stealerium | d99bf38cb207b2d5824898f2a9f2a15cc18635380087b4800e8b3e14594a7376

Analysis

max time kernel
126s
max time network
137s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
22/04/2023, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
My Logo.txt
Size 810B
Sample230422-q6cnaagg7z
SHA256 d99bf38cb207b2d5824898f2a9f2a15cc18635380087b4800e8b3e14594a7376
MD5 49e17e34956aa9f53d0b0f6c60676227
SHA1 69ad883d69792b67fa9e227bb22c011f20c6b645
SHA512 bdcc1563be6a7328aa75722425fcd0c8e0812c9ca04e619ae089a7c464e2d6979dfb1b92d7af85e404b894e3462347911cd8563e7e8032e3275970f2e1c8df25
MD5 SHA1 SHA512

Score

10^/10

stealerium discovery persistence stealer upx

Malware Config

Extracted

Family

stealerium

https://discord.com/api/webhooks/1095395235925860562/XJKTcwaCabyMW-BfMqoZcV1Cdz4AG_yTryi6C2h1zfneacs22tdMKRBmOj0nL4Bx8vi0

Signatures

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
5144	winrar-x64-621.exe
2248	uninstall.exe
5148	WinRAR.exe
212	Synapse Launcher.exe
1204	main.exe
4952	Runtime Broker.exe
4460	Client Server Runtime Process.exe
5904	build.exe
2620	main.exe
4836	Client Server Runtime Process.exe

Loads dropped DLL 64 IoCs

pid	Process
3236	Process not Found
2620	main.exe
4836	Client Server Runtime Process.exe
2620	main.exe
4836	Client Server Runtime Process.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
4836	Client Server Runtime Process.exe
2620	main.exe
2620	main.exe
4836	Client Server Runtime Process.exe
2620	main.exe
2620	main.exe
4836	Client Server Runtime Process.exe
2620	main.exe
4836	Client Server Runtime Process.exe
2620	main.exe
4836	Client Server Runtime Process.exe
2620	main.exe
4836	Client Server Runtime Process.exe
4836	Client Server Runtime Process.exe
2620	main.exe
2620	main.exe
2620	main.exe
4836	Client Server Runtime Process.exe
4836	Client Server Runtime Process.exe
4836	Client Server Runtime Process.exe
4836	Client Server Runtime Process.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
4836	Client Server Runtime Process.exe
2620	main.exe
2620	main.exe
2620	main.exe
4836	Client Server Runtime Process.exe
2620	main.exe
4836	Client Server Runtime Process.exe
4836	Client Server Runtime Process.exe
4836	Client Server Runtime Process.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe
2620	main.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ThreadingModel = "Apartment"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2620-1278-0x00007FFD7F180000-0x00007FFD7F5EE000-memory.dmp	upx
behavioral1/memory/2620-1283-0x00007FFD93EC0000-0x00007FFD93ECF000-memory.dmp	upx
behavioral1/memory/4836-1282-0x00007FFD79C10000-0x00007FFD7A07E000-memory.dmp	upx
behavioral1/memory/2620-1285-0x00007FFD8F6B0000-0x00007FFD8F6C9000-memory.dmp	upx
behavioral1/memory/4836-1284-0x00007FFD8FDC0000-0x00007FFD8FDED000-memory.dmp	upx
behavioral1/memory/2620-1286-0x00007FFD8F480000-0x00007FFD8F4AD000-memory.dmp	upx
behavioral1/memory/4836-1287-0x00007FFD8F1E0000-0x00007FFD8F1F9000-memory.dmp	upx
behavioral1/memory/2620-1288-0x00007FFD93BA0000-0x00007FFD93BAD000-memory.dmp	upx
behavioral1/memory/4836-1289-0x00007FFD8F180000-0x00007FFD8F199000-memory.dmp	upx
behavioral1/memory/2620-1290-0x00007FFD8F150000-0x00007FFD8F17E000-memory.dmp	upx
behavioral1/memory/4836-1291-0x00007FFD90050000-0x00007FFD9005D000-memory.dmp	upx
behavioral1/memory/2620-1292-0x00007FFD8EEE0000-0x00007FFD8EF9C000-memory.dmp	upx
behavioral1/memory/2620-1293-0x00007FFD8F860000-0x00007FFD8F86A000-memory.dmp	upx
behavioral1/memory/2620-1294-0x00007FFD8EEC0000-0x00007FFD8EEDC000-memory.dmp	upx
behavioral1/memory/4836-1295-0x00007FFD8EAF0000-0x00007FFD8EB0F000-memory.dmp	upx
behavioral1/memory/2620-1296-0x00007FFD8DB80000-0x00007FFD8DBAE000-memory.dmp	upx
behavioral1/memory/2620-1297-0x00007FFD79450000-0x00007FFD797C5000-memory.dmp	upx
behavioral1/memory/2620-1300-0x00007FFD8F1B0000-0x00007FFD8F1BB000-memory.dmp	upx
behavioral1/memory/2620-1299-0x00007FFD8F6A0000-0x00007FFD8F6AD000-memory.dmp	upx
behavioral1/memory/4836-1303-0x00007FFD7F090000-0x00007FFD7F0BE000-memory.dmp	upx
behavioral1/memory/4836-1302-0x00007FFD7F7C0000-0x00007FFD7F7E9000-memory.dmp	upx
behavioral1/memory/2620-1304-0x00007FFD78D20000-0x00007FFD78E91000-memory.dmp	upx
behavioral1/memory/2620-1305-0x00007FFD8DB70000-0x00007FFD8DB7B000-memory.dmp	upx
behavioral1/memory/2620-1306-0x00007FFD84A10000-0x00007FFD84A1C000-memory.dmp	upx
behavioral1/memory/2620-1307-0x00007FFD7F080000-0x00007FFD7F08C000-memory.dmp	upx
behavioral1/memory/2620-1301-0x00007FFD81220000-0x00007FFD81245000-memory.dmp	upx
behavioral1/memory/2620-1308-0x00007FFD7F070000-0x00007FFD7F07B000-memory.dmp	upx
behavioral1/memory/2620-1309-0x00007FFD7A920000-0x00007FFD7A92C000-memory.dmp	upx
behavioral1/memory/2620-1310-0x00007FFD7A900000-0x00007FFD7A90E000-memory.dmp	upx
behavioral1/memory/2620-1313-0x00007FFD7A8E0000-0x00007FFD7A8EC000-memory.dmp	upx
behavioral1/memory/2620-1314-0x00007FFD7A8D0000-0x00007FFD7A8DB000-memory.dmp	upx
behavioral1/memory/2620-1315-0x00007FFD7A620000-0x00007FFD7A62C000-memory.dmp	upx
behavioral1/memory/2620-1312-0x00007FFD7A8F0000-0x00007FFD7A8FC000-memory.dmp	upx
behavioral1/memory/2620-1317-0x00007FFD7A600000-0x00007FFD7A60D000-memory.dmp	upx
behavioral1/memory/2620-1316-0x00007FFD7A610000-0x00007FFD7A61C000-memory.dmp	upx
behavioral1/memory/2620-1318-0x00007FFD7A5C0000-0x00007FFD7A5D2000-memory.dmp	upx
behavioral1/memory/2620-1320-0x00007FFD7A590000-0x00007FFD7A5A5000-memory.dmp	upx
behavioral1/memory/2620-1319-0x00007FFD7A5B0000-0x00007FFD7A5BC000-memory.dmp	upx
behavioral1/memory/2620-1322-0x00007FFD7A580000-0x00007FFD7A590000-memory.dmp	upx
behavioral1/memory/2620-1324-0x00007FFD78990000-0x00007FFD789A4000-memory.dmp	upx
behavioral1/memory/2620-1367-0x00007FFD90160000-0x00007FFD90184000-memory.dmp	upx
behavioral1/memory/2620-1369-0x00007FFD8F1C0000-0x00007FFD8F1D9000-memory.dmp	upx
behavioral1/memory/4836-1370-0x00007FFD8F120000-0x00007FFD8F14E000-memory.dmp	upx
behavioral1/memory/4836-1371-0x00007FFD79890000-0x00007FFD79C05000-memory.dmp	upx
behavioral1/memory/2620-1373-0x00007FFD8F0F0000-0x00007FFD8F11B000-memory.dmp	upx
behavioral1/memory/4836-1374-0x00007FFD8EDF0000-0x00007FFD8EE04000-memory.dmp	upx
behavioral1/memory/4836-1372-0x00007FFD7F0C0000-0x00007FFD7F178000-memory.dmp	upx
behavioral1/memory/4836-1376-0x00007FFD8F7F0000-0x00007FFD8F7FD000-memory.dmp	upx
behavioral1/memory/4836-1396-0x00007FFD7A630000-0x00007FFD7A7A1000-memory.dmp	upx
behavioral1/memory/2620-1397-0x00007FFD797D0000-0x00007FFD79888000-memory.dmp	upx
behavioral1/memory/2620-1398-0x00007FFD818F0000-0x00007FFD81904000-memory.dmp	upx
behavioral1/memory/4836-1399-0x00007FFD78FC0000-0x00007FFD79212000-memory.dmp	upx
behavioral1/memory/2620-1400-0x00007FFD78EA0000-0x00007FFD78FB8000-memory.dmp	upx
behavioral1/memory/2620-1403-0x00007FFD7F7A0000-0x00007FFD7F7BF000-memory.dmp	upx
behavioral1/memory/2620-1406-0x00007FFD8EDE0000-0x00007FFD8EDEB000-memory.dmp	upx
behavioral1/memory/2620-1409-0x00007FFD81210000-0x00007FFD8121B000-memory.dmp	upx
behavioral1/memory/2620-1412-0x00007FFD7A910000-0x00007FFD7A91D000-memory.dmp	upx
behavioral1/memory/2620-1479-0x00007FFD90160000-0x00007FFD90184000-memory.dmp	upx
behavioral1/memory/2620-1477-0x00007FFD7F180000-0x00007FFD7F5EE000-memory.dmp	upx
behavioral1/memory/2620-1481-0x00007FFD93EC0000-0x00007FFD93ECF000-memory.dmp	upx
behavioral1/memory/2620-1483-0x00007FFD8F6B0000-0x00007FFD8F6C9000-memory.dmp	upx
behavioral1/memory/2620-1484-0x00007FFD8F480000-0x00007FFD8F4AD000-memory.dmp	upx
behavioral1/memory/2620-1487-0x00007FFD8F1C0000-0x00007FFD8F1D9000-memory.dmp	upx
behavioral1/memory/2620-1488-0x00007FFD93BA0000-0x00007FFD93BAD000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
670	api.ipify.org
671	api.ipify.org

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_240621250	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinCon64.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Default64.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Default64.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WinCon64.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-621.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-621.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-621.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Runtime Broker.exe	Synapse Launcher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1752	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5664	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	WinRAR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	WinRAR.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133266523373968419"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r10\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r01\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r04\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r29	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r24\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r06	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzst\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r25	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.gz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r09\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r17\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r26	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r02	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r23	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r08\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r13	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r15	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.z	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r26\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r20\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r10	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r00\ = "WinRAR"	uninstall.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4340	chrome.exe
4340	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5148	WinRAR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 59 IoCs

pid	Process
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe
Token: SeShutdownPrivilege	4340	chrome.exe
Token: SeCreatePagefilePrivilege	4340	chrome.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
5148	WinRAR.exe
5148	WinRAR.exe
5148	WinRAR.exe
5148	WinRAR.exe
5148	WinRAR.exe
5148	WinRAR.exe
5148	WinRAR.exe
5148	WinRAR.exe
5148	WinRAR.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe
4340	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5144	winrar-x64-621.exe
5144	winrar-x64-621.exe
5148	WinRAR.exe
5148	WinRAR.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 5060	4340	chrome.exe	68
PID 4340 wrote to memory of 5060	4340	chrome.exe	68
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3096	4340	chrome.exe	71
PID 4340 wrote to memory of 3080	4340	chrome.exe	70
PID 4340 wrote to memory of 3080	4340	chrome.exe	70
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72
PID 4340 wrote to memory of 4916	4340	chrome.exe	72

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\My Logo.txt"
1⤵
PID:3260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd93d19758,0x7ffd93d19768,0x7ffd93d19778
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1944 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:2
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3576 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4412 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4680 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4844 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4424 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4720 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4956 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4616 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4664 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2440 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:3128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4696 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3280 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3016 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4504 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4484 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4648 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5924 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=6012 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5960 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6340 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=6644 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6484 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6016 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=6036 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=5956 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=6164 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=5952 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=6084 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=7164 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=6180 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=7336 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=6420 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=4496 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=5436 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=5372 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=5492 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=3132 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=7260 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4356 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=6108 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=7496 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=5932 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=6716 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=5868 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=6704 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=6136 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=7456 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=7676 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=6568 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=59 --mojo-platform-channel-handle=6232 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=8028 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=7820 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=62 --mojo-platform-channel-handle=8108 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=63 --mojo-platform-channel-handle=7792 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=64 --mojo-platform-channel-handle=7732 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=66 --mojo-platform-channel-handle=7808 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=65 --mojo-platform-channel-handle=7692 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=67 --mojo-platform-channel-handle=8928 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=68 --mojo-platform-channel-handle=9068 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=69 --mojo-platform-channel-handle=9072 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=9204 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=71 --mojo-platform-channel-handle=9568 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=9564 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=9884 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=10036 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=75 --mojo-platform-channel-handle=7712 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=76 --mojo-platform-channel-handle=9228 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=77 --mojo-platform-channel-handle=10416 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10700 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10760 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10672 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10620 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5032 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:5996
- C:\Users\Admin\Downloads\winrar-x64-621.exe
  "C:\Users\Admin\Downloads\winrar-x64-621.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:5144
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10764 --field-trial-handle=1700,i,17748409575950261810,16581798534288325324,131072 /prefetch:8
  2⤵
  PID:5152

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5408

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Desktop\synapse-v2-launcher-4-11-23.zip"
1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5148

C:\Users\Admin\Desktop\synapse-v2-launcher-4-11-23\Synapse Launcher.exe
"C:\Users\Admin\Desktop\synapse-v2-launcher-4-11-23\Synapse Launcher.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:212
- C:\Users\Admin\AppData\Local\main.exe
  "C:\Users\Admin\AppData\Local\main.exe"
  2⤵
  - Executes dropped EXE
  PID:1204
- - C:\Users\Admin\AppData\Local\main.exe
    "C:\Users\Admin\AppData\Local\main.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:4888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
      4⤵
      PID:3468
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        5⤵
        
        PID:3964
- C:\Windows\Runtime Broker.exe
  "C:\Windows\Runtime Broker.exe"
  2⤵
  - Executes dropped EXE
  PID:4952
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    PID:836
- C:\Users\Admin\AppData\Local\Client Server Runtime Process.exe
  "C:\Users\Admin\AppData\Local\Client Server Runtime Process.exe"
  2⤵
  - Executes dropped EXE
  PID:4460
- - C:\Users\Admin\AppData\Local\Client Server Runtime Process.exe
    "C:\Users\Admin\AppData\Local\Client Server Runtime Process.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Unblock-File '.\Client Server Runtime Process.exe'"
      4⤵
      PID:4276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Unblock-File '.\Client Server Runtime Process.exe'
        5⤵
        
        PID:3084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "net session"
      4⤵
      PID:4436
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        
        PID:3680
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:3280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Client Server Runtime Process.exe'"
      4⤵
      PID:5492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Client Server Runtime Process.exe'
        5⤵
        
        PID:4236
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"
      4⤵
      PID:5448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        5⤵
        
        PID:3548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      PID:5200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        5⤵
        
        PID:4172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:5460
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:2964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:5876
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:1752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /IM svchost.exe"
      4⤵
      PID:3536
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM svchost.exe
        5⤵
        Kills process with taskkill
        
        PID:5664
- C:\Users\Admin\AppData\Roaming\build.exe
  "C:\Users\Admin\AppData\Roaming\build.exe"
  2⤵
  - Executes dropped EXE
  PID:5904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_000031

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031
Size 28KB
SHA256 3eaa0a64173bb0af94802103bc77aa47c395021edae232706cdb008f2db38c1e
MD5 9c8e6d7913552303cb09b0dabfae3788
SHA1 6042659bcfded553734f7eade0824d9059cd21a0
SHA512 72a0e757865065cb840a25bf207d267852412bce62545149ea7f98934c45a15d07cf9ebe43e6fa076fc11713b4a4a490ed954ba95863ed9982fbbd2b2674520e
SSDEEP 768:MRvMPsAnYFCVur72a+tunwtaeYBbDjY4Hf:MqUwtVuf23tuwAx
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000046
Size 19KB
SHA256 847004cefb32f85a9cc16b0b1eb77529ff5753680c145bfcb23f651d214737db
MD5 ca7fbbfd120e3e329633044190bbf134
SHA1 d17f81e03dd827554ddd207ea081fb46b3415445
SHA512 ab85f774403008f9f493e5988a66c4f325cbcfcb9205cc3ca23b87d8a99c0e68b9aaa1bf7625b4f191dd557b78ef26bb51fe1c75e95debf236f39d9ed1b4a59f
SSDEEP 384:LhrrbLQlGGB/elLPOCqCGSVREuPbrOQ78AEV9uADEc0EZxXMBM36:LZbL1G8LVakEunOQL+DEcdEF
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 cbb97b1e6db7fb83fa7f25dceabd63088dd92e141ba76b9e2eb12b878b3113bf
MD5 b8aa601b5aeea3e26486d1d957137b4f
SHA1 dfe64a64029c2222e876b0c1522af6812fe22447
SHA512 92a4d302e2d17d0efa331facab79a4ed2b5e3ac9aa145cbc53a635f03b4e24ca5df4fe1bb5622670f8018f8d399fe234199e99320699d7dd823066569a4400a9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 2831f196ff2cd878abc9158c623271f61382efadbc8d55dc136d848381815355
MD5 475de20f8c867e2938941a65fac74e61
SHA1 41504475772f66e2f0124c6dda52f5a6ec530dd4
SHA512 792fa515dea377c84dc9750d7e4e7d9fcd32b8888a2ae4946a0caf42983821c011e5909756b5cfc7cff68ddd755d7aded8fb805453c1bf3920eb4eabe41da6ed
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
Size 264KB
SHA256 83073fdae149cfc34ac73f5f24fb6fd0428cf42bdfae7f4c646a38cdf0a3386d
MD5 235903e4803d7b6dbdce88091f15886c
SHA1 0fb5c28f92e80359dc0551d05d3c2721d7d60bbb
SHA512 922e95ff8fdfacc6d6ac89f34bd4365b483d67e3e277737666b970f6cd32375b4c91c355153a22afc427753ec9666a5c31bf7b8b6c012ef8393ca3c6e686fe48
SSDEEP 3:MsEllllkEthXllkl2zE/lgug4:/M/xT02zRu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 2736c3b1ea9aa749d40ae9b8e88c402d00c52142718869c6c368e1705a88a512
MD5 711a59e68be4a738c41cd28be1c709fb
SHA1 93b7b7c3f4f556bd16a99a4fa5da18aaa27858a1
SHA512 26cc854b60c615ad7395dc1f79589ab7ad9dc1f9172b7cd26f0069d94dc539659dd1f258be256103fe4d615bdbc577d56b14c087346c61a507878dc8124b7fd6
SSDEEP 384:pN0qQAm6VwSfH+QfGefLOZWxKeZLzzEJtA6jq1j6cF67lAKxFIL8o3JuqJ4Ne6r7:J52V91rvHcSlLWsb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 0830755f611d0cd523e40db4fed5acb1cebf29be2030823c8de84b019e6c3542
MD5 190319a52ecab1d656eb5e32b835dfd1
SHA1 a68a88104663d0f9d829fed11a9c3698906c1908
SHA512 f616bc84b8f16abcd0da0fba2810d6c9031d3d2952cde0be88a9ee8ce75493aee9363836d0d86052f88ac480268ea2575e3afcb6a0408110210571ac3b349c13
SSDEEP 384:pN0qQAm6V4QfGefLOZWxeZLtEJtA6jq1j6cF67lIIL8o3JT4Ne6reIr6sz6AuDKh:J5xV9MrUHRFtfGX4s
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 872B
SHA256 6bee13cf8fa2ef07302a287d04808f10ea96b6693c90399ba4854c8d590f80f0
MD5 2031baf05109158469a3bb4046042ab9
SHA1 a40ed1a0db92970665af9a33a210657988c13f9a
SHA512 955762fc75972d93e4a853a25ead50dcefd59e5702fe3e6603f584b27b1091cf2bf4625831442adf8da549804fd7cc9bc57e15736eeaafea4d70af0ef456a606
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 86d66865f06d45ffa931304cfb66e629fa0cecb27ad7e67412e99bca1cdf35a9
MD5 bfdc3f3a53f5614fe6267f8080416afc
SHA1 df8f44612fbaac5341e270446bb24b3a24972dca
SHA512 aceaea9c3b1b9fffcc108da7421344c1559d5427cf24f68e2dc6ccaec67b077fb340625f93caf6fe10457b23804ea6faade803c03b4781f4242c271e282b7fc6
SSDEEP 96:BUTIAUl/gUb/UUmx/E+UrXeUO/gieUz/4sUA/rbUB/BUS/8Uc/wUUFU7/1ULwNU+:BUUAUWUQUmHUTeUlU8sUQUPUBUvUGU5v
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 b7b7da96665de2f230b011c88aa6256a8b38ad07b7c8c9c727a3a913f8503230
MD5 b4c1ad666207536e078f9a06677572a8
SHA1 90608652ab480de5b8f7736b920bd326813b244c
SHA512 d40bddf889f01db1a4e6942638376eca85c8c5513704e16805e4fa1f097464501869100affffb84d80f6ba2a4981647645caa05e10bb6c4cf9afc0419c1c2c10
SSDEEP 192:BUUAUWUQUmHUTeUlU8sUlMUuUPUBUyUdUNNUPUMUw5UhIUEU4U/UfUVU5U7Uw7Um:B3AT/LNkhsD34GH+OUNJ5CIV/UCwo6J/
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 544406f2f815c09841072c7298038912f6038dae09bfb9266ef1dc4c921e0f90
MD5 45d28fef9ade58b3703f62a941a0c74f
SHA1 60c69c7f6f7a6d9007cdc98894c6fe4e7c562377
SHA512 1c940d4343e8161474009d8a5554f3d72f97eb1cd5747ad72d0afc53d4db0964bd4ceb5f4edb8ad1f8a47bf4d04ba7012f1ad4a7669a20fd609c2a15761f888f
SSDEEP 192:BUUAUWUQUmHUTeUKUFsUlMUuUPUBUyUdUNNUPUMUwyUyIUEU4U/UfUVU5U7Uw7UW:B3AT/LNvwsD34GH+OUNJyZIV/UCwo6JH
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 5KB
SHA256 a36b578654110612db18b29717d8db8e7ca0fc4409c153f8809da13420dc5ab2
MD5 e614a72d00294502a1cd859dc0c78653
SHA1 90effac1f0e993d13fb8cd40f4b4509a69e18cfd
SHA512 3fabc956477ff692f4a3070734515a3007df73577c8dbcecb0362ce0dbd73c8dae63d11d69c1474fed52bf392a2ba2f68368db2ef9ab5c49e5c2c0ca044ecfd2
SSDEEP 96:CUKIAUl/gUb/UUmx/0+UbXeUO/gieUz/4sUA/rbUB/8Uc/wUU/1ULWNUgtUx/DIC:CUrAUWUQUmDUDeUlU8sUQUuUvUaUiUey
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 1d6e916dc7571a4e34213fc1e40a4abf01941cdf22fc8c2be5e243f41781595c
MD5 8cf5ad3c87874688ca93ef7c77fdd81e
SHA1 dacd73682a8ce6744047a44010abf3cac3242e60
SHA512 df9956c6544bbd1919d36cf62b0cc38731b4122aa3d74e03f1329189761971b5007c6927eef5f17b295f06e0631b19cd8c2546e68e7123396cb42cc20b340c5b
SSDEEP 96:NadlFKIoL508iZRy7Di+6MPRgmdeFk/1ck4MkzOjOjjVhYtjEsXt0/cg2Vup:NSFW08syy+FP+k/Ck4jotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 b29cd16b9cd0ec9bcfa649436c82d8f520b412b87afe6f7c7d752efd138e117c
MD5 c611b52046a8e1faef84643614865697
SHA1 0bb9c9770dd7915df0ee19e6a78bcdd6ca78e374
SHA512 7fbbebdf970155737895069b94ed756950fc3eb66a49d150eca8761fa63983c433bfe74d2f69eccb80ef59a0e5a9e46776525acdce4cf0d490c1c4e6aba24ed0
SSDEEP 96:EadZFKIoL508iZRy7Di+6MPRgmdeFk/1bIOjOjjVhYtjEsXt0/cg2Vup:EaFW08syy+FP+k/8otjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 fa063054095e530c26123af4229fe761675cae591480854388a38720333dd8d0
MD5 fd3fb0d1db5901325cd2f33715a6fa40
SHA1 fbf7673dc8ebdae16ae8d03be58a953d4a1afbee
SHA512 3369d031b98cf59bcedeb15e4b248a2a8906b29801d934d1289514c10f1ba4cf381a31c856bdc7befb03ae2713feb6d57ee0836ced0f2e932625ae3cc6a7c4d0
SSDEEP 96:EadZFKIoL508iZRy7Di+6MPRgmdeFk/1QKkH1LeOjOjjVhYtjEsXt0/cg2Vup:EaFW08syy+FP+k/HkHGotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 8a604d990ba58d97755794b88fbc774b1ef9a7c4aec90e467d7a7a3c8a4fcbae
MD5 a3839bc7fb37adec4e41973dcce9a518
SHA1 f7085a2eb7fecb329eb0ab67e98d52c0eb619ad6
SHA512 30e8b06a0b63de63bc4c79a8566e50e351af749a02dc3b9c8e69a2d0fc78583b6f005787191fa7347904f6979ddfa5b5c50c4f28061b862e009241dbf1297419
SSDEEP 192:NYc2kJ3FWa8syy+FPDDUx+k/Ck4Xkeb2tjEsXtScPS:NYc3wQyxne0jKtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 12KB
SHA256 de0014c33842a5397f3dedfcfa304dfad4f10fd8aa72d59a8058877924fe5d2e
MD5 2819b8093a1ea14808e983ad818de5cd
SHA1 1f9510bd1aeb082538c138aa15ac2c8eb74328fe
SHA512 146cca9d720ae0f0c0cc2b00905b2dcf6a2d9205d2f2c7adde5785b42e1ce8bae817c8f096cea356e6b3982857d87406b4266799d589f5847040d3f8432a5103
SSDEEP 384:9CX51kXqKf/pUZNCgVLH2HfkYrUwHGdenUaDwM:+51kXqKf/pUZNCgVLH2HfDrU0Gdo
MD5 SHA1 SHA512 SSDEEP

Submit Download

a025ffa4-63ce-4447-b615-42179db2e8f2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a025ffa4-63ce-4447-b615-42179db2e8f2.tmp
Size 7KB
SHA256 d25c29f29b6a2904f716720da3fefb072b47f9f0ba17a7c918cbcf9cdc6a2940
MD5 883ff7fd3adad4fe48145395a654d43a
SHA1 d051d8ea158882dee03ad1c267bcf3020ddf0f9f
SHA512 17f4d4c3372d1e66da62987e921571dea70e1dcf0f60294615b3bd6c5f468e19a9eac8ea374b3feb30ae4937e515ca4a31174d06d3d59d2df30c0ebf82edbfad
SSDEEP 192:NYc2kJpFWa81+yy+FPDU+k/Ck4XkeAotjEsXtScPS:NYcpwEyxL00jDtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 bbf9e7bf4e90a19e1a60f85cc6cb537027b7d278b854b1b864ca6d46677fc994
MD5 acdc1570ede37484b8331e4473aa1d54
SHA1 6b23ef8d573381653bc28a8c9f2a6b36b9955805
SHA512 3b75a8075dd14130edd3135cfc69e161b6ce3280a6bcc9b5c17839ced5857aa5ad03f34d2dc143585464cfdee70c5fb43eef30a8cf3a487f499bc39aaa67db22
SSDEEP 3072:BX48EeIxJS2qN/b929d+APqyixVFBDjG4PDKU8wH/Q/6Zp/viVwg0GOM7Vzo:eX+2i2z6yi/jPPDX8w4/S/viVLjhs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 1ce65bfcc4e1535aaac3bb493b975bd7de953747d6e12f876afdd5ba044f92b4
MD5 9ca358ca8a396240cfe710802de0d3ff
SHA1 6e9f2839ea1411f9e463905a86e35b6af13eb3df
SHA512 b24388660e745b943a1f149fc3ab542502c87eb2345f7b91a7c4c7e6b5d27d3255a5a51b2e74e8aa72198634d72d76ef1742facf88eb30d9c80d31af3f0ecddf
SSDEEP 3072:vX48EeIxJS2qN/b929d+APqyixVFBDjG4PDKU8wH/Q/6Zp/viVwg0GOM7Vzo:gX+2i2z6yi/jPPDX8w4/S/viVLjhs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 200KB
SHA256 31d789fcdf486d96cb725836458692b62c7c2ca99b04e715ff2aae567b452c37
MD5 6d0bb1fdeee5bbeb451741986634f782
SHA1 d90d61137bec879dcfb95da45898937e09ff8aa0
SHA512 afa7c38c5ae51668585861f3cecb3f59b66024d263ad9832a15ca0ad17338408c265dbe9beafd639ad174cee1d881df55caec352456e1b1a7ec1df01acaaff67
SSDEEP 3072:9X48EeIxJS2qN/b929d+APqyixVFBDjG4PDKU8wH/Q/6Zp/viVwg0GOM7Vzo:iX+2i2z6yi/jPPDX8w4/S/viVLjhs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 111KB
SHA256 15b80fd21b0778e404af3b30aac2b30a1ca93d3c75cc3d6aad0df941c2db8eb0
MD5 eca762ed3f04b498d0c3fe5a458337aa
SHA1 7c940ccce1dbc250bd20c73b971d49e536ea14dc
SHA512 f4ba3b483f066f08d39df3e5d74373a57cc137e74e06ae626c23deea6046b33929ab1b731e0a17b4e44737d7b74d53b213b2b4258b34fc3f9ac607f89b9e1f57
SSDEEP 384:5NIBS+YgMnunTfJflxz0mER8uV4FABtFmYM+AMnGgo/CZfyS7O2mLAkYed2W6oXy:5D+YgZxKs1cMbPMAiAKR3iqYs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 104KB
SHA256 72745889dd687a51235bb482455831f9e809df79826b4f8d9c011eab97473024
MD5 722977334f8c901700d097a783bf248c
SHA1 982e5093770cdf0c6370cd0cb67794b179293bbd
SHA512 79cb752799c44c7757c4bd96e90d10159c6b38320279835b83944ce3474ddddb52546b987a3989905cc937e99d11e792ee9078e0614b9ba31b77eff159b80424
SSDEEP 384:eNIBS+YgMnunTfJflxz0mER8uVJALy3+AMnio/CZfyS7O2mLAkYed2W6oXyiy0b1:eD+YgZxKb6ccCCMLiAKR3iqYu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe5728b6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5728b6.TMP
Size 97KB
SHA256 f996a8e0e3eee0b64ca31c36e4f51cd86e46b926f28c5177f5e11fc183c935f9
MD5 d918d29f04f2c9e2213871bfd92e1e52
SHA1 f77d7be68f37ccc157340564e8b013831bfe45b2
SHA512 9c056add963529384d0fb0dc758543787a8533e750b988c70f7df84b46fcdd5fc77e83eb49a9ddc084dfc613b5e9052f889488766a68229a10a2009a71ffe464
SSDEEP 384:lNIBS+YgMnu7lkflxz0mW8uVJALz+AZniotCZfym7O2mLAkYed2W6oXyi0bsLUKw:lD+YgUxKb4cXCmM2iAKR3iqYd
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_t22535xn.mgd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t22535xn.mgd.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 8KB
SHA256 3df19294f45716e80221a72977fc8d65c6cc87b01d958c5e6600fe6efe380b47
MD5 27443895ee167eb956fd3a41f3f148cd
SHA1 c758df7391cff2478ae763774d22c64d0433c236
SHA512 973896796e576ce79e9c462a3d0d22611ae9a98a8286f0f876d895fb0e0ebcbd5d9073f7d0095558bf35e138932edab15db1c258e1f25f5a4d6ec79b3fb44cd7
SSDEEP 48:Scd/nIj2yRnJtrtDbepZUkUoLqeho0EqiVcd/nIj2yRnJNrtDIqP+eVRZUkUuqef:S2sPRFmM2sv5lYF+hK2s1ZN2sghPp
MD5 SHA1 SHA512 SSDEEP

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 12KB
SHA256 4921937f87ff64908020bea060178d774802b04e0cc3d8bdeaeb856e72644c11
MD5 b4f7a5dc591b41007709fe2fb94cb6f6
SHA1 1931453f85546532b5294335b984288edbc76c27
SHA512 a2549af29f5c6db4fde33fbba109ec2be0b6410fa8f0043baf30e7a9517fdbbddd868722163a58f697ca489c16f4df60f0e021d4a974d4d9f2a92ceb857c44fc
SSDEEP 96:k2sPRFmt+yhsDQwF+bS+yhsDQh2fF62ybj+yhsv5lYF+hK+yhs1ZN+yhsghPp:kzPQ+yycC+yychjB+yyv5c+yyp+yyS
MD5 SHA1 SHA512 SSDEEP

Submit Download

synapse-v2-launcher-4-11-23.zip

Path C:\Users\Admin\Downloads\synapse-v2-launcher-4-11-23.zip
Size 22.6MB
SHA256 9091bd5c9ebdbe167c3761e028a6155710ab944de1e03ac0ce99b78a2421e5df
MD5 02a04171f274c961f4cf61036ee84855
SHA1 a96ed7d6bdff5f8c62e3b132277378f89d9469de
SHA512 a23c44f756a677e1fdd45241432bcbf4054e325e073390e130d258a7a4858e6d65da80246c5e477fd8e725af898c5be0e77c3f0b0a0143d5a0de46a248c08dc4
SSDEEP 393216:gWx3MtMjgniJaRzdaPfa+HXJBEWX3gBwvKj3Mbr53xBXt71TpEuQIEhTI:gWetBiJizD+JyWX3gPTMb1BZVEjg
MD5 SHA1 SHA512 SSDEEP

Submit Download

winrar-x64-621.exe

Path C:\Users\Admin\Downloads\winrar-x64-621.exe
Size 3.4MB
SHA256 06d6ecc5f9d88636b0bac62218c296bfa1b2222f734c9cbed5575bd9f634e219
MD5 766ac70b840c029689d3c065712cf46e
SHA1 e54f4628076d81b36de97b01c098a2e7ba123663
SHA512 49064dc2c30eecd7320a6431abfee49d250ea7cda5e8ae630d2c55325f5bdf338355ae8d7a3246b4036afce5c100b8b30599baf19ab64d20190392d2d9a28608
SSDEEP 98304:JXBOBfKwtPLkq+mYc1SItulce0nDd/n/Y4TsL0Ffxm:JX/wtgdxIece0nelj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2620-1508-0x00007FFD8F6A0000-0x00007FFD8F6AD000-memory.dmp

Download

memory/2620-1403-0x00007FFD7F7A0000-0x00007FFD7F7BF000-memory.dmp

Download

memory/2620-1278-0x00007FFD7F180000-0x00007FFD7F5EE000-memory.dmp

Download

memory/2620-1549-0x00000240234A0000-0x00000240236F2000-memory.dmp

Download

memory/2620-1283-0x00007FFD93EC0000-0x00007FFD93ECF000-memory.dmp

Download

memory/2620-1547-0x00007FFD8F290000-0x00007FFD8F2B9000-memory.dmp

Download

memory/2620-1285-0x00007FFD8F6B0000-0x00007FFD8F6C9000-memory.dmp

Download

memory/2620-1546-0x00007FFD8F2C0000-0x00007FFD8F2D6000-memory.dmp

Download

memory/2620-1286-0x00007FFD8F480000-0x00007FFD8F4AD000-memory.dmp

Download

memory/2620-1545-0x00007FFD93BD0000-0x00007FFD93BDE000-memory.dmp

Download

memory/2620-1288-0x00007FFD93BA0000-0x00007FFD93BAD000-memory.dmp

Download

memory/2620-1544-0x00007FFD8F890000-0x00007FFD8F8CF000-memory.dmp

Download

memory/2620-1290-0x00007FFD8F150000-0x00007FFD8F17E000-memory.dmp

Download

memory/2620-1543-0x00007FFD8F8D0000-0x00007FFD8F8E5000-memory.dmp

Download

memory/2620-1292-0x00007FFD8EEE0000-0x00007FFD8EF9C000-memory.dmp

Download

memory/2620-1293-0x00007FFD8F860000-0x00007FFD8F86A000-memory.dmp

Download

memory/2620-1294-0x00007FFD8EEC0000-0x00007FFD8EEDC000-memory.dmp

Download

memory/2620-1542-0x00007FFD905D0000-0x00007FFD905E3000-memory.dmp

Download

memory/2620-1296-0x00007FFD8DB80000-0x00007FFD8DBAE000-memory.dmp

Download

memory/2620-1297-0x00007FFD79450000-0x00007FFD797C5000-memory.dmp

Download

memory/2620-1298-0x0000024021D30000-0x00000240220A5000-memory.dmp

Download

memory/2620-1300-0x00007FFD8F1B0000-0x00007FFD8F1BB000-memory.dmp

Download

memory/2620-1299-0x00007FFD8F6A0000-0x00007FFD8F6AD000-memory.dmp

Download

memory/2620-1541-0x00007FFD7A930000-0x00007FFD7A94B000-memory.dmp

Download

memory/2620-1540-0x00007FFD78990000-0x00007FFD789A4000-memory.dmp

Download

memory/2620-1304-0x00007FFD78D20000-0x00007FFD78E91000-memory.dmp

Download

memory/2620-1305-0x00007FFD8DB70000-0x00007FFD8DB7B000-memory.dmp

Download

memory/2620-1306-0x00007FFD84A10000-0x00007FFD84A1C000-memory.dmp

Download

memory/2620-1307-0x00007FFD7F080000-0x00007FFD7F08C000-memory.dmp

Download

memory/2620-1301-0x00007FFD81220000-0x00007FFD81245000-memory.dmp

Download

memory/2620-1308-0x00007FFD7F070000-0x00007FFD7F07B000-memory.dmp

Download

memory/2620-1309-0x00007FFD7A920000-0x00007FFD7A92C000-memory.dmp

Download

memory/2620-1310-0x00007FFD7A900000-0x00007FFD7A90E000-memory.dmp

Download

memory/2620-1313-0x00007FFD7A8E0000-0x00007FFD7A8EC000-memory.dmp

Download

memory/2620-1314-0x00007FFD7A8D0000-0x00007FFD7A8DB000-memory.dmp

Download

memory/2620-1315-0x00007FFD7A620000-0x00007FFD7A62C000-memory.dmp

Download

memory/2620-1312-0x00007FFD7A8F0000-0x00007FFD7A8FC000-memory.dmp

Download

memory/2620-1317-0x00007FFD7A600000-0x00007FFD7A60D000-memory.dmp

Download

memory/2620-1316-0x00007FFD7A610000-0x00007FFD7A61C000-memory.dmp

Download

memory/2620-1318-0x00007FFD7A5C0000-0x00007FFD7A5D2000-memory.dmp

Download

memory/2620-1320-0x00007FFD7A590000-0x00007FFD7A5A5000-memory.dmp

Download

memory/2620-1319-0x00007FFD7A5B0000-0x00007FFD7A5BC000-memory.dmp

Download

memory/2620-1322-0x00007FFD7A580000-0x00007FFD7A590000-memory.dmp

Download

memory/2620-1324-0x00007FFD78990000-0x00007FFD789A4000-memory.dmp

Download

memory/2620-1539-0x00007FFD7A580000-0x00007FFD7A590000-memory.dmp

Download

memory/2620-1538-0x00007FFD7A590000-0x00007FFD7A5A5000-memory.dmp

Download

memory/2620-1537-0x00007FFD7A5B0000-0x00007FFD7A5BC000-memory.dmp

Download

memory/2620-1367-0x00007FFD90160000-0x00007FFD90184000-memory.dmp

Download

memory/2620-1369-0x00007FFD8F1C0000-0x00007FFD8F1D9000-memory.dmp

Download

memory/2620-1536-0x00007FFD7A5C0000-0x00007FFD7A5D2000-memory.dmp

Download

memory/2620-1534-0x00007FFD7A610000-0x00007FFD7A61C000-memory.dmp

Download

memory/2620-1373-0x00007FFD8F0F0000-0x00007FFD8F11B000-memory.dmp

Download

memory/2620-1535-0x00007FFD7A600000-0x00007FFD7A60D000-memory.dmp

Download

memory/2620-1533-0x00007FFD7A620000-0x00007FFD7A62C000-memory.dmp

Download

memory/2620-1532-0x00007FFD7A8C0000-0x00007FFD7A8CB000-memory.dmp

Download

memory/2620-1531-0x00007FFD7A8D0000-0x00007FFD7A8DB000-memory.dmp

Download

memory/2620-1397-0x00007FFD797D0000-0x00007FFD79888000-memory.dmp

Download

memory/2620-1398-0x00007FFD818F0000-0x00007FFD81904000-memory.dmp

Download

memory/2620-1530-0x00007FFD7A8E0000-0x00007FFD7A8EC000-memory.dmp

Download

memory/2620-1400-0x00007FFD78EA0000-0x00007FFD78FB8000-memory.dmp

Download

memory/2620-1527-0x00007FFD7A910000-0x00007FFD7A91D000-memory.dmp

Download

memory/2620-1406-0x00007FFD8EDE0000-0x00007FFD8EDEB000-memory.dmp

Download

memory/2620-1409-0x00007FFD81210000-0x00007FFD8121B000-memory.dmp

Download

memory/2620-1412-0x00007FFD7A910000-0x00007FFD7A91D000-memory.dmp

Download

memory/2620-1479-0x00007FFD90160000-0x00007FFD90184000-memory.dmp

Download

memory/2620-1477-0x00007FFD7F180000-0x00007FFD7F5EE000-memory.dmp

Download

memory/2620-1481-0x00007FFD93EC0000-0x00007FFD93ECF000-memory.dmp

Download

memory/2620-1483-0x00007FFD8F6B0000-0x00007FFD8F6C9000-memory.dmp

Download

memory/2620-1484-0x00007FFD8F480000-0x00007FFD8F4AD000-memory.dmp

Download

memory/2620-1487-0x00007FFD8F1C0000-0x00007FFD8F1D9000-memory.dmp

Download

memory/2620-1488-0x00007FFD93BA0000-0x00007FFD93BAD000-memory.dmp

Download

memory/2620-1492-0x00007FFD8EEE0000-0x00007FFD8EF9C000-memory.dmp

Download

memory/2620-1491-0x00007FFD8F150000-0x00007FFD8F17E000-memory.dmp

Download

memory/2620-1495-0x00007FFD8F0F0000-0x00007FFD8F11B000-memory.dmp

Download

memory/2620-1500-0x00007FFD8DB80000-0x00007FFD8DBAE000-memory.dmp

Download

memory/2620-1499-0x00007FFD8EEC0000-0x00007FFD8EEDC000-memory.dmp

Download

memory/2620-1502-0x00007FFD797D0000-0x00007FFD79888000-memory.dmp

Download

memory/2620-1505-0x00007FFD79450000-0x00007FFD797C5000-memory.dmp

Download

memory/2620-1497-0x00007FFD8F860000-0x00007FFD8F86A000-memory.dmp

Download

memory/2620-1507-0x00007FFD818F0000-0x00007FFD81904000-memory.dmp

Download

memory/2620-1528-0x00007FFD7A900000-0x00007FFD7A90E000-memory.dmp

Download

memory/2620-1509-0x00007FFD8F1B0000-0x00007FFD8F1BB000-memory.dmp

Download

memory/2620-1510-0x00007FFD81220000-0x00007FFD81245000-memory.dmp

Download

memory/2620-1511-0x00007FFD78EA0000-0x00007FFD78FB8000-memory.dmp

Download

memory/2620-1512-0x00007FFD7F7A0000-0x00007FFD7F7BF000-memory.dmp

Download

memory/2620-1513-0x00007FFD78D20000-0x00007FFD78E91000-memory.dmp

Download

memory/2620-1516-0x00007FFD8EDE0000-0x00007FFD8EDEB000-memory.dmp

Download

memory/2620-1517-0x00007FFD8DB70000-0x00007FFD8DB7B000-memory.dmp

Download

memory/2620-1518-0x00007FFD84A10000-0x00007FFD84A1C000-memory.dmp

Download

memory/2620-1520-0x00007FFD81210000-0x00007FFD8121B000-memory.dmp

Download

memory/2620-1522-0x00007FFD7F080000-0x00007FFD7F08C000-memory.dmp

Download

memory/2620-1524-0x00007FFD7A920000-0x00007FFD7A92C000-memory.dmp

Download

memory/2620-1523-0x00007FFD7F070000-0x00007FFD7F07B000-memory.dmp

Download

memory/2620-1529-0x00007FFD7A8F0000-0x00007FFD7A8FC000-memory.dmp

Download

memory/3084-1347-0x000001C673130000-0x000001C6731A6000-memory.dmp

Download

memory/3084-1329-0x000001C672F80000-0x000001C672FA2000-memory.dmp

Download

memory/4836-1302-0x00007FFD7F7C0000-0x00007FFD7F7E9000-memory.dmp

Download

memory/4836-1370-0x00007FFD8F120000-0x00007FFD8F14E000-memory.dmp

Download

memory/4836-1376-0x00007FFD8F7F0000-0x00007FFD8F7FD000-memory.dmp

Download

memory/4836-1372-0x00007FFD7F0C0000-0x00007FFD7F178000-memory.dmp

Download

memory/4836-1374-0x00007FFD8EDF0000-0x00007FFD8EE04000-memory.dmp

Download

memory/4836-1371-0x00007FFD79890000-0x00007FFD79C05000-memory.dmp

Download

memory/4836-1303-0x00007FFD7F090000-0x00007FFD7F0BE000-memory.dmp

Download

memory/4836-1638-0x00007FFD7F0C0000-0x00007FFD7F178000-memory.dmp

Download

memory/4836-1399-0x00007FFD78FC0000-0x00007FFD79212000-memory.dmp

Download

memory/4836-1637-0x00007FFD79890000-0x00007FFD79C05000-memory.dmp

Download

memory/4836-1396-0x00007FFD7A630000-0x00007FFD7A7A1000-memory.dmp

Download

memory/4836-1636-0x00007FFD8F120000-0x00007FFD8F14E000-memory.dmp

Download

memory/4836-1284-0x00007FFD8FDC0000-0x00007FFD8FDED000-memory.dmp

Download

memory/4836-1291-0x00007FFD90050000-0x00007FFD9005D000-memory.dmp

Download

memory/4836-1289-0x00007FFD8F180000-0x00007FFD8F199000-memory.dmp

Download

memory/4836-1287-0x00007FFD8F1E0000-0x00007FFD8F1F9000-memory.dmp

Download

memory/4836-1295-0x00007FFD8EAF0000-0x00007FFD8EB0F000-memory.dmp

Download

memory/4836-1282-0x00007FFD79C10000-0x00007FFD7A07E000-memory.dmp

Download

memory/4836-1634-0x00007FFD8F180000-0x00007FFD8F199000-memory.dmp

Download

memory/4836-1631-0x00007FFD79C10000-0x00007FFD7A07E000-memory.dmp

Download

memory/4952-1191-0x0000017259700000-0x0000017259730000-memory.dmp

Download

memory/4952-1277-0x0000017259A80000-0x0000017259A90000-memory.dmp

Download

memory/5904-1279-0x00000000050A0000-0x0000000005106000-memory.dmp

Download

memory/5904-1276-0x00000000006B0000-0x0000000000842000-memory.dmp

Download