabb37380ee7_0
Filesize
124KB

MD5
19d9212cf2704b871caa05fb529a3468

SHA1
fa382b3227fe0c09688e6c253bb2f90d49929253

SHA256
41730521ad3d8f2eb1c8b6fb6d1e6fe4272567304963d194b8430b6365792b0c

SHA512
8f6a1e339435daf2fb12e65b3083568568b3a0888a3235d8737868fc50be71e4742f134a2c00791fe1dbd30b77b88f97d48df9911e606edf80c2edfbde6f7a7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\73efefdaed893a47_0
Filesize
141KB

MD5
7e493b358a9a2f55b48aef0879ec82e8

SHA1
2f9c4b625f60ebc63b5fc85946d02b0ff8c4f95f

SHA256
5fc5dcaadc69d46df6cc1a7023c4a73f052ca7904047aa53a063d0ef1e3a0a3f

SHA512
c066113221e0ba6ab9bad6767386a8dec93590c0d69f0ca807fca7563ab8962f75d8674c8911532cbefdf07e7dc65ad8009dd3f3627a3e2dd1a4a995d472a61b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\9c2336377be262da_0
Filesize
262B

MD5
e515abc7fd7a46dee6f655e712e05f07

SHA1
096005b4a204e0d06ac983cf6ea26daa1ae1044e

SHA256
e95a3c1d8c470f888648a73c4648fd9a5df5133cede4613b295145e1ec84d168

SHA512
bd155338cdd436245a21cd9050e71fe903b9bd50f19fbe86becef3044365a986c0cf6f6e4985b924b6cfcc6237807bda6ea6dc26497cc66f814593238cc643ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\d0a00ee860d2b416_0
Filesize
145KB

MD5
a93fb6ed8bc8ddee101a72dfccd4f755

SHA1
35483a463b8d16e61bda77087b7d0bcb69e30f48

SHA256
635759e3c8ddef4cfbd500f51de43638c1f501f95d292868d5e8c93dd3241250

SHA512
eaa295b5ea627851906e1e1d5a1e3dc45099adcb28e8b82b3a3ab7109cce9675ca45ddea463cf5798ff00d033c5e125ad7bc9a5a0c73c8b32456a03c7c485370

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\dfa2225ec508f057_0
Filesize
285B

MD5
4a33b20e3efb90e698323ab1c402d6a1

SHA1
8c52baadb14ae20a27a74c1e8d8108d18630400b

SHA256
873d1aa0f96578eb816264cf54012e9b2b7f5f14de0a2630abfc8819bc7280e2

SHA512
44e6d06bb2b3898ea4ddecdb706e026a369adebbaf42a66805e6e38fdc199393dc8b476a1958deb68f76380348729144b660c6be6ec0f31ec5344e2e8ce68d5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\e8ab333ee6e4c1f8_0
Filesize
267B

MD5
ef0967f6dc66f864660a5dd60ef69a45

SHA1
685a3e2729b7a06ca11d75fb26e02749af6b5672

SHA256
030208ba0314b2f63d6f23f61e219c89cb63a7a234f05dd0cf21236d1abe6f8a

SHA512
b57da3f8be0764007a04e6b0ac93b9a2c8a1a8e6bd0934f715f5470008bdfc0594fae870d1146013c4e11aca57a2364dc0444252dbffdddad660b80d32bf04bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
8ff96ef3720660528628e54bfc897dc7

SHA1
4dce31e978b5d2b940cff08eeb11c29de5f04612

SHA256
dd4c8eabc34f3f14ff6b2919adba9a4e2917559d7480dceafd0459045e2b856e

SHA512
f78072b398ea83302442cad96345db112ce9c02dc07c2a6d7cdcad4405765e495b7230583a277a113495a86a8ffbaea218ff3c33373c57cee60264cee4fa6a41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
dca28b210f0ac29ed4a730ebaa82d4da

SHA1
227ec729c54d070919e2d726cad9ec9ce842736c

SHA256
16b3966acce7928ad3d1cd3f0dd5a26149dbaa3eb19191e3b7a02bf6b4cc37a0

SHA512
480d578029b564509ac78e3fdb4f20250136dc38dc5f4d204d79c8b9f53f2a4a83ba58d93412a6b7dd3896cdcc1ebb7bbe5bf71ca26060a5bb56cdafb743a1e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
e2940da84c7814a0b2077631c6ac8bdf

SHA1
1fe946d83f7a66deace7e1304d15077f2717c1b0

SHA256
71caba40b10fd7ea22a33efb8290fe26f5bd4c04674f3eeed54b7afccd7bb8a0

SHA512
6c75bf7d06c74728e071e645442158cc172cc7b3dc387c0e0afefe3eaf195cef650b1a102f42ca33c152ded46fc8cce6d7345bbc86f75e2b490f98481d09c1ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
48B

MD5
8dff667b430a8ee02dc5c5c4f78db588

SHA1
8cb04fb803cc26f35459f241734103d02d240de6

SHA256
2f613c685b906a3f3e5e24fe8a122f6cff236f0272c2f4d57114825484a34dc4

SHA512
985735d5bd126b2d53ad524a0727adc5a3e4ba0a7cf192616bbc8a74e32ecdd0ed5f2df8e3bc98409f01bd83f761c0b696c4a974a3c6aa7aebbe5732b7a940a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
e56219375d89ecc62f98920d681451cc

SHA1
acaf29941ef7703a8b315d2023392a58fa424656

SHA256
53b6086c5020e5784b25a2cbab74f5731c9de705c490568d7fdae48020aa143d

SHA512
b79aba4112ea0970875adc9a4b9bde0ab8dbacba57f3d6c04183646666a303ed0cc41cd4a3b068f53a22d8142507f84b64350cfcafef8d90094e3c71fc8cca8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DNR Extension Rules\bkdgflcldnnnapblkhphbgpggdiikppg\ee7e7b09-636d-4a8a-be3b-679e65c45a90.tmp
Filesize
377B

MD5
512f5824cfeb3f4f19dc74cd71a6f4b5

SHA1
77dc51a2b6b7234cdc95e775a0d8106d0c4f7a26

SHA256
e4fda6d184e7a9baee54312dd565da850de1891ec4daae9d93594bdc8e5094de

SHA512
2fc2941df4bebe2555220ef522323a407e7d38f233a1a0242517c69b2ffd65a7b707e822bffaa341f320c22bb95ec6e417ae18845c68a0b4cd0491e821319238

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DNR Extension Rules\bkdgflcldnnnapblkhphbgpggdiikppg\rules.fbs
Filesize
843B

MD5
81e1b0c51cccd55a5f38c31b58bef2cc

SHA1
637573d78dc956b5dfe4e3bb7e7df2471b778660

SHA256
6a938024c49d4fb8281e7f2df99c4674bba7f770cde532ecc3db3c23dd864c64

SHA512
3d86afdfc6d240b16a58b0d14548c50bdeafab46ca6b0173ef318bb0964e1fce15bb6629b9ea14bffe92abc55e88882ea6ff8675af7210ec0f6d35762c1ca06e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DNR Extension Rules\bkdgflcldnnnapblkhphbgpggdiikppg\rules.fbs
Filesize
1KB

MD5
bb75aa473028f9a38d1e3be324e6114d

SHA1
13ff26deba36f1e9abe4801b32853566759984ee

SHA256
2dd703ab36f85f92465c2ee831cb8e1d4ce49617cc3eb9df0ca056982bb220fd

SHA512
45e29676381b15606e6dc43497d19630deb724039a61407e9609271283c1441f0e4b3156b01efd4aef81b7c28638014e02230669ff82208ddff656939dcd2d56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DNR Extension Rules\bkdgflcldnnnapblkhphbgpggdiikppg\rules.fbs
Filesize
880KB

MD5
5427c9cc459309cb18ba5cb73f5110c0

SHA1
586d32c7fa363c9fd4a8f456801a3198351e16f3

SHA256
d951188521be8c2dbd2d36dcaa7abf25a54e484b8bbad2e2d0836061c35233ca

SHA512
1b0ee110f683acbcfc96ff247c3d7c531833b5bc3c66bd33b28541f9e1e8270e371d79ec31b30827ef76f933b1b5e8ef366d58741c54a2e8639697efff8a8e7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DNR Extension Rules\bkdgflcldnnnapblkhphbgpggdiikppg\rules.fbs
Filesize
299KB

MD5
d48f470362a1bb3236404d7a4498bbeb

SHA1
40aa97503bb7a6aa9ac04e954501bffac9c2d9b9

SHA256
9829cf79329358beccc8b31c08f3fe62fb7831390c5f84f234b730d2eefeb8b3

SHA512
3783b56b00f7be2632489125ef22231720180a69f76703f9a9569e1fc5137fcfd5989fefed4498e5392a88505dcfc180e6e141faf10f249127d43689ccb86d5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DNR Extension Rules\bkdgflcldnnnapblkhphbgpggdiikppg\rules.fbs
Filesize
66KB

MD5
c2ff5b810182a074ad2a684b07cc09e7

SHA1
b2677037d9fc6e12d53c7af2947a098f9c6569de

SHA256
51efba9acbac7254262016fc581e6219e186932f89b280d01a71cd49be9459d5

SHA512
855f055da8ed1c085e8a9d3af1337b0be13d7acab7fc0019c28d78745ac4c7c5a85dbea84c6bced1834c4cb2aaee5d4a01d1da7630ced8ab674e8d6023239d57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DNR Extension Rules\bkdgflcldnnnapblkhphbgpggdiikppg\rules.fbs
Filesize
880KB

MD5
2b1fd9ae14dc0865a64aeeb25ba11980

SHA1
38e10a00fc305f77c18faf1b55b23b34fc34c0c3

SHA256
c33ead2a1765316785861aaf643d0bf3d0b45bda4876b637d15a4bf10b4e4aeb

SHA512
e81ddd545b42d3292ce3ef2c12154b739a5a826a0697ca4fac197633f6f26a2d759e8baa08c341d2ae0cc44600085a46dde9a525133fdd629573351fc2f5fb94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DNR Extension Rules\bkdgflcldnnnapblkhphbgpggdiikppg\rules.json
Filesize
672B

MD5
634ad0f36f20984dd85c02dabceb48e9

SHA1
62e64b904db42dfa6aff8e0412e72d3a2a6a36fc

SHA256
c131d98fda9f538d1fd05b512846f9e98c5929bf147d76b4c642cb1e22e56b51

SHA512
7c6f0ec6c4038d049b743ce7dedf2ee0f6cdcf47f4a0235a2264e497b6e12db2aa18fbfb389386799d415bd5cc71559fc584832740e948ea0e146cbfd812d6aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DNR Extension Rules\bkdgflcldnnnapblkhphbgpggdiikppg\rules.json
Filesize
1.8MB

MD5
9346734036f565c9766a498587883306

SHA1
fa0ff58f49b36e3f33781ee00be30838aaba8737

SHA256
0cadd2f8cf3eb3b2fe901e51b7d51d46af540cecbd57ae701de8f47f43181c95

SHA512
267cfdcb348b9066df77d9e189201c027eb98af247e2793a9da6b2c24b93a8a8bc3219b5955f793bf1b03143e8bcb2eabe20280f3c0ee013053c5d5c09184017

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DNR Extension Rules\bkdgflcldnnnapblkhphbgpggdiikppg\rules.json
Filesize
77KB

MD5
de6dfabf9f7f24d90c72fce575ac6f2f

SHA1
1209e54a813546648d6b34de085d047c309e1c14

SHA256
6e3da426ecd93c2cf08ee1ba883de375c6e7dddda3a4a99601d748258a4aa369

SHA512
d89bd7ac74732170a28d9245bdce12311d01bd9554ee6e08572b268fe035b30a18cbb7830ac122f5f52aac4fd3cdbdc32dcfd01c7478e06d0838884069300355

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkdgflcldnnnapblkhphbgpggdiikppg\2024.6.13_0\_locales\en\messages.json
Filesize
352B

MD5
66938df7acb239bdfeb3117614090db9

SHA1
ec307ceeb5d88ea7c1ac2b54c625f86668e047cf

SHA256
97a48a908a810f39c84c3b415366953256747ae939ad8f02bcdb90cd9f147dd8

SHA512
e99c30559b9c8042a0a531b7f44b4b68afe7f2652784f921075f8bbd2fc0ffafd45760237c2241d44b6796b06b379ca0fc14f9a358d79222d71f3ba33c304e16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkdgflcldnnnapblkhphbgpggdiikppg\2024.6.13_0\data\surrogates.txt
Filesize
887B

MD5
8bf1f49ce68b50d0d2a4f9f2e8d88685

SHA1
513d9e3b3b469574078bd3c980a52c377176dff8

SHA256
ed4570b127692c3930e7d7d6f72f19aa72f057f7555a3e51c0696ab6fcbffbe1

SHA512
ca5ef16c1f03f9c7cc4160ca7a4fe9a68b3c8c45bd795f0d4c1c6ddd00f10edaa2b745ff5fa3f14ea5cd2fd2920986369628349a70fcb22abb64cd851923370e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkdgflcldnnnapblkhphbgpggdiikppg\2024.6.13_0\html\tracker-stats.html
Filesize
381B

MD5
f7a487f96bf053da101abdd0c6872619

SHA1
5d5051dc381d9d09eea13bb03ca24cffee741bcb

SHA256
2f2c01d2e005a8d2ce1ee11197a813b26fd27c66a4cd2f527a10cfd53aafe491

SHA512
b0a83ea463e2b0de6d888b55c7877319574c038cfae8a540324847d3eb6b2008e5a98dc2b91507531e52ffe9a6a9f9b5ead9d6da732e3f2198765e0aa88530ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkdgflcldnnnapblkhphbgpggdiikppg\2024.6.13_0\img\icon_browser_action.png
Filesize
1KB

MD5
81ea56563b665c2742c0ba604143b15f

SHA1
49f31dc94f72b0a9df78fb7b45bf15d73f87c874

SHA256
b228283f63ca961b21f9215e833350db027f69bc4465cf71f1d5f437a4aa0852

SHA512
8b2e2ed774084fad6f6396bd4ead29a1f123844f1e59bfc682fb71b5c9a65b2511753c58552f1fc76a46404d7d33c738c4f45c5d657b409d100db0858f0dfa42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkdgflcldnnnapblkhphbgpggdiikppg\2024.6.13_0\managed-schema.json
Filesize
293B

MD5
4d6b9a3f83f637d66e56e6644348d285

SHA1
784b7e7ca1e86fb33d779c8d350893eb0d1b3a41

SHA256
d342b4f27c8ad9102845ccc7520564de9cc26c1a2167f4a750c8d579347921d0

SHA512
0f7c1ca7eb43f44483ef5090370e1d1f4f5f77f42fbd820e18b5e2daf9cd843292b28e30e1148edf9f853ee95a570daaaaf193de7bc09ba4524c8fc40c561fbe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkdgflcldnnnapblkhphbgpggdiikppg\2024.6.13_0\public\css\autofill-host-styles.css
Filesize
1KB

MD5
94fba7e3157c4a3a415d50ecfbc5b102

SHA1
4335e9eeb72968733c69b177fb05584f6918cbf8

SHA256
2c03f6d0bc183c569833ba5990d5b5ca858bac9495d1f813c75c8a909e30c46c

SHA512
54a17a10f0ed0a8cdc78546bcb9bc0355bb4e6005541ddeaf1966423c9b6c66f7db47822d6c50451826e386d1515ea2eacdb3e1a44ee6b06231a9884346b0e63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkdgflcldnnnapblkhphbgpggdiikppg\2024.6.13_0\public\font\ProximaNova-Reg-webfont.woff2
Filesize
55KB

MD5
747b87424b5c2cdd47269446e6a32532

SHA1
82cbac08c2be6913b18224a2f435bb8b90164c8d

SHA256
783f52e4a7b24c384c21730458503ef90f63cbf1efabe846f4ada1912c907a1c

SHA512
05abe9827733d43517218915256df7554bba94b8622c0ba931ae64494229c5690c0ddaf68f4eafbec2b6c958b52eb89f5b9288961b77cfda896aaf5670209ed4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkdgflcldnnnapblkhphbgpggdiikppg\2024.6.13_0\public\js\content-scripts\autofill.js
Filesize
547KB

MD5
61cc9232a095154f2cb6639413cf66e0

SHA1
c7b64ca249904298edd22f12f69338253723b596

SHA256
31c1d8880e055da933b6b74cb13a7f2d2b17f59eeae6b42f9adea3e7110bea3e

SHA512
a7789e6cde3b86f808457f3dcd75922e3b88f4ba913603d666e845bc7347ed8100d9683fd8c978b644d4fba67dd0b88208f0b418bccccea1b90b7a925428419c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkdgflcldnnnapblkhphbgpggdiikppg\2024.6.13_0\public\js\content-scripts\content-scope-messaging.js
Filesize
2KB

MD5
d7bcf9d9cb31db7e55a0532aaa70b73b

SHA1
b99bb7187e47e8f1c7bf9ae6f966a2653e0a1ddf

SHA256
ee56f3c134e838d9a91e45cfe343d4a89647e1de0a3e01070416ad30235bfba7

SHA512
1430f5ef4d719ae3dfdc5613db0b2d6272232b2609d2441351280c8f03bc35c99a73588dd8bb2de684ad1eeb52a6b6ea5281cf94938c0710950478d47f996b88

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkdgflcldnnnapblkhphbgpggdiikppg\2024.6.13_0\public\js\inject.js
Filesize
587KB

MD5
e3c1ecc04b36cc8885bcb11977e14592

SHA1
5ecc11eacc0c95c5c16c1757b914847988f5e138

SHA256
5dc753ee28b6d3dbb6f0d772f8e0921acf62482b65b8749ada34f875b91b45b1

SHA512
a14d6f9d0ac7f2621cc4c339155f1503fc9a0332fc50c7047d95748e1261ab60c9297ff301b005e217ef236c8a6c0fb9f4a76726cdfc4b63ec61f1c5bb8935d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkdgflcldnnnapblkhphbgpggdiikppg\2024.6.13_0\public\js\newtab.js
Filesize
126KB

MD5
374ed20eab56b7707c92cfb9a41bcf00

SHA1
6a690fa7aa2688d9164bcc481f57095910f165df

SHA256
9dc59d276f1ad54826a6fe32f86a90dce1bfc5a1cf454580c311fc9ed9ad5187

SHA512
5f0c909c4becddb3c78b168bae9e03fc97635ea885917ff5ab3f529a06f338302f8452877530b67ffa3497a80ab6b94895d5f824b1daeb4c1e18b9e71ec5e91f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.78.1_0\_locales\en_CA\messages.json
Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.78.1_0\dasherSettingSchema.json
Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Filesize
593B

MD5
91f5bc87fd478a007ec68c4e8adf11ac

SHA1
d07dd49e4ef3b36dad7d038b7e999ae850c5bef6

SHA256
92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9

SHA512
fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_bkdgflcldnnnapblkhphbgpggdiikppg_0.indexeddb.leveldb\000003.log
Filesize
59KB

MD5
5dd7fb107fcf0308e8eb09fb98f37cfe

SHA1
432fbc609a670d4c8f43cec7e8edcd2adc8b9c22

SHA256
37f799ddb4df605dd12758868faa6ece0e72f4f38ea5ae867861a739415a95d4

SHA512
3d776a4399e70b1800aa5172db606bc811063151ee62d90e46ffdf6a0f748776edb18a2260d7478ff3c2b3f871de3b1bb7671a9fa1503cd7ea36398607e12985

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_bkdgflcldnnnapblkhphbgpggdiikppg_0.indexeddb.leveldb\LOG.old
Filesize
448B

MD5
9ffb688b14c995ad4427d5f7068d78e7

SHA1
0ab57d67d82ac2da4cc3c6ffb34b2ccab8fa934a

SHA256
828beb4d0028b872dbc9f1e1406dca18cbebabf10ddf5c0cc58bcae00354c04a

SHA512
e7a7054a3b7cde0824219a915d54335e2741a2789f19041ca452231fbeead40391fc3f4b6225fd59cd67e112c5db280f025d5279693a2d798d1ba242bf960ab5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_bkdgflcldnnnapblkhphbgpggdiikppg_0.indexeddb.leveldb\LOG.old
Filesize
407B

MD5
1141c1d29e66a3dc349b1ae3cb3e01c3

SHA1
02b4547afb7170a62d94d9a7606c7705b7fcab12

SHA256
409054601c3e3badc8c0a74036f0a89e47b5e1b95dd534b0973c8fee33247de0

SHA512
0d88e62285aefe9881b86696650aee859bcabf7df762b8b2b6bd1f0486fbde2543cb3ed578c6679fe8d536f74bfa9c135a7003840f416a3d6bf25d56d4709e16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_bkdgflcldnnnapblkhphbgpggdiikppg_0.indexeddb.leveldb\LOG.old
Filesize
448B

MD5
4661033b13c1d22b85d192a235578833

SHA1
70ae998d3b6b971e085c1feecd498e97c5cebd60

SHA256
6871cfa2231eb4fcca1e7b9216cef842a4b8fff0c105cc9abdc579981fb111ea

SHA512
8c96570265c6980a48b338dcaae38eafd39ec0383ba01e7df50b614ab526484bc5f011cda685eb61ab640c9153796be82ccf22100e37c2aecfe345c309f53b4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_bkdgflcldnnnapblkhphbgpggdiikppg_0.indexeddb.leveldb\MANIFEST-000001
Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
c85d32022659885cdec8b09983c359a9

SHA1
c9795b0938670845d9feb9b844f1d83b5a50d46f

SHA256
e37236c56d0f9f469b3067a884b6d500f4d5de6c74f7f6629c0f99d33acfd249

SHA512
e24a0733ba4da9d5d6d1de82436fcbaf260a7a6ad8faacf39d8813eaa610e35668a41d147d348be250d28b0de3540cf42811fd29c0e726ad3f349cf34ca2dedf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
7KB

MD5
7345c1bd371a5aaee85d1094f3ec0bd0

SHA1
d37f6eb172dd50efd8862257537676b233f84ae7

SHA256
7c1f1863d9ed025da2ef02b89e04ebfa03e0d650c74d0d56a75cf7e1737098dd

SHA512
7618c161ef48ad154aeed8dbffe0265ee664c46969710f77000f1ccbca2b01de181558b00a3a92cdc50b4f6139a5cd2e63b861fab8398c629fd3f6556276f959

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
8KB

MD5
5381b664430414538d9965be46ddbec2

SHA1
68c7e289908b192638f8b8de70c45ba78e5e783e

SHA256
b9c983483ba0bf49025117f1fe8e273fe237f30866a772518ffb6e0c33d3628b

SHA512
5d090d3c01cb15e66064f046ff61cfc7fe64b1c534c37ef6b67210ee0f81d12bbc0688369cf6c95e1e8566be8e06fabc0d014678895fd368cabfba9fdd2bd0f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
860B

MD5
44b8d50ccb5956d527218ca27a67d41b

SHA1
5ba12246f187ec916c06fae1fb17fe871aa43a86

SHA256
e3958691710e5c90f5641beaaa36dd0c5d1f23146c9ddce15bfd6df4d887dbfd

SHA512
240206ddba52bc429cbe156d0fccb373d6760bdf299c54b74dc1ef661696b1c83ebdcf7dcfdc49b770d95382657836fd37534224b0cd1a09b59d087a599dbec3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
b86379fa986b5995a80d7218fe273e5a

SHA1
85517c39ba582d1c2cf7803b9290e6282f80dbf6

SHA256
448cf6600ac5031ab8d9337bda7fd7ad0105e16cf897fcb1dadd83d9b9c6b2d0

SHA512
0fe58dad92e4c2e11e2768b851651a9c37d2086b2d7060550fd30e3f5430e005d7dda7c6c5ca4c24b174ed9aa04ffc12de489c8deab4e8f2efbafd99ddfdffaf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
7a61aeea2894fdd5c6944c8c8939c9c7

SHA1
2b97712ba0128770abda19464d0caa4a29ac93a9

SHA256
9e61b2352ca1d8d81c652aecc1d1c8026ed81ef269cac92387b8ec43d6e5a14a

SHA512
91294303ba1b148055955fce0995ed713d04815e40325ace3a683441abdb300301c386854cfe565a718440848a566fb3eeefccf71573d25bddde688019088f62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
0374d8a932a1da604abed011243d3bbb

SHA1
579986a0a78a424f97c3cc294daa80e1a776a6c0

SHA256
f471fea2d216baea82c2257bc6e9bdc057f00dd4768cd400f6d66c8065b2c97a

SHA512
e4fd4311d22440b0724b93b0d15963299a2d1a60b6c78a4536a67bce3e9769fbda02351f91269658511f6fb95514fc170c158453e6c6327850de66a811676562

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
860B

MD5
30c262568f408a2ef19b62a0b3d7c2e2

SHA1
a81602c79c42b412a25a1349dc74aba7a24585b0

SHA256
28f584459d09499fc23a46370ca083014156d4ec44c3c6e29f62516204f24619

SHA512
203d939652d9f81308e43b10814f21f950c4132230c7c4fe47e6ffaf05e9512dda28b6081dfb78e80060fc4507f78bab7da2824cfb87ed480e1be706035e95e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
0e22e03006dcc42dab894cf12a17dc9f

SHA1
230c3a330f0a44e41e6cfb104630c68b0f556c61

SHA256
8d955c194ed942030590fd7e657f8b3f5ea0f760aad27626d9d1bfc8ea2a668e

SHA512
36bc59445dd7d17c48c32cbf1884d117010236db44b67612deaa6aee69cd25288bfc503378a51d33884896fd6bea1f176a37483d5847877dac27e2f490749cc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
62b8de89b4bfa84b9f284a25e679d5a6

SHA1
6fc0b3e9f05721ce733e9939e29e824f58781c80

SHA256
29d840e9426d0119b54f726f2db1deff1ae41a6883800b4ce4ce339111b15abd

SHA512
a2526248b816da183e36eecd38ecae6b263fab640a9b39e2b3837eb5a8220608fec604049def8cfdc874baaad0d82a497393f241aed109b81d3bee55f0470a37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
34327fc9c498351d1396284e99086f95

SHA1
34bdf4bb2badb77c5e4dfa23e05838aaab4d4907

SHA256
a407fd2e780487a6b55856f62088b9f79a93eb13b767fcecd1c65dd23e12c706

SHA512
e0bb557e7d68bbf0d3de8f33d11a4138f926f0db186db4892636b2ada8249675b7177766d76a892511e6cacaca74d0c94d4513450b8a73e4a937a5714cda5002

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
4f89a39351d0ff94b69c84dd97ac95ef

SHA1
338d98eaacf585a1fdfa2c44ed9e088371706127

SHA256
c66cfa81d7349cf86f2c62b0fb9a45cf7b5de441ad8a8d0e3c4729c7c158538f

SHA512
31d712b09cb1a422769112866dcfce2d97308c515869b4694e0044593b2e7d4cefce0e64e4f37a7b6f2163ce197f0bb3f112b21ada612583e0e9350514e076dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
76c8f32aa1b92a5968687a6fa93b3f44

SHA1
fc2a2a88635706990ce2ba74b1d77bd490ba649e

SHA256
7eb26bac597844575b2a7a07d2740dfa49b5d356ce95dbb0861f6905ba5072ee

SHA512
41455788bea36bffcbcb217bed5d1ff847c1fe647b0ff8008a43069ebec829d97c12738fdf0f6c28188b1b35ad33ad5c5260895082ebc1eeea4ea62f2d681bd1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
ecfaee564eae1b0a92f4507970e96df2

SHA1
d33100de4f670c76335f0f3881bc52452cd2ddce

SHA256
b3b3252c5b63312adc792af02638f157f414360ee21a5d5e4eca185223518208

SHA512
43ccb785c95ed65436f9aaf9746e7874892ef44a60c54d34f7399807fd433a445598cc2e4a7f923699113b6d19f5c8592ca7d666a194dd178a33fcb7709f39fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
32373853cc81e138ac5d5b4ba9012434

SHA1
94b140b86a9ec34333596126d03a7b0e2b39a3b7

SHA256
a9db1b638e4aad036e71ff68375e7df5cd913ad521b55f7e3a5ce95163d39cdc

SHA512
0671161de8f900f1c597102e6e050408f811b6de99e59eb9a93d79955494ac96bcc2dd143dc333bbd75a8c7b3dc6d8e128f07b084de2a75b8b1641d0327cc655

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity~RFe66c5c8.TMP
Filesize
356B

MD5
dec17ba33af909c285c337ee5cb570d2

SHA1
5903052091ed51c9c22f09965a7d3fc357c969e7

SHA256
056efc808521508a36f269ec999e069b53e0f17623494081940a572a20b33cf7

SHA512
255fb8ab3dd0e54bdc13af58d8dd63fa8214062e3f14accae9c8248951c0fbc90b8a894d777f99b05ee74581c51fc6e12d76e449f777ea249f48dab135f0832d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
0f7eb386fe76f978fb5ea32fad6f736c

SHA1
3eef179cab01bf569b248623a231da02217b09ac

SHA256
76a66939159d076f3e5fc7541b46ed8ad690a3d54c011ae4ed7b0d318653c886

SHA512
288a14c2f74d00d6ce6ab02f1328f01fc0eed4c4fc2808c66a1e905dc999b041785096d39ad5104b185f619b6d587e5038e778fb3cf73f6a65b606a4846f3f7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
baa96ed108ee588c728e7502a64042fe

SHA1
5d1230c7d01e2cdc43098fcde5628c3d7ea89af8

SHA256
872d6a9fee1e574f480fd3595936401f12e6b5dcc67b41305fb5709c6eccf6c9

SHA512
e13eab7ef15c7df7554f01d0e7a6f26aed30b80b199c950a7545d2c4dcd0d7cf4078aa837c370cb66d950568530f54149da1a37f01e12d7afdd8f53efb7ec1f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
73986b8307321ed9987861b4f3e908b7

SHA1
38f959be0fda01ac4a9c37d44c4950d1241d2c47

SHA256
9f63a4cde0b250b3699c3da15b7fa18d1748480ba6f3da250a2ea5cf6fdb453d

SHA512
e85738dec022c8d6404ea8c5875d2d2a2b0c91a09590d42645e8ff8992cbac885135faa0baf5886f052fca50fa9d8253cb96b6d6e94b1316cb765fcfb9a9ef07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
570a7ab86cf9920a3f4391abcaa24ad1

SHA1
e6d25f4465487f0200ad170ed4896b4253113433

SHA256
6298d3e99f773fb159a311df8f58769013965a93361b40ffc525c35a2fb2ee92

SHA512
5f0c6744fa72eb060f1bbbe36d54cc83f6f659639b97f21bb39e35cd953d4db1c206fa0d505f92d4437c87eec66019cf998437d42e38fc6f9cc4960cacadb671

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
10KB

MD5
2d1b84fc62511443cf50e3b3cea9a23c

SHA1
5e85d709dc1be1b8fe0603698db2d6abb39cc814

SHA256
d2dd1977490baec34407697e37060d896ded1c86d5191cba0c235f1a8569466c

SHA512
a2a7db1438c08d7a62b6e4dcd6a1b7972ebd2132494243e82c475702c95971590ae8557101bc1f98c2a6c593113cdbf7de0ee13878088e150e91c5d3ff0306f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
10KB

MD5
8a792a9067cafb6afb54a553713ef790

SHA1
497a5d986d285f642c1d8e31d4c1b196b6315042

SHA256
e65997c952f7c6c1740a041825fa55142f4dee41f73448fe8299d49bc4af1a22

SHA512
1ea77baf81954d5a3ff6c6c6b593b2345bbbcff709c6ed5912f598bebc069c36f761afe0b498ae96a9ed66c06cef661912a749db2aa422739e465a6d8c469030

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
11KB

MD5
e468cf543caf57d15565845005936c07

SHA1
2b7338d9df0c5745809b87f9dc5397906b11a21c

SHA256
48af264914073695ead9e89ef33c70aadd889a74133870ce96278e62e214dfd1

SHA512
d03de21c9e48c787dbc61bd48a543556c0bdf51088d8fa1971aa2612f223e902b0958784b176a44b9f7783c3a12f35c7100afbf7411c12e9c24cd0bb8aee5146

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
11KB

MD5
62657db1044dd82e2b50a388cf473838

SHA1
a5ddf4374b6312268a305326a2ea1c850210ba0a

SHA256
388028e3127be3ac0cafc0828175540b71cf7c6a3dc004a5463ff1af1d70362f

SHA512
409ffb73f5f5c77ece1d09c210e66a153ec87121881c475ed730289ac9ea6b0006d3894a3a4e88487e8e4f5bffac0b9df7ebbe8e539d368d0bcd40a3440470f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
11KB

MD5
c06df170f1958c10439f34b896495488

SHA1
461ebe2c2169247272a44f3a0d6cbace384bcabc

SHA256
f32ba6bf10f59b593522f30fd6c5ac8e3566a7f2bb457df81794e11ed9b5de0a

SHA512
112c807025742c664b838a7087a7cac647662b836be29dbfbe88c9a1a4890187df1fa932737dadbafebd480bd4619578cbea7567c2c3c594f37bac721b1e8b34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
11KB

MD5
ed05657aee64866e47df881fe9e6f435

SHA1
71665dd94f53467dcf26c088f54c2acb8a921589

SHA256
a8baa94567369037aaae4ffbf4b69ef2eabf8c4bd2e87c9ddd80dd1d08fd4a01

SHA512
dc74ea148992a80693aff10dd8ec1083f6f86bf6ee2b9267bf6871ebd14806427aef7d992dbe444620431a7abe68c34aa5813e338e24c5098ec2d192e9422cc2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
11KB

MD5
9377a4db367c2910609fd291a10cd9f9

SHA1
bbd7a2e07634ea7d00f2fee74174171aa6414f3a

SHA256
fbc5a86d838d7291812060c82108ce7568dba65c15f7c3847e78293a0e119cd4

SHA512
113e254545b3837da7e93ac4b32ad14da30f871585c587515fa3d5b49053a4cc2f9cba67dc69c6fefa60eb2dd5155354f088a928eec02618225a09c2aed5b354

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
11KB

MD5
77ccc2825075204f1c7853c5454725c6

SHA1
9f9758e4530966783f497aa81da86f0b2d18047f

SHA256
83ce14fe0d433bdb7861a9f8277382e6aea64852c4dafd48f4ab9dbf6fc1222d

SHA512
bddac9877eb2368b5d55764e27272ec2bf3cd7051d67778120c35e0153c1abe573874d4f0019f65d4b0ea59f60980eedd3f638bd66b55496d652a6f3e267fcc9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
11KB

MD5
d142a454a1353480b3a8a372ecf36e17

SHA1
0e737e2700916cb981db9e11409f53ce98e412bc

SHA256
8254acdbcf283569d32895045d185730e1926d4684de12319a2333b632e008f8

SHA512
1aaf293e674aecf15cb4473b2c15f2933874a3952bb6e796854b60838e91fae42807af23c6ed44f50a0e8e79bb1639aac88fa1ab10890a6047e3ea81322cfe9a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
11KB

MD5
9fa1e7316e6900868ab83074ddfc269b

SHA1
1d52a6845881862124612dc7d3ce2211b08e6417

SHA256
79725c5b7deb3bb89d42a8102740ff28eba8781138f12ba2d5523adf71125820

SHA512
b4119999457014a1a9c6c631e0d345f89258ae9902cc6eba5c32de768e726a29fd992b94faad194d6eeb6a52f2f31c3974531173253349f3e8edbe934cbf7a17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
11KB

MD5
4bd5d0134aeaa408d10340a14d3a209e

SHA1
988836ed176648c41ff4227ca0f6aa061db9d815

SHA256
bdcfa30369691d47c971b730dcc740fab788aa8b7640cdc6d46aa1c259bd60e6

SHA512
e0d76dc0042f34e4abe8e9cf16ae4817c0fd0164608f1eac4fbd97c5533cc3ffffac07f7646083b67b822474a1fe15d178bb8f8304c1983f96d3041ceb3b8d7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
10KB

MD5
3ec92a3c4132bdaf87d47ac009546967

SHA1
ac325b37b6b207951ada41220c6b62c5713bdc36

SHA256
91b73d5ffbcfafb11aaa71202e592ccbdd41a879dc6b4762af74e2fadcf73783

SHA512
968e27fc120c5a79f016a3cecda02ab3bc3470348ff7e6e02ddc46fb2482e41f32b3dd38fa0a826f1af6523e6268f3a5d4e19f5dddb7e2276c07f07e089ffd1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe66c3f3.TMP
Filesize
8KB

MD5
cc8c4ead61ca4f81e69c1fde78cbc2c4

SHA1
66fe6dbac486314d0e65032464cc2f3dbce007fb

SHA256
559ef1df21182ecbc362e725bd96f770808046b7aa012f06efdefafbb00f7762

SHA512
8357d1e1576837f35ac6c23b998f19fbb97dd75ac7d0b4f157b5776272ea75d9ae7264e2a1373a3d9f9fd0402ca03a0933e3c1479d3ed08ff124f3c6417e9f93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
21KB

MD5
a65943819151dedb0f00afd59e11f03d

SHA1
ee0f49c8392081a1f96e83ecfd42482b401bb33b

SHA256
74ba8f0f1938f00b8b1860469fbe0483fa96e7e10bb0df533da7ace6628d4c63

SHA512
a1ac4abb91f2980211469996fd6c8eb8805fe9ced441835efe70f63fe70a42bf249cc495fca6ad9c654085f009a7c778fb9758490d6f250dfe2cb1ef533bd547

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
21KB

MD5
7622b92bd404d9d5f3eea07161220a87

SHA1
3ae9ac36236d99397d5d8db24685d3173713709c

SHA256
d6a589edf1512b1464473f6271550c95a834608ebd1c82fb830379e821b0e557

SHA512
7003809e38dec3576631525625d2f57a4c7bc378d9f5e72f8bc6cd9a2cab8aaa71c742da2a820f032ea6b5ccb9ba71e1db526f8eec6aa38e889d4c16f2471f03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
21KB

MD5
67a80b2ca2d05a2f1c6af80a0884183d

SHA1
332b904ef97613869d0ceaec03b99645f4751aa4

SHA256
d102de5ff9272eb6ec1fe30c2f200c5d2e7ee2fa76e779ebb85bc79f3b311c40

SHA512
9b6946830c73725d0f736e92c2aba3ce17789c78ffc7c4f2129e71f6c3544306454d4d15d4e2cbd9ad3be63236cb0145915bb54dddc785b968dbac3b3aa4613a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
21KB

MD5
9d6553f850b18bdd3daf42efd8339d82

SHA1
097837543c242d0657176cd06c0c4322a29154a4

SHA256
b2a82d70154c2cd6f44642e455dce0f3453bb328aaf39dcff3f3401a43e5391f

SHA512
a2206b85fa99c2e7d2a06987b13bddc47ff34ebc793c8f16cedfcce4a9aedbe69319d5a39785f88cee7f6c36a441b3d814bb36cbf5b3f14d0505d6e7094ae886

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
22KB

MD5
cdea193cc56a361e08bda070cc311813

SHA1
efe179a7a2283399c928c1bc79478ad3be20740e

SHA256
58db5a6e64813b510339ffb46fae7eeab9dda4e912153aa3749e0edeb6ae6c0d

SHA512
49ca182976a3df29e06bfcfab01fff990f0ffc90541e92fb22f56c572f77d8590cb61eb3cca39629bd04be7953c5e46d4e7c2d7688f12c82acb597be3a4e2eee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
22KB

MD5
0418d13f17e91beac8a013a180c4e297

SHA1
b7c2e036cea7afbc128b244b22fdba3235d14249

SHA256
c73ffa57b13f4226a0da34d8c5e9049a1ff89c4dc84549c5722b3fc70a23a595

SHA512
ef36e053170c3eda6c0e2aa30f0766eb67999c49583765d5084e16e8595e6a5ddffbbde42399ea0a5e534f99b9354d7dd699703486f5389a214e99ff59a8805b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Filesize
1.2MB

MD5
40b1de31e0ee52e2a194ab87c6da7c15

SHA1
1300ba5b61b75a044f58004bbb92fad988549d9e

SHA256
3394714d690700a63af8a83b4ae48bf7856b02ab53e8a383b00be31af7057046

SHA512
e5053d5750b78ac848af52d74abf9c3b0ff1094f4d51f44b6e181a18e7c437a85ba66f69b339ae63432e9b2380627823cbb586adf42dc6c2c79b0cf0ab7fbc6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Filesize
120B

MD5
0d56899214bac9fd1064727b3a44fcb3

SHA1
c96cd488a59ef999e633e00afef044f7c27f7dcf

SHA256
05930bfeb92652d13dfa021bd4a62d37928031956ef69428b4b8bb3528dd8a24

SHA512
f240b05b7ad41453dd6577377aecfec47dfc0663ed774bb7289d6e3359e42770590be28ea4dab9b13fe95e159a50750c0d75bcba088283183bc18382eb4584dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
96B

MD5
533ca9abc3fadab9f29c57d258641cc8

SHA1
d347b7067cfd6663adf9954997f4a6d3461a0479

SHA256
ced4744f72455f5c30d4dd23fd2de69af12d4fed050b789340d2eccdbfc4f31d

SHA512
6401997f109883952e12cfbe0d5449fe27f5076c7ec1d0ff97631bab78e2c7f564e87abeccc62608266af279f1c98f5be3c41acc97b5c2be7867604bc0dfe014

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
197c99464462434e9cf877bed2ad6635

SHA1
226f483ff57a64808d6e7a7e342f2037c6356a9a

SHA256
b24533882ca132fdbd1082c16061fadbfa208ba418ae04b9d9a4f63cb5368605

SHA512
e88bbcdcbd14d0f38c6e8ce2c30eb6613c662e982bce56815984f6406253dec181055601af503123287761fb5767369218032d6400873ccb2e5450db77529565

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe66cbd3.TMP
Filesize
72B

MD5
720665af42ae3af428627037b908df7b

SHA1
ff8a29830ff06db8543f7687ef3c748cc977f41d

SHA256
37c13d712c91a17c169888e3f5b6337c8652ce6bd737280a6950236abe3cdacb

SHA512
bc3e7089973c6ea88805e21e4534e2e9386eefdfd1281a0937afb71697f4b8a7a2f3239552c61c0415217b3f0a09e52399965ce38d6694f9c57e751b212dd8ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
f9aa01bb4a9b1a2cf94b1a2e424892d0

SHA1
d9db92a1f33ce13f3fddce750f50098470c0289f

SHA256
28698b6f5755a96bb23232a2dc3c06439a76f1fb72fdb909b31c69df9651a8ca

SHA512
aa9ed31153e9ce80a730a96d84aba1d57254ab659744f911ac0f31c4ec9b23e7c5f9bc8bf704bb06a778ba9a7ba5027f8b78b34bb13b1ecae0e0b4eabb734337

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\temp-index
Filesize
48B

MD5
bf3ca149ee3c64f1203ac3a59a7aa5a1

SHA1
c1dcc99dfd919ca5af544e29d38e1bc9a0a74763

SHA256
7434d701fdfb665243bdaaec4138788bc4a20400392272f30c1a1b8c7c02fd15

SHA512
0eb2d798239231324deba0c583982eed85c57bc6043fdea10ff0a14ef6802a3870fc992630612ad2b12bc750fb90ec73c3c89b6de69fe7d0940942af7a67cecc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b4b6fd39-59ce-4adf-ac50-0e4849c2e504.tmp
Filesize
9KB

MD5
d71ee4320fd8fbfd2367ba10cfee4aa7

SHA1
e9824f2b9014b360036b32d8b6ede879c062146f

SHA256
5e4b64fe47932c02301f7092f6d2858eb9a19b1ea468650dbf20832d6b594f75

SHA512
3bc97532806d2c1f186d9b074908282ac4c2743347ebaad0377c631cc75e90ac9621b95fd387ac04092ee212559620c55686d104530c3c8ea9659710989fe419

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bd023b8c-a641-4d75-9459-d07c88811d6c.tmp
Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0
Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_2
Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3
Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
1KB

MD5
2ae8fb638eae5acac9cc2b720c36086b

SHA1
f5a76c01bb5932d98c475110017682b55deb9378

SHA256
e1693949f48aff1f0bbd7016955dd23f0fe4beec7f1857474cf3ce604391ab84

SHA512
6211a12860deca82f7e8bd80e7746d4cead4126791d1210f9b38a21de8e31d0c1e81c48f125801e8ee7fbd5d55b1f56c1e09d5b9ebfa2666a77e3dcf2bfe97b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
84KB

MD5
cfe6c1d29f66e371cb91ac6b2f965795

SHA1
725f6d53356b8cd5368e61fbbbff3d5de16f9486

SHA256
0d2ab215984d24b7ddd6905aae7d2d0aad18abb7b20cfdecbd0b0777d9c9c620

SHA512
55af39f04d3a6b835e1155fcf2cc9f618e7a9c189a0b4340b1e445de4f2185b84ad1041ff9b51002c7927f16a9639c15ba868f8f101ed2d38a8dc9f889646750

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
85KB

MD5
82b3d99ed1d5b6d7aac52368a2411b1c

SHA1
3827e2d8229d5989fd0a33c5978e36522e5b4947

SHA256
ea40a578adb387a48df8b4c5eb7dc7c1935a448afd9cccf33678d61edb3a0d26

SHA512
86f53772809a903aa2f5303c29596ef50f3c9e3f26b28ecbc5d2825b8a918f02d596b1e90499f469e99bcf668cb3110c2dcd3bf3a7156ca86e3d39cc2b17840a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
88KB

MD5
12307cc8cbcc087819af668c5ef82657

SHA1
b709bd3a5bebc36321b92b3afbfbab96ef97fda6

SHA256
9ffc14062bb7cb61c90dfcb9b351e31e54a797870ac28c8cc82d8db39cd0e3fc

SHA512
b58b16e29a30eb6feff2e72dcb529cfaec790744d1a303fc8bda6f2d9fe61ac9410aa4dde161683e5a9021c74546e8a9706b91c8903d40415aa530e0d5c9b0fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
88KB

MD5
e1140c4b148900391267085cbf82dd1c

SHA1
f10f3daccd9c1a70404b5d5bf100d37221f11f0b

SHA256
81c7319273bb662eae63e4d029b9215ad256392e7988060be69b57266b80e7fa

SHA512
13e0a31c56e94137d5c5c0b220a396cc65c3fc8fc4a62775f0d31795e868fadf88c8bcae47edbd38e0cf1ebb7ab7dba7c609d63c4da00a89af4e9945d426b667

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
88KB

MD5
f25c0e8624907e510b31fa3e74409eac

SHA1
f9b8433f1e915c2f4e45668ba180c10d238355c8

SHA256
4cca32f751cbd13f0bab12ac6f4c5ba084b7417f074f242e09198b53718966c4

SHA512
3d73460bfc1f250498aff4f878c2bd159ab5d0543bc3538a18f6ddb52d41ca1e542312ed43d7856d58f0cb25c0f8f347fd32a2c2af928182db988b27b5df4afb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
88KB

MD5
05f9794af1cadadc7be5cc1aba89e005

SHA1
601155346e44c7e002f60cad0bad5cb8921eb2c3

SHA256
5c0ec4025d0c6c4563ecc51023fb19f436910c8edd6356cf040d0a7021822959

SHA512
dadcfdab9f1d012418be72e3eddcfa917846a627e12dcce83141c768217581a464bfc516cc5af01ff939b2b4c331813aadd6b0f61bcb1086f77b29c6a460de63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State~RFe6665f4.TMP
Filesize
919B

MD5
fecce61bc5560bc439eee2325ee031b8

SHA1
bc400cb48f1b2c5704a7b478b3d264e44173b80e

SHA256
17308b833049bef3aec9d295ddb5c8d6dace1e0a82233b7a6750dea9845c6b19

SHA512
444bbee77baff6f7c418e27a4a52efcaf2cdf175c92c466a8c15bd02330112013f4fc862b86a1982611f9acfa661559a02b8a4d574ba905b9ed55d5f87dda518

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Webstore Downloads\bkdgflcldnnnapblkhphbgpggdiikppg_23929.crx
Filesize
4.0MB

MD5
45daa749bc26f997d89b360c153f5158

SHA1
3074ee3ace934c4aaad10dfca2126efbc0cbb5b3

SHA256
169fadbde7087819155261ecef60ae01e3a4c4cccf7205a9cc24bdd438a0c1d5

SHA512
849a3800f0afef73859bbeaed616624365dfd7a14c46147dd598d8c551d898d9aa0ea46b4cb79430ff4144055eaa5a23a12ec0927df26f1fe80938dfdcb09d15

Download Submit
C:\Users\Admin\AppData\Local\MICROS~1\Windows\POWERS~1\STARTU~1
Filesize
1KB

MD5
9259352f454235033352a42b5257d3d5

SHA1
5b60cd54e7846c4ab95bfce770b5b76f9b2e4680

SHA256
d9ad704bde63ac63a28af645e14fe6e4a0a05d4f117bbfff31611a3a091c8aef

SHA512
c1df6f512137ae3610e0293fdfc0a77d661203235afc13030948d2b1c3913e6e3fcf834b5600aefa5ec2cfb41b37c8c00e76779f62f69c18b2e8e6c5d4d2fcd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svhost.exe.log
Filesize
654B

MD5
16c5fce5f7230eea11598ec11ed42862

SHA1
75392d4824706090f5e8907eee1059349c927600

SHA256
87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151

SHA512
153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
dbf31b2ac090b01b2ee014ef6e055743

SHA1
e068d76a51b6311e4339d2f0e9b63ec3e6cbfac2

SHA256
c6dcd79c92fdb1846267984ed9db153a7164c21dbf190ed3bc03ae19a5a772b8

SHA512
84d3d324773ee6678d27ae59c6ea9bbb818a579f6fe61a8047e3105f6ecde8ab87070533acbcedd529f5c259056dc6dac52d1d28c5a9e77ab9d1ef4aaeb0e086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
7d5139e816e5fbdcd5079e3603738ca9

SHA1
76ae70001df4af9916a3b2ca7f7f0561f6bbaa8a

SHA256
558ecd7c24b10ac57c23bde86ff1718b2437a04ef108b27ddde211fdd7b2258e

SHA512
69c1dd1103a5cf712eadf53d9b1b15d66f8bfd41c602d34a4c151db21c46edc309aa75e5da4a3fa0b59dcda8b7af74f0eab5729b9e195d91ac922a14fd0af9c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
9f482bcd6777742cc7f81789baf349ae

SHA1
dfe10b6c730182ccf4da5c8de5e496486052cc91

SHA256
aabfcded6f5606829b4b60a57a8714d791d4af69a5ef5c4b5b375acdcb4bebe2

SHA512
9c7c976093025ec6c0ebf99737bc61e954c15b3b02943f67fd4a43efa59ff42c854e3840a32bae806344ae1f535e70fe07244bb460cf27ba9edb014684483494

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9RYA3JQ4\microsoft.windows[1].xml
Filesize
97B

MD5
05f076c284761f606433ab57df8af5a5

SHA1
0fc5eb64cdaf62dbd41d0948e7ce55825fc24c36

SHA256
e20708a7c494dc587afac5f5a7781573ab6687f0d045539cd5bb904ffb22fc22

SHA512
fd189610dd5eaf194d3b3943b57a5449d53a6f1b78bf53d3259bc21bf78eede1d6c85e064ac0b7dea670994ffcebd52d0166e0ab385a67d78b0464ab262e49f9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{07ced9fb-1d87-42f6-be15-0732ebabaea7}\appsconversions.txt
Filesize
30KB

MD5
f21f68ab0fd9bf5b4255eddde72be816

SHA1
abea6564790813e12784c8fabd43eddbec334bf2

SHA256
9034fbd5f370a37a2e43cae5d482b84d3ed9b6c62c6ddbc4bee25b0526ad25ee

SHA512
3b75d817d4f5361a05148fd7e62f5c54b97e685d8db046d73bf4889cca3fb5080da0d8e52b4d0d34b31e927bcb9f2a073411c4597a1f9528c419aadbb2663472

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133642709087578217.txt
Filesize
106KB

MD5
33cf26edef738f550e71228fc3bae3e2

SHA1
4c13fbedf0b13384fe739d52f5e9969c546447f3

SHA256
f9a8d0dfb841f5ac10651be208000ec7eee8ac54f9b13a617e73940c84c8b7a9

SHA512
538f384d9432c0a025fa6c4c9cc411bd63ed51132590355e5037062552b1fef99dbf25e373fd471e6968cb46c234bc766b6da58af37a997e5f1d3d9542359cfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\5f0ee59d-15a4-49e7-a574-0e9357c65516.tmp
Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\AME Wizard Beta.zip.crdownload
Filesize
10.2MB

MD5
511632bac24aa554f91577526a582299

SHA1
3cd19b20965cbc9a5e856736f8afc1ec5f24573a

SHA256
1575980d2b65bbcab8dc4d0d6a54d8af4d0d7f0c518a73a3ad1748f306430ee3

SHA512
890067e49cb12bf626af85ce9c77144892200cb64cf5f32059ec6a1e320584edf8b2b9945b7cfe115eacf726c1a775ecd089bd89e4259651da1de717cb050f3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AtlasPlaybook_v0.4.0.zip.crdownload
Filesize
8.1MB

MD5
ae171d8467d0b578f1a65c3ef035a03a

SHA1
6b434fbd4f34f69e1e4be8ddf32e7a0c183854a2

SHA256
5ddabd14c4a8d7fe5e6cc0dad71ec94385c634ec772e6a8b44f43522e67d8b48

SHA512
4f1962fa19e52db02434ea50c30429a5d45ad11eb8f21079df1c5e58086fcd721c37a3066f17fbc305df48f11f365e7793303aa23efe5227da2edd5b8d1bbba9

Download Submit
C:\Users\Admin\AppData\Local\Temp\DuckDuckGo.appinstaller
Filesize
749B

MD5
930d0d329b1815d839baf2a6a5af1958

SHA1
51a7b089f4d44de923b9e9d3c8727dcff3b9e361

SHA256
51434be82d8ad0a58759fd1dd85d71b487b2ab993eb6be499b9ba07c8ff5703d

SHA512
0de0300aeb6dbb2cdce9726f347843d54bb56fdef1dcfe47b9b09e5643b11cbf729e472b0f5a7900e304f2ea5dbc9d0c88b7b647b52ff7740f9cd8121367ffb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qh2lfdur.a5c.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\b653ed9a-a8b4-45fd-bb7c-d90e65222398.tmp
Filesize
242KB

MD5
541f52e24fe1ef9f8e12377a6ccae0c0

SHA1
189898bb2dcae7d5a6057bc2d98b8b450afaebb6

SHA256
81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82

SHA512
d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88

Download Submit
C:\Users\Admin\AppData\Local\Temp\rojmhh.exe
Filesize
8.0MB

MD5
780d9df36221ccd24716da39ee3e2708

SHA1
3a2e4f8bc401856f1870e9fd3a3977044db68729

SHA256
f765d1d4012f47223a47c5992da55066e81d76b0714eb347ca6a54c55f4e374c

SHA512
36b1df97a9b0a3ae9cae704f722537c877c6b8a091c513be66bd16645cdf9ab424912e6dac3ddfbbf9419a9d0acc17113dec88418b8134e641a87028e8e4d6c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4288_1113108837\CRX_INSTALL\_locales\en\messages.json
Filesize
450B

MD5
dbedf86fa9afb3a23dbb126674f166d2

SHA1
5628affbcf6f897b9d7fd9c17deb9aa75036f1cc

SHA256
c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe

SHA512
931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4288_2102783356\CRX_INSTALL\_locales\en_CA\messages.json
Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4288_2102783356\e2262a76-fa23-44ea-ad66-9fac1d0af1e2.tmp
Filesize
132KB

MD5
f8e609603d53c701422bbc4e026740c8

SHA1
5d08ba917111a8fce835be950477156720e57437

SHA256
aea99c066addc7157626d59326d8e5589402f6aac551a0560b92710ba68ded8a

SHA512
5cbdfc06d076665752b4a1aefd697f8af7dd2f673c2a65d363dde5e27e97451bbf6d6097c0b9003cccc886b1ec0cc3cd66be58c57076c181d2749249395462bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tportable-x64.5.2.0.zip.crdownload
Filesize
6.0MB

MD5
cd3d2b3765ced4253f9a4d05d0e52b6b

SHA1
62f170647adff882bbb3e7857d84cc23d42e8260

SHA256
4ffd944ceada0b5c1094d0193ac66475309d0236917c27b41d01ff885991c6d8

SHA512
afd599bc3a24f1c85e89cb456951e03bbc28442d70a0962f5ff92e34a27f99b140fd797c0ed57ad385b69a3b7733926f2accc94d60438b892a3a397f9406556e

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\svhost.lnk
Filesize
665B

MD5
b139bba37dc5cb5e024204291e00fad9

SHA1
678198bdcd87f2b7a5c0a84558013d308ff402a2

SHA256
186109f3ad165817eb0727488cad69f79bfd6d8213f3e269318097a35d6ca3c8

SHA512
12d91112e6f256975de77707df24f1c53f340eb88eb398ca179f5832e6f006759d04d59da99b851f464702b27a353bee96c09ce8db5f21d3d5fdeac589fde4cd

Download Submit
C:\Users\Admin\Desktop\crash.bat
Filesize
12B

MD5
63f7f3de4f2696f40d7d11ceef3466a0

SHA1
95b9f45d0196a99e63dd3a8277e9252a3d5a4603

SHA256
868267cbdf2b92d40f371c546439eae7d808bb95ca3b353f7864e03cf17d0a32

SHA512
71b530f508570de28a19dcbb1f7684a88fd66d62f0555c96f8b347148116e1a505b67b5f7a61824b89a97155f4bf057552a7740ae605f7649ab6bfe2cb052284

Download Submit
C:\Windows\TEMP\chrome_installer.log
Filesize
21KB

MD5
f318871e1aec8020b2ab9b835e8805c5

SHA1
9381e5c3b0a8d9b9eac04cf4c68df0ffdecf4ca9

SHA256
dce13dfff187c7065d29cb8c468853daf899d40c85663b76b0cc26ab61b6db0d

SHA512
a8c3978e3db6f4bcd6ce57fbbd7fed56419b6ffe8fdd5479a4f094a6620fac1ad983510c7ad9dccb49633cd81240859a33c052fd1366be2c7c6fc2a2b62be51f

Download Submit
\??\pipe\crashpad_4288_LAKLDKGUBKCYYSQW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files\Google\Chrome\Application\126.0.6478.127\chrome_elf.dll
Filesize
1.2MB

MD5
576f4379df97be0689013c7de1ae64b0

SHA1
6751967e285bb8008c5a582dc87f1e3c132bee15

SHA256
114b6fb306bbc3e5f0a903c7bd2c3ccf01a6df1ef12a31f418a478ccc7b5ebdc

SHA512
e70a1698880f654d0ca2d63ab74ed01c4f4d6e7b3979c726d9e9b11b4d93622967a494f91bf014ad6def451c38815b5ca9dabb7db8613a3174e25a0c64a78c4b

Download Submit
\Program Files\Google\Chrome\Application\126.0.6478.127\d3dcompiler_47.dll
Filesize
4.7MB

MD5
a7b7470c347f84365ffe1b2072b4f95c

SHA1
57a96f6fb326ba65b7f7016242132b3f9464c7a3

SHA256
af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

SHA512
83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

Download Submit
memory/392-229-0x0000029BA5F00000-0x0000029BA6000000-memory.dmp

Filesize
1024KB

Download
memory/392-262-0x0000029BA6C20000-0x0000029BA6C40000-memory.dmp

Filesize
128KB

Download
memory/392-236-0x0000029BA6AA0000-0x0000029BA6AC0000-memory.dmp

Filesize
128KB

Download
memory/392-230-0x0000029BA5F00000-0x0000029BA6000000-memory.dmp

Filesize
1024KB

Download
memory/392-231-0x0000029BA5F00000-0x0000029BA6000000-memory.dmp

Filesize
1024KB

Download
memory/824-186-0x00007FFDC79F0000-0x00007FFDC83DC000-memory.dmp

Filesize
9.9MB

Download
memory/824-3935-0x000000001B6A0000-0x000000001B750000-memory.dmp

Filesize
704KB

Download
memory/824-1-0x0000000000BC0000-0x0000000000BD6000-memory.dmp

Filesize
88KB

Download
memory/824-0-0x00007FFDC79F3000-0x00007FFDC79F4000-memory.dmp

Filesize
4KB

Download
memory/824-384-0x0000000001330000-0x000000000133A000-memory.dmp

Filesize
40KB

Download
memory/824-187-0x00007FFDC79F3000-0x00007FFDC79F4000-memory.dmp

Filesize
4KB

Download
memory/824-188-0x00007FFDC79F0000-0x00007FFDC83DC000-memory.dmp

Filesize
9.9MB

Download
memory/4632-10-0x00007FFDC79F0000-0x00007FFDC83DC000-memory.dmp

Filesize
9.9MB

Download
memory/4632-11-0x000001D8D4F20000-0x000001D8D4F96000-memory.dmp

Filesize
472KB

Download
memory/4632-52-0x00007FFDC79F0000-0x00007FFDC83DC000-memory.dmp

Filesize
9.9MB

Download
memory/4632-48-0x00007FFDC79F0000-0x00007FFDC83DC000-memory.dmp

Filesize
9.9MB

Download
memory/4632-6-0x000001D8D4C20000-0x000001D8D4C42000-memory.dmp

Filesize
136KB

Download
memory/4632-25-0x00007FFDC79F0000-0x00007FFDC83DC000-memory.dmp

Filesize
9.9MB

Download
memory/4632-12-0x00007FFDC79F0000-0x00007FFDC83DC000-memory.dmp

Filesize
9.9MB

Download
memory/4632-9-0x00007FFDC79F0000-0x00007FFDC83DC000-memory.dmp

Filesize
9.9MB

Download