Overview

overview

9

Static

static

3

Synapse.exe

windows7-x64

7

Synapse.exe

windows10-2004-x64

9

Synapse.pyc

windows7-x64

3

Synapse.pyc

windows10-2004-x64

3

Resubmissions

12/05/2024, 05:00

240512-fm7dfahg8s

12/05/2024, 04:36

240512-e8aqxsca796

12/05/2024, 04:26

240512-e2tkfsbf569

12/05/2024, 04:22

240512-ezqqsabe5610

12/05/2024, 04:18

240512-ewyxzsbd268

Analysis

  • max time kernel
    463s
  • max time network
    471s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 04:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Synapse.exe
  • Size 17.5MB
  • Sample240512-e2tkfsbf56
  • SHA256 fb025a0aa34315c3287c087cc598598732f8e96cbcba4cd5ea2d728a270e5467
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
discoveryevasionexecutionspywarestealerupx

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 36 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 18 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Synapse.exe
    "C:\Users\Admin\AppData\Local\Temp\Synapse.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Users\Admin\AppData\Local\Temp\Synapse.exe
      "C:\Users\Admin\AppData\Local\Temp\Synapse.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2308
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3532
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3308
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4128
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:776
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1644
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5056
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:976
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        3⤵
          PID:4812
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic os get Caption
            4⤵
              PID:1784
          • C:\Windows\System32\Wbem\wmic.exe
            wmic cpu get Name
            3⤵
              PID:4020
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              3⤵
                PID:4336
                • C:\Windows\System32\Conhost.exe
                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  4⤵
                    PID:1448
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic path win32_VideoController get name
                    4⤵
                    • Detects videocard installed
                    PID:4556
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                  3⤵
                    PID:4056
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic computersystem get totalphysicalmemory
                      4⤵
                        PID:5008
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
                      3⤵
                        PID:1988
                        • C:\Windows\System32\wbem\WMIC.exe
                          C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
                          4⤵
                            PID:1480
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                      1⤵
                        PID:5032
                      • C:\Users\Admin\Desktop\Synapse.exe
                        "C:\Users\Admin\Desktop\Synapse.exe"
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4848
                        • C:\Users\Admin\Desktop\Synapse.exe
                          "C:\Users\Admin\Desktop\Synapse.exe"
                          2⤵
                          • Drops startup file
                          • Loads dropped DLL
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:5020
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2712
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic csproduct get uuid
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3860
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3676
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1212
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3496
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3124
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:452
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                            3⤵
                              PID:2792
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic os get Caption
                                4⤵
                                  PID:3744
                              • C:\Windows\System32\Wbem\wmic.exe
                                wmic cpu get Name
                                3⤵
                                  PID:1784
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                  3⤵
                                    PID:2556
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic path win32_VideoController get name
                                      4⤵
                                      • Detects videocard installed
                                      PID:2320
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                    3⤵
                                      PID:3572
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic computersystem get totalphysicalmemory
                                        4⤵
                                          PID:2432
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
                                        3⤵
                                          PID:1448
                                          • C:\Windows\System32\wbem\WMIC.exe
                                            C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
                                            4⤵
                                              PID:3616
                                      • C:\Windows\system32\NOTEPAD.EXE
                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\op0HIx95km\Browser\cc's.txt
                                        1⤵
                                          PID:4092
                                        • C:\Windows\system32\NOTEPAD.EXE
                                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\op0HIx95km\Browser\roblox cookies.txt
                                          1⤵
                                            PID:3196
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                            1⤵
                                            • Enumerates system info in registry
                                            • Modifies data under HKEY_USERS
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of WriteProcessMemory
                                            PID:4008
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x120,0x124,0x128,0x100,0x12c,0x7ffc3fefab58,0x7ffc3fefab68,0x7ffc3fefab78
                                              2⤵
                                                PID:4088
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:2
                                                2⤵
                                                  PID:2460
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:8
                                                  2⤵
                                                    PID:1564
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2192 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:8
                                                    2⤵
                                                      PID:5076
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:1
                                                      2⤵
                                                        PID:3280
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:1
                                                        2⤵
                                                          PID:452
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4360 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:1
                                                          2⤵
                                                            PID:1008
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4488 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:8
                                                            2⤵
                                                              PID:4380
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4664 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:8
                                                              2⤵
                                                                PID:3532
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4652 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:1
                                                                2⤵
                                                                  PID:4624
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3272 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:8
                                                                  2⤵
                                                                    PID:3804
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3312 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:8
                                                                    2⤵
                                                                      PID:1480
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:8
                                                                      2⤵
                                                                        PID:2712
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4388 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:1
                                                                        2⤵
                                                                          PID:3940
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3244 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:1
                                                                          2⤵
                                                                            PID:2368
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:8
                                                                            2⤵
                                                                              PID:1112
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5408 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:1
                                                                              2⤵
                                                                                PID:2664
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:8
                                                                                2⤵
                                                                                  PID:804
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5344 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:8
                                                                                  2⤵
                                                                                    PID:624
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5652 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:8
                                                                                    2⤵
                                                                                      PID:3580
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4228 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:8
                                                                                      2⤵
                                                                                        PID:3132
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5804 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:8
                                                                                        2⤵
                                                                                          PID:1740
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5784 --field-trial-handle=1668,i,13101113582917801851,12812619444801719532,131072 /prefetch:8
                                                                                          2⤵
                                                                                            PID:1432
                                                                                          • C:\Users\Admin\Downloads\FiddlerSetup.5.0.20242.10753-latest.exe
                                                                                            "C:\Users\Admin\Downloads\FiddlerSetup.5.0.20242.10753-latest.exe"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:2372
                                                                                            • C:\Users\Admin\AppData\Local\Temp\nsdB04C.tmp\FiddlerSetup.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\nsdB04C.tmp\FiddlerSetup.exe" /D=
                                                                                              3⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Modifies Internet Explorer settings
                                                                                              • Modifies registry class
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:1960
                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"
                                                                                                4⤵
                                                                                                • Modifies Windows Firewall
                                                                                                PID:324
                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="FiddlerProxy" program="C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"
                                                                                                4⤵
                                                                                                • Modifies Windows Firewall
                                                                                                PID:5036
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
                                                                                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
                                                                                                4⤵
                                                                                                  PID:3416
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
                                                                                                    5⤵
                                                                                                      PID:876
                                                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 294 -Pipe 280 -Comment "NGen Worker Process"
                                                                                                      5⤵
                                                                                                        PID:1776
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 0 -NGENProcess 1e0 -Pipe 1e8 -Comment "NGen Worker Process"
                                                                                                        5⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:2796
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 0 -NGENProcess 290 -Pipe 294 -Comment "NGen Worker Process"
                                                                                                        5⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:5716
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 0 -NGENProcess 2c0 -Pipe 1f8 -Comment "NGen Worker Process"
                                                                                                        5⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:5664
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 0 -NGENProcess 2c4 -Pipe 2e8 -Comment "NGen Worker Process"
                                                                                                        5⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:5844
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 0 -NGENProcess 2f4 -Pipe 2f8 -Comment "NGen Worker Process"
                                                                                                        5⤵
                                                                                                          PID:6020
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 0 -NGENProcess 2e4 -Pipe 2f4 -Comment "NGen Worker Process"
                                                                                                          5⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          PID:6036
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 0 -NGENProcess 2e4 -Pipe 2bc -Comment "NGen Worker Process"
                                                                                                          5⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          PID:4248
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 0 -NGENProcess 2e4 -Pipe 314 -Comment "NGen Worker Process"
                                                                                                          5⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          PID:5792
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 0 -NGENProcess 1e0 -Pipe 2e0 -Comment "NGen Worker Process"
                                                                                                          5⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          PID:5732
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 308 -Comment "NGen Worker Process"
                                                                                                          5⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          PID:5040
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 0 -NGENProcess 31c -Pipe 1d8 -Comment "NGen Worker Process"
                                                                                                          5⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          PID:4652
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 0 -NGENProcess 300 -Pipe 288 -Comment "NGen Worker Process"
                                                                                                          5⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          PID:6104
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 0 -NGENProcess 300 -Pipe 328 -Comment "NGen Worker Process"
                                                                                                          5⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          PID:4796
                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 0 -NGENProcess 2ec -Pipe 2d0 -Comment "NGen Worker Process"
                                                                                                          5⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          PID:5232
                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
                                                                                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\EnableLoopback.exe"
                                                                                                        4⤵
                                                                                                          PID:1784
                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
                                                                                                            5⤵
                                                                                                              PID:4588
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 0 -NGENProcess 288 -Pipe 1d8 -Comment "NGen Worker Process"
                                                                                                              5⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:5612
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 0 -NGENProcess 298 -Pipe 2a0 -Comment "NGen Worker Process"
                                                                                                              5⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:5640
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 0 -NGENProcess 288 -Pipe 2c8 -Comment "NGen Worker Process"
                                                                                                              5⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:5952
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 0 -NGENProcess 2e0 -Pipe 29c -Comment "NGen Worker Process"
                                                                                                              5⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:4308
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 0 -NGENProcess 2e4 -Pipe 270 -Comment "NGen Worker Process"
                                                                                                              5⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:1776
                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 0 -NGENProcess 2dc -Pipe 2d0 -Comment "NGen Worker Process"
                                                                                                              5⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:4484
                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper
                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\Admin\AppData\Local\Programs\Fiddler"
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2500
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fiddler2.com/r/?Fiddler2FirstRun
                                                                                                            4⤵
                                                                                                            • Enumerates system info in registry
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                            PID:4800
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc3f0b46f8,0x7ffc3f0b4708,0x7ffc3f0b4718
                                                                                                              5⤵
                                                                                                                PID:4072
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,6251316911175827117,4516157926906682365,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1952 /prefetch:2
                                                                                                                5⤵
                                                                                                                  PID:396
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,6251316911175827117,4516157926906682365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
                                                                                                                  5⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:1128
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,6251316911175827117,4516157926906682365,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
                                                                                                                  5⤵
                                                                                                                    PID:4380
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,6251316911175827117,4516157926906682365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
                                                                                                                    5⤵
                                                                                                                      PID:5124
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,6251316911175827117,4516157926906682365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
                                                                                                                      5⤵
                                                                                                                        PID:5132
                                                                                                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                                                                                1⤵
                                                                                                                  PID:3676
                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:876
                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                    1⤵
                                                                                                                      PID:5472
                                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:5724
                                                                                                                    • C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:4220
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fiddler2.com/r/?Win8EL
                                                                                                                        2⤵
                                                                                                                        • Enumerates system info in registry
                                                                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                        PID:4532
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3f0b46f8,0x7ffc3f0b4708,0x7ffc3f0b4718
                                                                                                                          3⤵
                                                                                                                            PID:2492
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,228643789653907738,18336518007751658538,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
                                                                                                                            3⤵
                                                                                                                              PID:2032
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,228643789653907738,18336518007751658538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
                                                                                                                              3⤵
                                                                                                                                PID:5368
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,228643789653907738,18336518007751658538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3036 /prefetch:8
                                                                                                                                3⤵
                                                                                                                                  PID:6120
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,228643789653907738,18336518007751658538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:1
                                                                                                                                  3⤵
                                                                                                                                    PID:4660
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,228643789653907738,18336518007751658538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
                                                                                                                                    3⤵
                                                                                                                                      PID:3768
                                                                                                                                • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                  C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:1600
                                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                    1⤵
                                                                                                                                      PID:4792
                                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                      1⤵
                                                                                                                                        PID:1048
                                                                                                                                      • C:\Windows\system32\taskmgr.exe
                                                                                                                                        "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                        1⤵
                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                        PID:5724
                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:5352
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fiddler2.com/r/?Win8EL
                                                                                                                                          2⤵
                                                                                                                                          • Enumerates system info in registry
                                                                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                          PID:2376
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3f0b46f8,0x7ffc3f0b4708,0x7ffc3f0b4718
                                                                                                                                            3⤵
                                                                                                                                              PID:5344
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6695715534098319481,4333479522280947722,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
                                                                                                                                              3⤵
                                                                                                                                                PID:392
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,6695715534098319481,4333479522280947722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
                                                                                                                                                3⤵
                                                                                                                                                  PID:5812
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,6695715534098319481,4333479522280947722,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4844
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6695715534098319481,4333479522280947722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2812
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6695715534098319481,4333479522280947722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5164
                                                                                                                                                  • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                    C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:5892
                                                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                      1⤵
                                                                                                                                                        PID:5316
                                                                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                        1⤵
                                                                                                                                                          PID:5748
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
                                                                                                                                                          1⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:4128
                                                                                                                                                        • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                          C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:5456
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
                                                                                                                                                            1⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:4528
                                                                                                                                                          • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                            C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:5776
                                                                                                                                                            • C:\Users\Admin\Desktop\Synapse.exe
                                                                                                                                                              "C:\Users\Admin\Desktop\Synapse.exe"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:5376
                                                                                                                                                                • C:\Users\Admin\Desktop\Synapse.exe
                                                                                                                                                                  "C:\Users\Admin\Desktop\Synapse.exe"
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Drops startup file
                                                                                                                                                                  PID:4572
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2984
                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                        wmic csproduct get uuid
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:1320
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3544
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:4236
                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                              PID:5716
                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                              PID:4352
                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                              powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                              PID:396
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                        PID:5616
                                                                                                                                                                      • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                        C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:5644
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                          PID:4832
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc57e446f8,0x7ffc57e44708,0x7ffc57e44718
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:3680
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,3388934127713207606,13747323988854241057,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:5896
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,3388934127713207606,13747323988854241057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:5140
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,3388934127713207606,13747323988854241057,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:5768
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,3388934127713207606,13747323988854241057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5732
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,3388934127713207606,13747323988854241057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:5808
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,3388934127713207606,13747323988854241057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3564
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,3388934127713207606,13747323988854241057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1860
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,3388934127713207606,13747323988854241057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 /prefetch:8
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:3416
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,3388934127713207606,13747323988854241057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 /prefetch:8
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:3472
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,3388934127713207606,13747323988854241057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:3748
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,3388934127713207606,13747323988854241057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:5992
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,3388934127713207606,13747323988854241057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4368
                                                                                                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:2228
                                                                                                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:3576
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                        PID:2500
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4fbdab58,0x7ffc4fbdab68,0x7ffc4fbdab78
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:5960
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1932,i,2395606031662800657,2578720705885422790,131072 /prefetch:2
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:5928
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1932,i,2395606031662800657,2578720705885422790,131072 /prefetch:8
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:3520
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2260 --field-trial-handle=1932,i,2395606031662800657,2578720705885422790,131072 /prefetch:8
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1784
                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3132 --field-trial-handle=1932,i,2395606031662800657,2578720705885422790,131072 /prefetch:1
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4988
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3172 --field-trial-handle=1932,i,2395606031662800657,2578720705885422790,131072 /prefetch:1
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:5124
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4348 --field-trial-handle=1932,i,2395606031662800657,2578720705885422790,131072 /prefetch:1
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:5732
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1932,i,2395606031662800657,2578720705885422790,131072 /prefetch:8
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:5524
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1932,i,2395606031662800657,2578720705885422790,131072 /prefetch:8
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:5448
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4888 --field-trial-handle=1932,i,2395606031662800657,2578720705885422790,131072 /prefetch:1
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:4584
                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4900 --field-trial-handle=1932,i,2395606031662800657,2578720705885422790,131072 /prefetch:1
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:5540
                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4652 --field-trial-handle=1932,i,2395606031662800657,2578720705885422790,131072 /prefetch:1
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:6044
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4152 --field-trial-handle=1932,i,2395606031662800657,2578720705885422790,131072 /prefetch:1
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:3544
                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3408 --field-trial-handle=1932,i,2395606031662800657,2578720705885422790,131072 /prefetch:1
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:664
                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:5704

                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 40B
                                                                                                                                                                                                                                          • SHA256 dc3766fd1d9f14e305d5483a9e886548c3ff3ad2d8497e26a04c6d8c31e7be6c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_000019
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
                                                                                                                                                                                                                                          • Size 50KB
                                                                                                                                                                                                                                          • SHA256 52f64b709933b849dd5aa056c569374b59fc9505b8be89ef351f8ff878506e38
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_00001e
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
                                                                                                                                                                                                                                          • Size 104KB
                                                                                                                                                                                                                                          • SHA256 d2dec720512133d14bfe30b6327f55fec8d64a171f7c0156edf1ef1e4f5b9404
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_000020
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
                                                                                                                                                                                                                                          • Size 181KB
                                                                                                                                                                                                                                          • SHA256 365d571abb63223dec14eb68fb6051a94e6e944820e739e44117bd1051ec5d34
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_000021
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
                                                                                                                                                                                                                                          • Size 41KB
                                                                                                                                                                                                                                          • SHA256 a8ce7ca09c32523d3c0bc43ed3df8a6d20523ae55b1c8e7228b3ec3be6682ab0
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_000023
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
                                                                                                                                                                                                                                          • Size 199KB
                                                                                                                                                                                                                                          • SHA256 d692f27c385520c3b4078c35d78cdf154c424d09421dece6de73708659c7e2a6
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_000024
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
                                                                                                                                                                                                                                          • Size 37KB
                                                                                                                                                                                                                                          • SHA256 9f008949167fc0481e6bf59fbcf63e9f8c5a8a1943f43cef7757344f32d63d44
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_000026
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
                                                                                                                                                                                                                                          • Size 42KB
                                                                                                                                                                                                                                          • SHA256 b91133eaa994c27dd6af3e1a4da536d46a4b194a8406e03ec70f1b560b0b8992
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_000028
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
                                                                                                                                                                                                                                          • Size 114KB
                                                                                                                                                                                                                                          • SHA256 39befd7177c0d187d1cb98d6e260f5fcb332884fed2bcf1c756d510cc32c812a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                          • SHA256 a32ec4be5c48fba4833b029c9cb8ddb064a6b184abdb756515561098ead70dda
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                          • SHA256 1b1c388e8be9eb5edb8a1589a30fc3c87c3d667b6c256fe1fdf8452b1dd182b4
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          data_1
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
                                                                                                                                                                                                                                          • Size 264KB
                                                                                                                                                                                                                                          • SHA256 3d6ad75ade0bd94aac6b9bbd3257b2f0de629afd308a8c4932e7d73892761bbc
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                          • Size 7KB
                                                                                                                                                                                                                                          • SHA256 b8ef005210541c37041ddd4abb49574f4324992dc06a1a76b9d61fbf751962ef
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                          • SHA256 dab4333f28ab492e2f9268ee8a73803200283382315e455efb7f11ef6a102182
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                          • SHA256 7e5a2ec83febd181d4e856fb0db28526418687519a4930923c780bcc7b7a5267
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          SCT Auditing Pending Reports
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                          • Size 2B
                                                                                                                                                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          TransportSecurity
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                          • Size 356B
                                                                                                                                                                                                                                          • SHA256 537130f72881caf6fc4739e99f7e765bb48354d56e33b16ec6121eb2fd5a981a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          TransportSecurity
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                          • SHA256 9649ac3a0839b037547ae8499efbf278d888a3058fd116631322ca2cd76473a0
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          TransportSecurity
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 5704a2544e4297062cdfb9adb9f5ff48a95d49dfa1b0731a532dc8f2220ca98e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          TransportSecurity
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 83030fb40bebafdabd6695b756a139eb542af0310e6223e92bcb3b0d0e1fd5e3
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          TransportSecurity
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 04648c0e7a99ca2101ebd53b78ece0e9bddde0ce4709d017790828126757b47c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 7KB
                                                                                                                                                                                                                                          • SHA256 e1c001566e4e9c87da357c78cab55ba956ca55bc6fe9d7cbbc6640e4b23f415c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 7KB
                                                                                                                                                                                                                                          • SHA256 7f2af352b85397ff2edb50b3c65a66adcab388029b2001d1ae6160e5fcc5c7e8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                          • SHA256 bcd012ada5b297a1b85b452b9ff25f9cc57ee283113588ca26e885b3184350d1
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                          • SHA256 9abc3aba48cce40ece4f396e3ffcfec13191fac69afdfd2f5e12c2fb9c78c03c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                          • SHA256 cac8e3aa6610f6dba014d19cc7ecd814c283edb2e44472b6b9054b7246890f69
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                          • SHA256 a559d1f80a9bd749953fa9aebb69732397c72121d6783c55ad6f03233dee0924
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Secure Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                          • Size 16KB
                                                                                                                                                                                                                                          • SHA256 d65a66b6909547cbe12355e54d250778364f2fd5fdde86b240263944188ce6da
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                          • Size 256KB
                                                                                                                                                                                                                                          • SHA256 7e00d2411104f6309bb440dfaa45f3cf41befb0ba9ba8f048779b5eb26152d18
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                          • Size 256KB
                                                                                                                                                                                                                                          • SHA256 8c971012fecca679dcac630dd12e3d049dff3eadb23be24c41f50f04a6caf97f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                          • Size 256KB
                                                                                                                                                                                                                                          • SHA256 1eb2196543eba0ce1b1946213f887998b434ed43daee6bb26511a42a19fb64eb
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                          • Size 256KB
                                                                                                                                                                                                                                          • SHA256 0d90213ec852671d68b6277d3a2d7112384448d6a72bdd15d3ccc7cb3d4ebdba
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Module Info Cache
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                                                                                                                                                                          • Size 93KB
                                                                                                                                                                                                                                          • SHA256 7ff4702992029c47f407fa9e49c524bd2b6e800b4856402f7fb288ca9f43d28d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Module Info Cache
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                                                                                                                                                                          • Size 106KB
                                                                                                                                                                                                                                          • SHA256 67eb8b299c50099b6de278e2aba5d16836b847fd0a55f8dbce20d03e56751711
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Module Info Cache
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                                                                                                                                                                          • Size 104KB
                                                                                                                                                                                                                                          • SHA256 6a10c09167fcfa17afef26370f71eae2e5e72c2a970faa582e224bd19cb1bc78
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Module Info Cache~RFe593203.TMP
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe593203.TMP
                                                                                                                                                                                                                                          • Size 91KB
                                                                                                                                                                                                                                          • SHA256 3225bb53b9878a46d3cfe33adbc39750b668da7decb7f51f73e435422c6316f7
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 152B
                                                                                                                                                                                                                                          • SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 152B
                                                                                                                                                                                                                                          • SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 152B
                                                                                                                                                                                                                                          • SHA256 b63753635716d649ed5437f512e10b6673ed78ef3de5744758bbebbec0a794c8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 152B
                                                                                                                                                                                                                                          • SHA256 b0a7fab98afdd397718aca9c9b2936cbf04cea4701140e2bb7946bcc2d84281b
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 152B
                                                                                                                                                                                                                                          • SHA256 7abf969060762e45bb044af32bb866bbf4d962ff1da8c1111ef4ebb91b36ce75
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 152B
                                                                                                                                                                                                                                          • SHA256 502870592b620041d3f6866fdbb0f54beebe7c42682a4affef9d82b9e23d3433
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                          • Size 111B
                                                                                                                                                                                                                                          • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                          • Size 61B
                                                                                                                                                                                                                                          • SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                          • Size 192B
                                                                                                                                                                                                                                          • SHA256 707b64d0a569506ba1fb6b059b0d637db0f75f612d84dda88007ad29ce10e868
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                                                                          • SHA256 5d2d2477a9e31bf4062f45b91af480b0044d0cfd36b3c7a926ed647fe8c01f34
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                                                                          • SHA256 e1c73a269d065729aad709f9b2af62aedc9cbe949229d4cd131aed74f44bdbf6
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                                                          • SHA256 91d91429473328d449949c0da2f81b82630495eb65cb5b00073d7e43a65def44
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                                                                          • SHA256 574803f6439d57ba1ebf128598d3564ad048fa3cb1a2a0df29236817fac4350d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                                                                          • SHA256 4d83255cf6d6ba92c36f7f43b7b903b05881eb11d63864ceefab0882a40edbfe
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                                                                          • SHA256 428adb9741db3d3e11821f91194b04b8b5fb8d7eef45efd5bc9b42f24d766f73
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                                                                          • SHA256 51296e6014df0ef6f960e93d45993fe40cf77853c90537c1ad72b7fee1a87990
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          CURRENT
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                          • Size 16B
                                                                                                                                                                                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          CURRENT
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                          • Size 16B
                                                                                                                                                                                                                                          • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          e3d474ef-4e47-4b6e-836f-210cde92ec97.tmp
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e3d474ef-4e47-4b6e-836f-210cde92ec97.tmp
                                                                                                                                                                                                                                          • Size 1B
                                                                                                                                                                                                                                          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          data_0
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
                                                                                                                                                                                                                                          • Size 44KB
                                                                                                                                                                                                                                          • SHA256 d2ee43d94cafe7616545e71c8c93dd22fd50f6370c89db82daea30c6c26331d2
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          • Size 11KB
                                                                                                                                                                                                                                          • SHA256 f224b92005a4ece3eb7b13ac9d635dd0984abbf7bad7b02ce3e6acea5f7eccdf
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          • Size 11KB
                                                                                                                                                                                                                                          • SHA256 89382ca947f56687c6b8543c88bb743a9517969e8d5b3c7bc096253511daf803
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          • Size 11KB
                                                                                                                                                                                                                                          • SHA256 324894b9d60bddb76b76e65bfabfcacef353e305e2573a539502549c56f9d8bb
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          • Size 11KB
                                                                                                                                                                                                                                          • SHA256 ffbac6301049139eaf6cd605387a8ad8f90ce7b50495d6ac5557e1e4f9fc6ee9
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          • Size 10KB
                                                                                                                                                                                                                                          • SHA256 47e2670b8d39233213c11abe97938a419c10df88a54aab8d731f07f0606ce2c5
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          StartupProfileData-NonInteractive
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                          • Size 64B
                                                                                                                                                                                                                                          • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          QWhale.Editor.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Programs\Fiddler\Inspectors\QWhale.Editor.dll
                                                                                                                                                                                                                                          • Size 816KB
                                                                                                                                                                                                                                          • SHA256 fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          QWhale.Common.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Common.dll
                                                                                                                                                                                                                                          • Size 192KB
                                                                                                                                                                                                                                          • SHA256 93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          QWhale.Syntax.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.dll
                                                                                                                                                                                                                                          • Size 228KB
                                                                                                                                                                                                                                          • SHA256 79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          user.config
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Progress_Software_Corpora\Fiddler.exe_Url_gn2suaigfhhkewccgutguryxxqm34vvg\5.0.20242.10753\user.config
                                                                                                                                                                                                                                          • Size 966B
                                                                                                                                                                                                                                          • SHA256 5446477534b78ce115004f8ff8ca59bd7f241a0e95d6425dc4e14f25e3ced1fe
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          VCRUNTIME140.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\VCRUNTIME140.dll
                                                                                                                                                                                                                                          • Size 116KB
                                                                                                                                                                                                                                          • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          VCRUNTIME140_1.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\VCRUNTIME140_1.dll
                                                                                                                                                                                                                                          • Size 48KB
                                                                                                                                                                                                                                          • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          _asyncio.pyd
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\_asyncio.pyd
                                                                                                                                                                                                                                          • Size 37KB
                                                                                                                                                                                                                                          • SHA256 617eb50897916095a22494d07e5dbe6c427331c9f983b0d4c1a7279513cd6743
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          _bz2.pyd
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\_bz2.pyd
                                                                                                                                                                                                                                          • Size 48KB
                                                                                                                                                                                                                                          • SHA256 1ac8ca1558305fcdd975b7846c48e006500629bb5639634958e70b51c62762c5
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          _ctypes.pyd
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\_ctypes.pyd
                                                                                                                                                                                                                                          • Size 59KB
                                                                                                                                                                                                                                          • SHA256 3c52af0a44d768a2cdaaa2163d438f09a5913fec85a01b7d591116e9fbd743b1
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          _lzma.pyd
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\_lzma.pyd
                                                                                                                                                                                                                                          • Size 86KB
                                                                                                                                                                                                                                          • SHA256 b5dffb38a8a869abef827789f12d75ceb6125335be12a7a990c78d8e8417b674
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-console-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-console-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-datetime-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-datetime-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-debug-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-debug-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-errorhandling-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-errorhandling-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-file-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-file-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 25KB
                                                                                                                                                                                                                                          • SHA256 3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-file-l1-2-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-file-l1-2-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-file-l2-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-file-l2-1-0.dll
                                                                                                                                                                                                                                          • Size 18KB
                                                                                                                                                                                                                                          • SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-handle-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-handle-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-heap-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-heap-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-interlocked-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-interlocked-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-libraryloader-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-libraryloader-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-localization-l1-2-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-localization-l1-2-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-memory-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-memory-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-namedpipe-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-namedpipe-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 5476db3a4fecf532f96d48f9802c966fdef98ec8d89978a79540cb4db352c15f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-processenvironment-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-processenvironment-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 0b6b598ec28a9e3d646f2bb37e1a57a3dda069a55fba86333727719585b1886e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-processthreads-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-processthreads-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 be8d78978d81555554786e08ce474f6af1de96fcb7fa2f1ce4052bc80c6b2125
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-processthreads-l1-1-1.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-processthreads-l1-1-1.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-profile-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-profile-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 e1c5d8984a674925fa4afbfe58228be5323fe5123abcd17ec4160295875a625f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 3c29730df2b28985a30d9c82092a1faa0ceb7ffc1bd857d1ef6324cf5524802f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-string-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-string-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 27e9d3e7c8756e4512932d674a738bf4c2969f834d65b2b79c342a22f662f328
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-synch-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-synch-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 61c0ebe60ce6ebabcb927ddff837a9bf17e14cd4b4c762ab709e630576ec7232
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-synch-l1-2-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-synch-l1-2-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 433bd8ddc4f79aee65ca94a54286d75e7d92b019853a883e51c2b938d2469baa
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-sysinfo-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-sysinfo-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 0dc92e8830bc84337dcae19ef03a84ef5279cf7d4fdc2442c1bc25320369f9df
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-timezone-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-timezone-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-core-util-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-core-util-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 2e1f090aba941b9d2d503e4cd735c958df7bb68f1e9bdc3f47692e1571aaac2f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-crt-conio-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-crt-conio-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 93619259328a264287aee7c5b88f7f0ee32425d7323ce5dc5a2ef4fe3bed90d5
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-crt-convert-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-crt-convert-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 25KB
                                                                                                                                                                                                                                          • SHA256 b987ab40cdd950ebe7a9a9176b80b8fffc005ccd370bb1cbbcad078c1a506bdc
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-crt-environment-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-crt-environment-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 2f6bd6c235e044755d5707bd560a6afc0ba712437530f76d11079d67c0cf3200
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-crt-filesystem-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-crt-filesystem-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 94a86e28e829276974e01f8a15787fde6ed699c8b9dc26f16a51765c86c3eade
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-crt-heap-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-crt-heap-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 8dd9218998b4c4c9e8d8b0f8b9611d49419b3c80daa2f437cbf15bcfd4c0b3b8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-crt-locale-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-crt-locale-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 551a34c400522957063a2d71fa5aba1cd78cc4f61f0ace1cd42cc72118c500c0
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-crt-math-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-crt-math-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 29KB
                                                                                                                                                                                                                                          • SHA256 1c4a70a73096b64b536be8132ed402bcfb182c01b8a451bff452efe36ddf76e7
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-crt-process-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-crt-process-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 bd943767f3e0568e19fb52522217c22b6627b66a3b71cd38dd6653b50662f39d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-crt-runtime-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-crt-runtime-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 25KB
                                                                                                                                                                                                                                          • SHA256 962d725d089f140482ee9a8ff57f440a513387dd03fdc06b3a28562c8090c0bc
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-crt-stdio-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-crt-stdio-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 25KB
                                                                                                                                                                                                                                          • SHA256 273817a137ee049cbd8e51dc0bb1c7987df7e3bf4968940ee35376f87ef2ef8d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-crt-string-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-crt-string-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 25KB
                                                                                                                                                                                                                                          • SHA256 415025dce5a086dbffc4cf322e8ead55cb45f6d946801f6f5193df044db2f004
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-crt-time-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-crt-time-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 82fba9bc21f77309a649edc8e6fc1900f37e3ffcb45cd61e65e23840c505b945
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          api-ms-win-crt-utility-l1-1-0.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\api-ms-win-crt-utility-l1-1-0.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 2e554d9bf872a64d2cd0f0eb9d5a06dea78548bc0c7a6f76e0a0c8c069f3c0a9
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          base_library.zip
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\base_library.zip
                                                                                                                                                                                                                                          • Size 1.3MB
                                                                                                                                                                                                                                          • SHA256 8de4f013bfecb9431aabaa97bb084fb7de127b365b9478d6f7610959bf0d2783
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          libcrypto-3.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\libcrypto-3.dll
                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                          • SHA256 d9c01ab4545d4681ab057b572eb8590defd33bc44527bb4ef26a5f23cadbfd03
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          libffi-8.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\libffi-8.dll
                                                                                                                                                                                                                                          • Size 29KB
                                                                                                                                                                                                                                          • SHA256 ed18fc7eee1bf09d994d8eba144e4e7d1e6a030ba87888001eea550d7afffada
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          libssl-3.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\libssl-3.dll
                                                                                                                                                                                                                                          • Size 222KB
                                                                                                                                                                                                                                          • SHA256 2674c58e05448f8b60d7b2182bbcd2efe386d4b7b1104dd1f753112638cb8e00
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          pyexpat.pyd
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\pyexpat.pyd
                                                                                                                                                                                                                                          • Size 88KB
                                                                                                                                                                                                                                          • SHA256 60a47ac9c1674198998338cf3caef2325bb722e62934310653f9dd01a1cb4109
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          python3.DLL
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\python3.DLL
                                                                                                                                                                                                                                          • Size 66KB
                                                                                                                                                                                                                                          • SHA256 d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          python312.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\python312.dll
                                                                                                                                                                                                                                          • Size 1.7MB
                                                                                                                                                                                                                                          • SHA256 cc947a9fcd6d569d60960758a6226e27dfe9ed8ca2cec3105ae99a711b1be3a9
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          select.pyd
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\select.pyd
                                                                                                                                                                                                                                          • Size 25KB
                                                                                                                                                                                                                                          • SHA256 f05fe1c21959ee25d30aaade30afaaf34fbd99524bdfb3ebee3cf8643ae5d1b6
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          sqlite3.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\sqlite3.dll
                                                                                                                                                                                                                                          • Size 644KB
                                                                                                                                                                                                                                          • SHA256 bfe78fe2b54df778c0d62144b1308f1f149bed79ea6bd628ffd76cbc5406cd1a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          ucrtbase.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\ucrtbase.dll
                                                                                                                                                                                                                                          • Size 992KB
                                                                                                                                                                                                                                          • SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          unicodedata.pyd
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\unicodedata.pyd
                                                                                                                                                                                                                                          • Size 295KB
                                                                                                                                                                                                                                          • SHA256 6c2c45ef24c6797ee92997417dd142e4447d410fae63c7969db615caed9327ba
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          __PSScriptPolicyTest_2um2cjkh.bhc.ps1
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2um2cjkh.bhc.ps1
                                                                                                                                                                                                                                          • Size 60B
                                                                                                                                                                                                                                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          datA970.tmp
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\datA970.tmp
                                                                                                                                                                                                                                          • Size 87KB
                                                                                                                                                                                                                                          • SHA256 8c39555ba5f42faab2eb79d33933c7f45ff5c84142ab27a717c99c4cbb22e504
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          System.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nsiBD1E.tmp\System.dll
                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                          • SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          cc's.txt
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\op0HIx95km\Browser\cc's.txt
                                                                                                                                                                                                                                          • Size 91B
                                                                                                                                                                                                                                          • SHA256 c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          cookies.txt
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\op0HIx95km\Browser\cookies.txt
                                                                                                                                                                                                                                          • Size 49B
                                                                                                                                                                                                                                          • SHA256 e04233c3a65810f382471c2c1484cc71df6f2078d56bd91f478ed99790ac11f5
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          history.txt
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\op0HIx95km\Browser\history.txt
                                                                                                                                                                                                                                          • Size 23B
                                                                                                                                                                                                                                          • SHA256 4db7f6559c454d34d9c2d557524603c3f52649c2d69b26b6e8384a3d179aeae6
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          history.txt
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\tx0Q5KORav\Browser\history.txt
                                                                                                                                                                                                                                          • Size 254B
                                                                                                                                                                                                                                          • SHA256 4c49dd095603870f3b725076af3a8350273d7e3493db3d71c6409b95bf5d55ac
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          roblox cookies.txt
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\tx0Q5KORav\Browser\roblox cookies.txt
                                                                                                                                                                                                                                          • Size 23B
                                                                                                                                                                                                                                          • SHA256 aac2a87a65cbbe472000734bd6db5c76f0ffed78e80928f575d5573f3ac94d0f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          default.dic
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                                                                                                          • Size 2B
                                                                                                                                                                                                                                          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          BrowserPAC.js
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Documents\Fiddler2\Scripts\BrowserPAC.js
                                                                                                                                                                                                                                          • Size 281B
                                                                                                                                                                                                                                          • SHA256 4a8cd7eaa74ae85c16255c6c4ce0829f6db44815e07cf9af88cbd2ffdd84d4f0
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Unconfirmed 862275.crdownload
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Unconfirmed 862275.crdownload
                                                                                                                                                                                                                                          • Size 4.4MB
                                                                                                                                                                                                                                          • SHA256 06812518a722af6f98fbd8c3a5ace0cad1c6d53477972618728e64bafcbc948c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          System.Data.SqlXml.ni.dll
                                                                                                                                                                                                                                          • Path C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\22b31f1b9eca85580b198424dd16a98a\System.Data.SqlXml.ni.dll
                                                                                                                                                                                                                                          • Size 3.0MB
                                                                                                                                                                                                                                          • SHA256 447bfc33e8f3bc3d661200891933fed1bb28c402d1063e6838f55096ec9833aa
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          System.Deployment.ni.dll
                                                                                                                                                                                                                                          • Path C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\18271de25c06b49b2aaa391461de2df6\System.Deployment.ni.dll
                                                                                                                                                                                                                                          • Size 3.0MB
                                                                                                                                                                                                                                          • SHA256 44a217d721c0fb7de3f52123ace1eeaf62f48f40f55bd816bb32c422d0939eec
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          System.Numerics.ni.dll
                                                                                                                                                                                                                                          • Path C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ba90284a07d8bc0ce7e6273afa79210f\System.Numerics.ni.dll
                                                                                                                                                                                                                                          • Size 314KB
                                                                                                                                                                                                                                          • SHA256 6c51e5a928f227bb64a7eb9e48089bca5e9bbef0d0329b971ebbf918335ee1ac
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          System.Runtime.Serialization.Formatters.Soap.ni.dll
                                                                                                                                                                                                                                          • Path C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f85535a7092741215f67fdedf2846499\System.Runtime.Serialization.Formatters.Soap.ni.dll
                                                                                                                                                                                                                                          • Size 345KB
                                                                                                                                                                                                                                          • SHA256 4075d88d2ba1cff2a8ab9be66176045628d24cae370428e0128f8af3a77639fb
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          System.Security.ni.dll
                                                                                                                                                                                                                                          • Path C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\7355af105ad86679d6c9070a9b4dc0c3\System.Security.ni.dll
                                                                                                                                                                                                                                          • Size 986KB
                                                                                                                                                                                                                                          • SHA256 9ac6d5445caaacae6813243c787e8d67c974988acd1a4a5f564503fd36e91e46
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          memory/776-259-0x00000263F93F0000-0x00000263F9412000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2036-486-0x00007FF783180000-0x00007FF7831CA000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-199-0x00007FFC53E90000-0x00007FFC53E9D000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-220-0x00007FFC408E0000-0x00007FFC40E09000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-136-0x00007FFC40E10000-0x00007FFC414D5000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-143-0x00007FFC53F80000-0x00007FFC53FA5000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-487-0x00007FF783180000-0x00007FF7831CA000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-146-0x00007FFC56140000-0x00007FFC5614F000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-150-0x00007FFC53EA0000-0x00007FFC53EBA000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-152-0x00007FFC52180000-0x00007FFC521AD000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-200-0x00007FFC51080000-0x00007FFC51099000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-201-0x00007FFC52160000-0x00007FFC5216D000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-202-0x00007FFC51070000-0x00007FFC5107D000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-203-0x00007FFC51050000-0x00007FFC51064000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-204-0x00007FFC40E10000-0x00007FFC414D5000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-205-0x00007FFC408E0000-0x00007FFC40E09000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-206-0x00007FFC53F80000-0x00007FFC53FA5000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-207-0x00007FFC50760000-0x00007FFC50793000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-208-0x00007FFC50690000-0x00007FFC5075D000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-210-0x00007FFC4FAA0000-0x00007FFC4FAB2000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-209-0x00007FFC4FAC0000-0x00007FFC4FAD6000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-211-0x00007FFC4FA60000-0x00007FFC4FA95000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-212-0x00007FFC53E90000-0x00007FFC53E9D000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-214-0x00007FFC3D350000-0x00007FFC3D4CE000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-213-0x00007FFC4FBB0000-0x00007FFC4FBD4000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-215-0x00007FFC4FB90000-0x00007FFC4FBA8000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-216-0x00007FFC4FB00000-0x00007FFC4FB87000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-219-0x00007FFC3E750000-0x00007FFC3E777000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-218-0x00007FFC4FAF0000-0x00007FFC4FAFB000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-217-0x00007FFC51050000-0x00007FFC51064000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-221-0x00007FFC3D230000-0x00007FFC3D34B000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-222-0x00007FFC50760000-0x00007FFC50793000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-223-0x00007FFC4FAE0000-0x00007FFC4FAEB000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-224-0x00007FFC49720000-0x00007FFC4972B000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-228-0x00007FFC3FB60000-0x00007FFC3FB6B000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-469-0x00007FFC3CF70000-0x00007FFC3D1B5000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-227-0x00007FFC41740000-0x00007FFC4174C000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-226-0x00007FFC46E90000-0x00007FFC46E9B000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-472-0x00007FFC3CF30000-0x00007FFC3CF59000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-473-0x00007FFC3CF00000-0x00007FFC3CF2E000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-225-0x00007FFC47540000-0x00007FFC4754C000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-229-0x00007FFC4FAA0000-0x00007FFC4FAB2000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-233-0x00007FFC3F5E0000-0x00007FFC3F5EC000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-232-0x00007FFC3EDA0000-0x00007FFC3EDAC000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-231-0x00007FFC3EEB0000-0x00007FFC3EEBE000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-230-0x00007FFC3F5F0000-0x00007FFC3F5FC000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-313-0x00007FFC50690000-0x00007FFC5075D000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-302-0x00007FFC53F80000-0x00007FFC53FA5000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-301-0x00007FFC40E10000-0x00007FFC414D5000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-312-0x00007FFC50760000-0x00007FFC50793000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-311-0x00007FFC408E0000-0x00007FFC40E09000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-318-0x00007FFC3D350000-0x00007FFC3D4CE000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-332-0x00007FFC4FB00000-0x00007FFC4FB87000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-322-0x00007FFC3E750000-0x00007FFC3E777000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-244-0x00007FFC3CF30000-0x00007FFC3CF59000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-245-0x00007FFC3CF00000-0x00007FFC3CF2E000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-241-0x00007FFC4FBB0000-0x00007FFC4FBD4000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-242-0x00007FFC3D350000-0x00007FFC3D4CE000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-243-0x00007FFC3CF70000-0x00007FFC3D1B5000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-236-0x00007FFC3D1F0000-0x00007FFC3D1FD000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-237-0x00007FFC3D1D0000-0x00007FFC3D1E2000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-238-0x00007FFC3D220000-0x00007FFC3D22B000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-239-0x00007FFC3D210000-0x00007FFC3D21C000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-240-0x00007FFC3D1C0000-0x00007FFC3D1CC000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-235-0x00007FFC3D200000-0x00007FFC3D20C000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-234-0x00007FFC3ED90000-0x00007FFC3ED9B000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-463-0x00007FFC3C830000-0x00007FFC3CEF5000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-465-0x00007FFC4FE30000-0x00007FFC4FE3F000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-464-0x00007FFC3F860000-0x00007FFC3F885000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-467-0x00007FFC3D5F0000-0x00007FFC3D61D000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-466-0x00007FFC3F840000-0x00007FFC3F85A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-468-0x00007FFC3D5E0000-0x00007FFC3D5ED000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-471-0x00007FFC3D5A0000-0x00007FFC3D5AD000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-470-0x00007FFC3D5B0000-0x00007FFC3D5C9000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-474-0x00007FFC3D590000-0x00007FFC3D59D000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-475-0x00007FFC3D570000-0x00007FFC3D584000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-477-0x00007FFC3C300000-0x00007FFC3C829000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-476-0x00007FFC3C830000-0x00007FFC3CEF5000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-485-0x00007FFC3C1F0000-0x00007FFC3C225000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-478-0x00007FFC3D530000-0x00007FFC3D563000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-479-0x00007FFC3F860000-0x00007FFC3F885000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-480-0x00007FFC3C230000-0x00007FFC3C2FD000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-481-0x00007FFC3D510000-0x00007FFC3D526000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-483-0x00007FFC3D4F0000-0x00007FFC3D502000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-482-0x00007FFC3D5F0000-0x00007FFC3D61D000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-484-0x00007FFC3D5E0000-0x00007FFC3D5ED000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-537-0x00007FFC3F0C0000-0x00007FFC3F0CC000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-529-0x00007FFC3F160000-0x00007FFC3F16B000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-530-0x00007FFC3F150000-0x00007FFC3F15B000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-531-0x00007FFC3F140000-0x00007FFC3F14C000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-532-0x00007FFC3F130000-0x00007FFC3F13B000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-533-0x00007FFC3F120000-0x00007FFC3F12C000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-534-0x00007FFC3D510000-0x00007FFC3D526000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-535-0x00007FFC3F110000-0x00007FFC3F11B000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-536-0x00007FFC3F100000-0x00007FFC3F10C000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-524-0x00007FFC3C300000-0x00007FFC3C829000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-525-0x00007FFC3F2C0000-0x00007FFC3F2CB000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-526-0x00007FFC3F290000-0x00007FFC3F2B7000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-527-0x00007FFC3F170000-0x00007FFC3F28B000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-528-0x00007FFC3D530000-0x00007FFC3D563000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-522-0x00007FFC4F9B0000-0x00007FFC4F9C8000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-523-0x00007FFC3F600000-0x00007FFC3F687000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-521-0x00007FFC3D570000-0x00007FFC3D584000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-519-0x00007FFC3F810000-0x00007FFC3F834000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-520-0x00007FFC3F690000-0x00007FFC3F80E000-memory.dmp
                                                                                                                                                                                                                                          Download