Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

TNoodle-WCA-1.2.2.jar

windows10-2004-x64

8

Analysis

  • max time kernel
    1799s
  • max time network
    1745s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2024, 08:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TNoodle-WCA-1.2.2.jar

  • Size

    29.8MB

  • MD5

    9f7103370956308807e2c6529f459133

  • SHA1

    e9c1227a7557ce7d62c59e4183f39b750ddf13e0

  • SHA256

    151fb27eae66cd0cd335f1717668d26e8530bb5d0266a0c5f871395dcd6237c1

  • SHA512

    30f44daca0b86f28a571db43e0958f465fe56c9a54b51c1487a927d8da2a356e613dea8f2f8a72142ca6e3babeaf257b1315edff14c8eb3d76755e5c66d5f2df

  • SSDEEP

    786432:/mznhtI2TkLLD44F4k/6Qe+jRBBJdCQgbg:+bOLo4F4Ke+lBBJgQg0

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 37 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 20 IoCs
  • Modifies registry key 1 TTPs 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\TNoodle-WCA-1.2.2.jar
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:1072
    • C:\Program Files\Java\jre-1.8\temp-launcher\TNoodle-WCA-1.2.2.exe
      "C:\Program Files\Java\jre-1.8\temp-launcher\TNoodle-WCA-1.2.2.exe" -Xmx1820m -classpath C:\Users\Admin\AppData\Local\Temp\TNoodle-WCA-1.2.2.jar org.worldcubeassociation.tnoodle.deployable.jar.WebscramblesServer --noReexec
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4344
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:2014/
        3⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2324
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa83ed46f8,0x7ffa83ed4708,0x7ffa83ed4718
          4⤵
            PID:3136
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
            4⤵
              PID:1804
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1404
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
              4⤵
                PID:1232
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
                4⤵
                  PID:2236
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
                  4⤵
                    PID:3256
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
                    4⤵
                      PID:1472
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2812
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
                      4⤵
                        PID:4340
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
                        4⤵
                          PID:3264
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
                          4⤵
                            PID:5396
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
                            4⤵
                              PID:5404
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5516 /prefetch:8
                              4⤵
                                PID:5760
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
                                4⤵
                                  PID:5752
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:8
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5736
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 /prefetch:8
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5896
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7368109632840788650,16879756137077270559,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2588 /prefetch:2
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2892
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4984
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:640
                              • C:\Windows\System32\rundll32.exe
                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                1⤵
                                  PID:5980
                                • C:\Windows\system32\NOTEPAD.EXE
                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Scrambles for 2024-05-21.zip\Scrambles for 2024-05-21 - Computer Display PDF Passcodes - SECRET.txt
                                  1⤵
                                    PID:3188
                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Scrambles for 2024-05-21 - Computer Display PDFs.zip\2x2x2 Round 1 Scramble Set A.pdf"
                                    1⤵
                                    • Checks processor information in registry
                                    • Modifies Internet Explorer settings
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2320
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                      2⤵
                                        PID:5192
                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5D11802A82BE8792DBE668358CB331BC --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                          3⤵
                                            PID:5592
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5D39C563B3639DFE1AA3884CE2C0D108 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5D39C563B3639DFE1AA3884CE2C0D108 --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
                                            3⤵
                                              PID:4920
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=171C09CC63469CEA3B4B622877180548 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                              3⤵
                                                PID:5708
                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C212A5DEC78BD8CFBFDCAC8D79A4EE5C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C212A5DEC78BD8CFBFDCAC8D79A4EE5C --renderer-client-id=5 --mojo-platform-channel-handle=2008 --allow-no-sandbox-job /prefetch:1
                                                3⤵
                                                  PID:3900
                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=410FB99D82441E84B9C248F99B0B48CE --mojo-platform-channel-handle=2712 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                  3⤵
                                                    PID:6076
                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F034F3EA75D3EA2616A90C5BFD63A1F6 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                    3⤵
                                                      PID:5164
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:5704
                                                  • C:\Windows\system32\NOTEPAD.EXE
                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Scrambles for 2024-05-21.zip\Scrambles for 2024-05-21 - Computer Display PDF Passcodes - SECRET.txt
                                                    1⤵
                                                      PID:3188
                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Scrambles for 2024-05-21 - Computer Display PDFs.zip\3x3x3 Multiple Blindfolded Round 1 Scramble Set A Attempt 1.pdf"
                                                      1⤵
                                                      • Checks processor information in registry
                                                      • Modifies Internet Explorer settings
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4784
                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                                        2⤵
                                                          PID:1008
                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6D38292CF8EAD0D26E4AF50D58D973EE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6D38292CF8EAD0D26E4AF50D58D973EE --renderer-client-id=2 --mojo-platform-channel-handle=1668 --allow-no-sandbox-job /prefetch:1
                                                            3⤵
                                                              PID:6060
                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=31D787C6F1236090409E670E95B0632E --mojo-platform-channel-handle=1856 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                              3⤵
                                                                PID:5284
                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=377E6D82C9CA80F81ABF23F6CA194008 --mojo-platform-channel-handle=2380 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                3⤵
                                                                  PID:5176
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=761B8CCA2865759873544CD45B53CE32 --mojo-platform-channel-handle=1844 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                  3⤵
                                                                    PID:1716
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=29BB1C6B7EC55E16D31B33D0489C389E --mojo-platform-channel-handle=1964 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                    3⤵
                                                                      PID:2540
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=970BE0EB5DC438E126979CA187AC7241 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=970BE0EB5DC438E126979CA187AC7241 --renderer-client-id=8 --mojo-platform-channel-handle=2012 --allow-no-sandbox-job /prefetch:1
                                                                      3⤵
                                                                        PID:5220
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                    1⤵
                                                                    • Enumerates system info in registry
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    • Suspicious use of SendNotifyMessage
                                                                    PID:3156
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0x108,0x128,0x7ffa9499ab58,0x7ffa9499ab68,0x7ffa9499ab78
                                                                      2⤵
                                                                        PID:4444
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:2
                                                                        2⤵
                                                                          PID:4820
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:8
                                                                          2⤵
                                                                            PID:1636
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:8
                                                                            2⤵
                                                                              PID:6060
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3136 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:1
                                                                              2⤵
                                                                                PID:3640
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3160 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:1
                                                                                2⤵
                                                                                  PID:3164
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4388 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:1
                                                                                  2⤵
                                                                                    PID:5528
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4552 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:8
                                                                                    2⤵
                                                                                      PID:2448
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4560 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:8
                                                                                      2⤵
                                                                                        PID:5780
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4320 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:8
                                                                                        2⤵
                                                                                          PID:5612
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4984 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:8
                                                                                          2⤵
                                                                                            PID:5340
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:8
                                                                                            2⤵
                                                                                              PID:4796
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5112 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:1
                                                                                              2⤵
                                                                                                PID:4816
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5116 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:916
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2452 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:472
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3184 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:1692
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4300 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:2712
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4768 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:6016
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5180 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:5684
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:8
                                                                                                            2⤵
                                                                                                              PID:5480
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5436 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:5296
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5420 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:5072
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 --field-trial-handle=1956,i,5731664788632555029,13950384392075818055,131072 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:2760
                                                                                                                  • C:\Users\Admin\Downloads\DiscordSetup.exe
                                                                                                                    "C:\Users\Admin\Downloads\DiscordSetup.exe"
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:5408
                                                                                                                    • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
                                                                                                                      3⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:3620
                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe" --squirrel-install 1.0.9147
                                                                                                                        4⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        • Checks processor information in registry
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        PID:2612
                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9147 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=28.2.10 --initial-client-data=0x514,0x518,0x51c,0x508,0x520,0x7ff61b013108,0x7ff61b013114,0x7ff61b013120
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:644
                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\Update.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:4860
                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1920 --field-trial-handle=1924,i,9986096698001741061,9514857193644297320,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:5940
                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --mojo-platform-channel-handle=2232 --field-trial-handle=1924,i,9986096698001741061,9514857193644297320,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:4448
                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                          C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f
                                                                                                                          5⤵
                                                                                                                          • Adds Run key to start application
                                                                                                                          • Modifies registry key
                                                                                                                          PID:3296
                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                          C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
                                                                                                                          5⤵
                                                                                                                          • Modifies registry class
                                                                                                                          • Modifies registry key
                                                                                                                          PID:4496
                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                          C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
                                                                                                                          5⤵
                                                                                                                          • Modifies registry class
                                                                                                                          • Modifies registry key
                                                                                                                          PID:4208
                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                          C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe\",-1" /f
                                                                                                                          5⤵
                                                                                                                          • Modifies registry class
                                                                                                                          • Modifies registry key
                                                                                                                          PID:4632
                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                          C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe\" --url -- \"%1\"" /f
                                                                                                                          5⤵
                                                                                                                          • Modifies registry class
                                                                                                                          • Modifies registry key
                                                                                                                          PID:5160
                                                                                                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                                                                                  1⤵
                                                                                                                    PID:628
                                                                                                                  • C:\Users\Admin\AppData\Local\Discord\Update.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
                                                                                                                    1⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:5468
                                                                                                                    • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe"
                                                                                                                      2⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Checks processor information in registry
                                                                                                                      PID:5236
                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9147 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=28.2.10 --initial-client-data=0x4fc,0x500,0x504,0x4f0,0x508,0x7ff61b013108,0x7ff61b013114,0x7ff61b013120
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:6128
                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2204 --field-trial-handle=2200,i,604437810054759693,2084162170065941256,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:2116
                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --mojo-platform-channel-handle=2660 --field-trial-handle=2200,i,604437810054759693,2084162170065941256,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:3908
                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=0 --gpu-device-id=0 --gpu-sub-system-id=0 --gpu-revision=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2808 --field-trial-handle=2200,i,604437810054759693,2084162170065941256,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:4584
                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
                                                                                                                        3⤵
                                                                                                                        • Modifies registry class
                                                                                                                        • Modifies registry key
                                                                                                                        PID:5848
                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3172 --field-trial-handle=2200,i,604437810054759693,2084162170065941256,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
                                                                                                                        3⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:4880
                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
                                                                                                                        3⤵
                                                                                                                        • Modifies registry class
                                                                                                                        • Modifies registry key
                                                                                                                        PID:2044
                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe\",-1" /f
                                                                                                                        3⤵
                                                                                                                        • Modifies registry class
                                                                                                                        • Modifies registry key
                                                                                                                        PID:5388
                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe\" --url -- \"%1\"" /f
                                                                                                                        3⤵
                                                                                                                        • Modifies registry class
                                                                                                                        • Modifies registry key
                                                                                                                        PID:3216
                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --mojo-platform-channel-handle=4032 --field-trial-handle=2200,i,604437810054759693,2084162170065941256,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:4808
                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --mojo-platform-channel-handle=4296 --field-trial-handle=2200,i,604437810054759693,2084162170065941256,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:1588
                                                                                                                  • C:\Users\Admin\AppData\Local\Discord\Update.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
                                                                                                                    1⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:4036
                                                                                                                    • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe"
                                                                                                                      2⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Checks processor information in registry
                                                                                                                      PID:1040
                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9147 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=28.2.10 --initial-client-data=0x4e0,0x4e4,0x4e8,0x4d4,0x4ec,0x7ff61b013108,0x7ff61b013114,0x7ff61b013120
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:2340
                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2432 --field-trial-handle=2436,i,3145379087616781086,13241702052435055961,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:1392
                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --mojo-platform-channel-handle=2664 --field-trial-handle=2436,i,3145379087616781086,13241702052435055961,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:5468
                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=0 --gpu-device-id=0 --gpu-sub-system-id=0 --gpu-revision=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2772 --field-trial-handle=2436,i,3145379087616781086,13241702052435055961,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:5400
                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9147\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2892 --field-trial-handle=2436,i,3145379087616781086,13241702052435055961,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
                                                                                                                        3⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:5732
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                    1⤵
                                                                                                                    • Enumerates system info in registry
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                    PID:3128
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9499ab58,0x7ffa9499ab68,0x7ffa9499ab78
                                                                                                                      2⤵
                                                                                                                        PID:4816
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1960,i,10018224846665124277,11078123554781938679,131072 /prefetch:2
                                                                                                                        2⤵
                                                                                                                          PID:1256
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1968 --field-trial-handle=1960,i,10018224846665124277,11078123554781938679,131072 /prefetch:8
                                                                                                                          2⤵
                                                                                                                            PID:1588
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1992 --field-trial-handle=1960,i,10018224846665124277,11078123554781938679,131072 /prefetch:8
                                                                                                                            2⤵
                                                                                                                              PID:1968
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1960,i,10018224846665124277,11078123554781938679,131072 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:468
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=1960,i,10018224846665124277,11078123554781938679,131072 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:2260
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4172 --field-trial-handle=1960,i,10018224846665124277,11078123554781938679,131072 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:1532
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4204 --field-trial-handle=1960,i,10018224846665124277,11078123554781938679,131072 /prefetch:8
                                                                                                                                    2⤵
                                                                                                                                      PID:4768
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4480 --field-trial-handle=1960,i,10018224846665124277,11078123554781938679,131072 /prefetch:8
                                                                                                                                      2⤵
                                                                                                                                        PID:4856
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4432 --field-trial-handle=1960,i,10018224846665124277,11078123554781938679,131072 /prefetch:8
                                                                                                                                        2⤵
                                                                                                                                          PID:5988
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4656 --field-trial-handle=1960,i,10018224846665124277,11078123554781938679,131072 /prefetch:8
                                                                                                                                          2⤵
                                                                                                                                            PID:5672
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4004 --field-trial-handle=1960,i,10018224846665124277,11078123554781938679,131072 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:5996
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3180 --field-trial-handle=1960,i,10018224846665124277,11078123554781938679,131072 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                                PID:880
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1960,i,10018224846665124277,11078123554781938679,131072 /prefetch:2
                                                                                                                                                2⤵
                                                                                                                                                  PID:4384
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                                                                                                                1⤵
                                                                                                                                                  PID:4440

                                                                                                                                                Network

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\Program Files\Java\jre-1.8\temp-launcher\TNoodle-WCA-1.2.2.exe
                                                                                                                                                  Filesize

                                                                                                                                                  285KB

                                                                                                                                                  MD5

                                                                                                                                                  1562e15220d8771fcb11b9a5b234a970

                                                                                                                                                  SHA1

                                                                                                                                                  50ec8e4e7125bda147a1b2ccc2b2827db2dc3479

                                                                                                                                                  SHA256

                                                                                                                                                  366199821c1efede3f7112d21da045fd6bf38b56fb3da1ae9d6493c4ddc1861f

                                                                                                                                                  SHA512

                                                                                                                                                  a07873f0a5381d202a6439a3245dd51f405cdcec4a9d40ff6ffdd4670a3b218008f7288a89e2a7455782c677d4c661bda96e62f813ce7d8c1f20a6c4c7c2b31f

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5236_1612660473\Google.Widevine.CDM.dll
                                                                                                                                                  Filesize

                                                                                                                                                  2.7MB

                                                                                                                                                  MD5

                                                                                                                                                  477c17b6448695110b4d227664aa3c48

                                                                                                                                                  SHA1

                                                                                                                                                  949ff1136e0971a0176f6adea8adcc0dd6030f22

                                                                                                                                                  SHA256

                                                                                                                                                  cb190e7d1b002a3050705580dd51eba895a19eb09620bdd48d63085d5d88031e

                                                                                                                                                  SHA512

                                                                                                                                                  1e267b01a78be40e7a02612b331b1d9291da8e4330dea10bf786acbc69f25e0baece45fb3bafe1f4389f420ebaa62373e4f035a45e34eada6f72c7c61d2302ed

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5236_1612660473\manifest.json
                                                                                                                                                  Filesize

                                                                                                                                                  145B

                                                                                                                                                  MD5

                                                                                                                                                  bbc03e9c7c5944e62efc9c660b7bd2b6

                                                                                                                                                  SHA1

                                                                                                                                                  83f161e3f49b64553709994b048d9f597cde3dc6

                                                                                                                                                  SHA256

                                                                                                                                                  6cce5ad8d496bc5179fa84af8afc568eeba980d8a75058c6380b64fb42298c28

                                                                                                                                                  SHA512

                                                                                                                                                  fb80f091468a299b5209acc30edaf2001d081c22c3b30aad422cbe6fea7e5fe36a67a8e000d5dd03a30c60c30391c85fa31f3931e804c351ab0a71e9a978cc0f

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5236_919763326\manifest.json
                                                                                                                                                  Filesize

                                                                                                                                                  1001B

                                                                                                                                                  MD5

                                                                                                                                                  2648d437c53db54b3ebd00e64852687e

                                                                                                                                                  SHA1

                                                                                                                                                  66cfe157f4c8e17bfda15325abfef40ec6d49608

                                                                                                                                                  SHA256

                                                                                                                                                  68a3d7cb10f3001f40bc583b7fff0183895a61d3bd1b7a1c34e602df6f0f8806

                                                                                                                                                  SHA512

                                                                                                                                                  86d5c3129bec156b17b8ebd5dec5a6258e10cb426b84dd3e4af85c9c2cd7ebf4faea01fd10dd906a18ea1042394c3f41a835eae2d83dc8146dfe4b6d71147828

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
                                                                                                                                                  Filesize

                                                                                                                                                  46B

                                                                                                                                                  MD5

                                                                                                                                                  858a92c24a1383aca6d720fd7a5bc5de

                                                                                                                                                  SHA1

                                                                                                                                                  5c61af2fbced1d4b148e87ff2d6eb092644fa894

                                                                                                                                                  SHA256

                                                                                                                                                  1161716c268d4cf56b752817875cdf5e9df2124bce707de66c4816f232598313

                                                                                                                                                  SHA512

                                                                                                                                                  1ea5437ebf63e9dd76e8e6fa7d8efed9051b3ade33270b3cefc9ac52c908d212a0a6f6f71b567a86ad492bdbbacc7bbd8567eb7aabdf394fea3e0a5b854c3eab

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\data_1
                                                                                                                                                  Filesize

                                                                                                                                                  264KB

                                                                                                                                                  MD5

                                                                                                                                                  31cb3b328c0a99a803e9eb14f715d9fb

                                                                                                                                                  SHA1

                                                                                                                                                  fa33cc279a35639c891afa204c44d8a909ce36b2

                                                                                                                                                  SHA256

                                                                                                                                                  43a17a23776f6727f50cb521e62289fb7c41f37f0fd2f6904b90f87bee4ccc1c

                                                                                                                                                  SHA512

                                                                                                                                                  c84e79ae29cffe0ddae99c5e208ed3b049ff0ef869dc28576220d1ef851ba625db4fdcfac25e78c7fe26ef744a01df618bf9e621048cb16a29b298996c115e2b

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG
                                                                                                                                                  Filesize

                                                                                                                                                  292B

                                                                                                                                                  MD5

                                                                                                                                                  5341e02652b3af7c40722ad72a0e0255

                                                                                                                                                  SHA1

                                                                                                                                                  75daa0feaaaa913cb28a65ae2163f8bcca48ae64

                                                                                                                                                  SHA256

                                                                                                                                                  5f0f327914e59297d88838fa0bc87dec5f392ff633b7616c017bc04e8a524ea2

                                                                                                                                                  SHA512

                                                                                                                                                  8688cd43c034e9a7e795e0cd1255acf7250c80e5feb0cd434dbbd934d4f718173ccd6a81bd52d0aeec62ef5d56f326383be07b51fdb8bba10ffb1a549dba69c1

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links
                                                                                                                                                  Filesize

                                                                                                                                                  128KB

                                                                                                                                                  MD5

                                                                                                                                                  f81de065dd947c3c61fc0ec48f7c01be

                                                                                                                                                  SHA1

                                                                                                                                                  31ee17793d20f7272565db0efbe784f8193285f4

                                                                                                                                                  SHA256

                                                                                                                                                  f56a44c84cd91d0f84ad965192bd865988ea430bd316ffa1aa20e9d5aa05c7ae

                                                                                                                                                  SHA512

                                                                                                                                                  30350459b5cb5abbb18a6208d136970f1f47f5402f572a524fd727a48cfbb775c3c8cc7a3c6f641378de904c888c18853c4271ab2e9ae43b2f2d8b1cadd3e974

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  MD5

                                                                                                                                                  b77267a8f659bf0f96ebd1d59b2fb286

                                                                                                                                                  SHA1

                                                                                                                                                  8bb60355a9c7475134a1b3295632b3832a2c7d3e

                                                                                                                                                  SHA256

                                                                                                                                                  f78d41bbf4060c84eb04d8518c6871af74d97b2c2418e175a50432d448ef45c4

                                                                                                                                                  SHA512

                                                                                                                                                  18b9c9723a687feb37365298e48edc08e43ca02b6d6170e2a9d775243f1ace94da03cd6d085f31dd060a8a96f939f976625c0b9c95715476769e6687bd21dc9b

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  MD5

                                                                                                                                                  c4baf236946fbab24de837bd2af479b0

                                                                                                                                                  SHA1

                                                                                                                                                  1b2fe5e8473a6fbe7698d27c340453967375a599

                                                                                                                                                  SHA256

                                                                                                                                                  2218eea8cb71a21084517b5994526edde5f7cdc88b8579e568b196bb00517b8f

                                                                                                                                                  SHA512

                                                                                                                                                  38c073c90704cbcb3cf7602e67a8609964c65c235126b8f58e7d59e53f9793828c3ccc48ddbbbb5255e209654f18726ac7ec63d74c0b07d959f20c0342833939

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  MD5

                                                                                                                                                  0ba058f890406797b3952ea4693fcbab

                                                                                                                                                  SHA1

                                                                                                                                                  56e9c569650b57fd90471fa2dc1820d69a6d5364

                                                                                                                                                  SHA256

                                                                                                                                                  26225cef4f3b97165c3769aa931658fc6a94935dd68aecfd0e31776d7341d942

                                                                                                                                                  SHA512

                                                                                                                                                  89ac3e741130c2b69957e2232e0303b3b4ebc9e4042b311f746144501678c06204e325d88f9710acd637195ad21449a31115b10b5bd6f6a5e9e32a20579de02a

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  MD5

                                                                                                                                                  d5b2798a21727d6c9b616891ad38ef13

                                                                                                                                                  SHA1

                                                                                                                                                  a67f05fa02b2ad7a7cb8a011bb7a08b50504272a

                                                                                                                                                  SHA256

                                                                                                                                                  46ce89a3ca24a7e9e01cb685d6df624b9b6e4c35e0ad34e7263ac8addde19270

                                                                                                                                                  SHA512

                                                                                                                                                  fd74a5efd385ff450f0b665825d66807972df33415bfe5afa3bda352d78c7b9ff47ba01f40d72cfa7e237e78f00a1c3bc36b5091aaeb3d306fbc853dc012735f

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\DesktopNotification\NotificationsDB\notificationsDB
                                                                                                                                                  Filesize

                                                                                                                                                  24KB

                                                                                                                                                  MD5

                                                                                                                                                  4fe2b64a2631d0d6eb30b8f42b49bcf5

                                                                                                                                                  SHA1

                                                                                                                                                  10c931554e79c2f4280a65ef2ad57ff61a2429ec

                                                                                                                                                  SHA256

                                                                                                                                                  4901703febb24c665059d25ae6d0769c55051bcdc1b7a72b600252d4c3b0eca0

                                                                                                                                                  SHA512

                                                                                                                                                  8ad48178aa8d835e0c2028688e41f575e50e21b6b4b59161d08984c300911fda1a4614738bfa5557c3f2d254373a61497b491cbc7fb163afea2dbe08fcb67004

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst
                                                                                                                                                  Filesize

                                                                                                                                                  97KB

                                                                                                                                                  MD5

                                                                                                                                                  700e7d6f9cfc26cea4d04f65f02b3452

                                                                                                                                                  SHA1

                                                                                                                                                  e5580200e54edb7cd4f7c5daada5c031434cf334

                                                                                                                                                  SHA256

                                                                                                                                                  c3d8aef5d450a90e4a51335532c977515e589143be772697e666c8c9f4ab0c0e

                                                                                                                                                  SHA512

                                                                                                                                                  1cafa5bab9838052312d8a6ced7d9baa4f28ef77d48681ada4dedf29400d235b51e187a1f207cfd8e008ee6274156cb7ef2821fdf7cbcc65d697ff4f469d7a82

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat
                                                                                                                                                  Filesize

                                                                                                                                                  324KB

                                                                                                                                                  MD5

                                                                                                                                                  7c02341fddfd3cfb02f9eb56c990000d

                                                                                                                                                  SHA1

                                                                                                                                                  eca1b9e2a1b8a241cecf6e9a488b3bd4eace09fe

                                                                                                                                                  SHA256

                                                                                                                                                  7ef427eb0d2fe00efb4bb547fc4a11fca1a710f4fa1c55901a8b25688ddc5661

                                                                                                                                                  SHA512

                                                                                                                                                  a0ea0e8c3212395b39292d65d81d28fba3ca886c0aba05f1d375201848ff1ee55a3cbcbcf85a7a7fa7a7178dc0aee0d42dcefb4b516232a88d6df90527d2466d

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
                                                                                                                                                  Filesize

                                                                                                                                                  12KB

                                                                                                                                                  MD5

                                                                                                                                                  1b881887d646741776601c652ed740ed

                                                                                                                                                  SHA1

                                                                                                                                                  9636375846c44b6541a3fb945958f4382e7633a1

                                                                                                                                                  SHA256

                                                                                                                                                  af1e871b3f38812ce39960f66663e3bfe04eda8afa3d76031261ce9eabe286cc

                                                                                                                                                  SHA512

                                                                                                                                                  8e2d45568ada8a18c07dfeb80c70203caf85371109a3c84bee07f2a4600890a9c377f5fb901db4bd95daa8581cdf62fef709bf4a6fe205224f4becf23dae4b0a

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin
                                                                                                                                                  Filesize

                                                                                                                                                  39KB

                                                                                                                                                  MD5

                                                                                                                                                  b41d29d45c1f55f1ecb185786e44bf37

                                                                                                                                                  SHA1

                                                                                                                                                  23a074aaacdb70da7d844fd842e4587acf6c87c7

                                                                                                                                                  SHA256

                                                                                                                                                  50be15c4bf850538ad6905a2065345f921185610e0774ca64e7920366ccea35c

                                                                                                                                                  SHA512

                                                                                                                                                  5cc0c48aafa499ab8c3678002c99e1e93f138a1935d2264095e8ad03a68027673002b8795776b1722511d3b0c5d1b7b13d1625f39f4c555c81fd726e2b1a9f25

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Discord\app.ico
                                                                                                                                                  Filesize

                                                                                                                                                  278KB

                                                                                                                                                  MD5

                                                                                                                                                  084f9bc0136f779f82bea88b5c38a358

                                                                                                                                                  SHA1

                                                                                                                                                  64f210b7888e5474c3aabcb602d895d58929b451

                                                                                                                                                  SHA256

                                                                                                                                                  dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43

                                                                                                                                                  SHA512

                                                                                                                                                  65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                  Filesize

                                                                                                                                                  40B

                                                                                                                                                  MD5

                                                                                                                                                  2cd879c3b1b25f881f4b7ab71b67a095

                                                                                                                                                  SHA1

                                                                                                                                                  e8c477526bb5bdddd659fdd44606060d83e703ad

                                                                                                                                                  SHA256

                                                                                                                                                  d15ec0b42a1305238584533da0ddd5ec2959a76896cabc74599185af8af9e92a

                                                                                                                                                  SHA512

                                                                                                                                                  95c25065ecb23b375e233d554beb9c5fb61d877f6b5586155d5b5931d270cedfd4508a8fde3dfee5073af2215b256d7cffde9f77923d41909d4168d9bc61123a

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\131cdff1-123c-434b-ba6d-a16320a93911.tmp
                                                                                                                                                  Filesize

                                                                                                                                                  1B

                                                                                                                                                  MD5

                                                                                                                                                  5058f1af8388633f609cadb75a75dc9d

                                                                                                                                                  SHA1

                                                                                                                                                  3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                                  SHA256

                                                                                                                                                  cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                                  SHA512

                                                                                                                                                  0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1f4e17b2-638b-4205-bdd3-ff3fcaff71e6.tmp
                                                                                                                                                  Filesize

                                                                                                                                                  6KB

                                                                                                                                                  MD5

                                                                                                                                                  8fb240a3420e3bc9dc6c6af0dea86660

                                                                                                                                                  SHA1

                                                                                                                                                  ee6f5154f59b7427be4e166a415c7b687631e408

                                                                                                                                                  SHA256

                                                                                                                                                  7a33e08a90fc399fa20fb7a41d337a5e28de67612823bc7244868011b6818e30

                                                                                                                                                  SHA512

                                                                                                                                                  4409ecc4fe3e20443d870a419877705c24a376fef5d541a6e675643fde87e94167f3788b7bea5692e23371c502f2bc24c19217195c223a75449e62058350b1bd

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\739420c9-2553-4357-9b18-e3a2ab44f75b.tmp
                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                  MD5

                                                                                                                                                  33425893cf52e8fba505121d4687eb96

                                                                                                                                                  SHA1

                                                                                                                                                  37ba54e2b0e6d4c59cd725774db2d393d9709e79

                                                                                                                                                  SHA256

                                                                                                                                                  d2604c92783a305c111b5745bd6f52eec8c7521113d20d9511bd720b347428ae

                                                                                                                                                  SHA512

                                                                                                                                                  7b55a905609fcbc2157ad0e608dffa33f373e0e56c187194bae7889fa066b9b7215d3fb4149890e148dda5409502a7dbd04e1e80df8e8eedc9bd7349b4ecee61

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000035
                                                                                                                                                  Filesize

                                                                                                                                                  26KB

                                                                                                                                                  MD5

                                                                                                                                                  a2fc0e081dfada88a77cee5dadc3203f

                                                                                                                                                  SHA1

                                                                                                                                                  a0fb3c85a6fa51cf76f80e30b40f7cb0f242137f

                                                                                                                                                  SHA256

                                                                                                                                                  974bf7a352f55a4cf9dda61140a7a2ae46fb4b20513883e8f387087bd98641e1

                                                                                                                                                  SHA512

                                                                                                                                                  e9f1f37cec3828c90522ed76e8a2adf0012a7f46bf63b5f1c99815e767c7dd9ca604d8c359845f91254557e15601eb309a733be18425f993c2a379b7bbb7cf4e

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000037
                                                                                                                                                  Filesize

                                                                                                                                                  21KB

                                                                                                                                                  MD5

                                                                                                                                                  50fc6fac3f30159f5b14b37ad004ed24

                                                                                                                                                  SHA1

                                                                                                                                                  e57b4bae4ac59f840bb843e4bcefaa6a0076e4e8

                                                                                                                                                  SHA256

                                                                                                                                                  7e4e6fdfe26e8a6c0ffcb452f4075a480c706c2bc06eb63f172ebed965cf3568

                                                                                                                                                  SHA512

                                                                                                                                                  e7ba359457359951ea2624872ae794294e4e267b20df4868d7180828e4c2d049bedb3d4e737b78b4c1f2481ce8d34752323816b2c584df5854b697ba08cd1f1f

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                  Filesize

                                                                                                                                                  864B

                                                                                                                                                  MD5

                                                                                                                                                  ba402290a2dcf7ba5db4030ce143df50

                                                                                                                                                  SHA1

                                                                                                                                                  aa4e66d8602dfa87c18ecbd65b68b601440b1e96

                                                                                                                                                  SHA256

                                                                                                                                                  910159add82510c406044da8e03ab6707b18eb1ce9b5554fb3003d3b6847a7df

                                                                                                                                                  SHA512

                                                                                                                                                  345ad41bc503923f0db4e85733a42a034382877f70ce451f73d92099cd1fce9134f5022f700bd17dc1c63de94418ce7050058574d12932247e9bdaffa6fbb9a5

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                  Filesize

                                                                                                                                                  768B

                                                                                                                                                  MD5

                                                                                                                                                  d608b0938a95834718969622042ce7a2

                                                                                                                                                  SHA1

                                                                                                                                                  f45963b4430e40de04dd326b5cf89147d0492eab

                                                                                                                                                  SHA256

                                                                                                                                                  5554dc33dd96fd51a20f66b934b348151e017daeb9e77226b08ce978fed1cb4e

                                                                                                                                                  SHA512

                                                                                                                                                  ccca82fb41d94fd7de6580bbb7f8cd4ae98be6999f3af8ff36e9edf893016a3df40c6d9b147a630163cf0f9fff8509b99d0308e92a698f8fc54742209c5ea308

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                  Filesize

                                                                                                                                                  5KB

                                                                                                                                                  MD5

                                                                                                                                                  825ce4c9c6af77cdc9cd48ff6f4a38a7

                                                                                                                                                  SHA1

                                                                                                                                                  a2c980be5bf4714a4a0bcf8b9b8b626a49b42247

                                                                                                                                                  SHA256

                                                                                                                                                  b19440935266564dfbbdad4caeb430fe8f720ccb6a01f8bb3aa4163e48fbae34

                                                                                                                                                  SHA512

                                                                                                                                                  e5b76013e3e4b5ef00061b22b5a5234e2cfea65c11632f4dee3f26efa8b411b8810ecfa71802dc2e52197c35f7e4eb7080312ad4c04cae516947ac4d6ea9ac31

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  MD5

                                                                                                                                                  168fd2d9cae658cefd8784b2dee8447d

                                                                                                                                                  SHA1

                                                                                                                                                  08882d5f179ac30fbaa22775668bd38077c0fd29

                                                                                                                                                  SHA256

                                                                                                                                                  5a2ee0aa866159e64c7013ae6721f681cb11344b39b5f886403d3c0623ea7568

                                                                                                                                                  SHA512

                                                                                                                                                  2968a05a672841c5daf63df834df9ef37cf79b42651e22cb4c51f6dc7a67887fefbf3d4f7eb635f08658b160ccc28bd25e92a2eb4c4889be5da3abde2b017633

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                  Filesize

                                                                                                                                                  5KB

                                                                                                                                                  MD5

                                                                                                                                                  1b683d48c8f9cc4a3da36e7f4434e07f

                                                                                                                                                  SHA1

                                                                                                                                                  796e23c776f731186a03fb72e54b75883c340b69

                                                                                                                                                  SHA256

                                                                                                                                                  ab29ab8451067ffbdc9b5f50382bcebb925d4069b8fdc84fd92b3893bc8c7329

                                                                                                                                                  SHA512

                                                                                                                                                  9868a833399ab695532f6a18952eb17ab705099e0728c72b5a0c4ad09a2c649fa0d7765770682a7a7f60587b793718ac1305232956b16fe08bd863a1073d45e8

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                  Filesize

                                                                                                                                                  2B

                                                                                                                                                  MD5

                                                                                                                                                  d751713988987e9331980363e24189ce

                                                                                                                                                  SHA1

                                                                                                                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                  SHA256

                                                                                                                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                  SHA512

                                                                                                                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                  Filesize

                                                                                                                                                  524B

                                                                                                                                                  MD5

                                                                                                                                                  0dc6d6881c5c1b495a1de91b22b0d768

                                                                                                                                                  SHA1

                                                                                                                                                  e177fcf488b8e964fc4a8a4a281c30462e6211df

                                                                                                                                                  SHA256

                                                                                                                                                  3aaa89fcec693ff2f776e9ae7f2b62c0cad04da10f2747750793fa93c28022ba

                                                                                                                                                  SHA512

                                                                                                                                                  132f31d448b032fd1e2538ab7bf3d143e4aed82bda7d9a86dae994bddeb527ee5fef6efd7a0909ba3bd1af94f6f42e72e161afd5a3282dfc508cf3beb602d6ff

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                  Filesize

                                                                                                                                                  356B

                                                                                                                                                  MD5

                                                                                                                                                  279dbcf147bfd10a34badd4310fa48f1

                                                                                                                                                  SHA1

                                                                                                                                                  2dee017b8db6e6c2a42ec6eb50d7ce60a3c41a96

                                                                                                                                                  SHA256

                                                                                                                                                  ac9f8cab55d9f245252bf85362711262a25d592725914dcc600e01a361e21306

                                                                                                                                                  SHA512

                                                                                                                                                  236af2666db0b54f75ef80d0a4e464128517e82b780de87bbe41ea06b678e293c8a78846386ef2c95a2fce4914b2aa73fda2ce17c94c810703d52930c2f3c409

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  9b2cdd71561ceca59f3c8e71430e6be9

                                                                                                                                                  SHA1

                                                                                                                                                  dfd0d48b6d598c6599c1a10a3ab36d104a7d7573

                                                                                                                                                  SHA256

                                                                                                                                                  6b9d5304b9392ecbd93d6b8fd3fa09527f3d432a34a4d467551d9e34d27e1e87

                                                                                                                                                  SHA512

                                                                                                                                                  f7907b5b2867b23678b83a79d4d8baf279f98e0eb12eb09e3fa4e39995d574e23f3f2f0fe304bb0c44efc35f02f64a083e63042eb3f19485d8b377a12b37d2dd

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  47a90eb591b8750a31cb0a3e732d5e08

                                                                                                                                                  SHA1

                                                                                                                                                  3a35030c67e7a9f72a8588a35cdc992db3041e85

                                                                                                                                                  SHA256

                                                                                                                                                  6bc64299259e78fd0eb8f51b35a6a3ba5246752890ad731926eb8df21992bb46

                                                                                                                                                  SHA512

                                                                                                                                                  5fa3e279e0056174eab461ab83eaa1c8f8b21762cf64b9d91a72793317da828c88fbcc30072217457092e9674d8c8cc7861d955aa6aaff2922cf2ed19c35c013

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  baab25d858aeee939d3efeb05b57a448

                                                                                                                                                  SHA1

                                                                                                                                                  430dbd753794a7fc879488266edf24268500ca6a

                                                                                                                                                  SHA256

                                                                                                                                                  2914e9c636ac88590632f01d3432ec3cae475c0fd929fd77c6197f6d1926dba3

                                                                                                                                                  SHA512

                                                                                                                                                  9700cf952f48a0aa00bf45d559bf2368cd29c568fe26701d10d773ea82559dee8595e968e977f207fb2b7aa12481208116d58d2d85a61f2cad324a5a6248c24f

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  Filesize

                                                                                                                                                  7KB

                                                                                                                                                  MD5

                                                                                                                                                  3c7074603d802a6ae6490f502b173073

                                                                                                                                                  SHA1

                                                                                                                                                  c8583bede21197ea0598d7d9ab4f707d01ee60ec

                                                                                                                                                  SHA256

                                                                                                                                                  6b72dd70e175da12a1abab7e46af2c3c705fd2ffe39d2c6fc4e92ed79fc1a381

                                                                                                                                                  SHA512

                                                                                                                                                  6c349e8791839a956a84f50082a2bac387704c85667344c56acc32cc2916c48e1a456dd411e1348fe99e15df4e72458a90a91d5ff1079b7b6f33956105d5b108

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  Filesize

                                                                                                                                                  7KB

                                                                                                                                                  MD5

                                                                                                                                                  0f813e1083ab0dd338a0b6ad9b999d79

                                                                                                                                                  SHA1

                                                                                                                                                  789b4f660e65d25ae82052a93d0cf2ccec6514e6

                                                                                                                                                  SHA256

                                                                                                                                                  d8ef587f310c1dcf367764ed2d1b4385243e5a7263a8103cd47112e679765e05

                                                                                                                                                  SHA512

                                                                                                                                                  57a97b6c609b88601fe67b7153e5f3742e330dd69fd2e9e2e13e50ac7afe6bb14c99cf86f80b7a4b585e58839d219a5e2b9746549d640356f579ffec660d9eab

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                  MD5

                                                                                                                                                  808947eef79d1da4c949b7a8d8dae276

                                                                                                                                                  SHA1

                                                                                                                                                  54646e45840542235abbaa6b98c71b2720971b42

                                                                                                                                                  SHA256

                                                                                                                                                  4a66f9c364cbbfbbde76505c2750b819d8162ff489f07114cc07b7d3e1262456

                                                                                                                                                  SHA512

                                                                                                                                                  3596adfd4dbee7f766f86a3a6fe16fdd2880514d1bab3d7e135809dc501cf13e72052b4bdad53101dc32b2b881083debe6222f01e839e4af51180b44bb6c0ec9

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                  MD5

                                                                                                                                                  cf56ebb84bafb7d710c0396fe4130437

                                                                                                                                                  SHA1

                                                                                                                                                  b2523a56a8fc62e44a051806cb01ed98eabda8f6

                                                                                                                                                  SHA256

                                                                                                                                                  534390e8ad986d9fa6ea8a3417c19f163f1150afe6cc2110e7a4ecb531eec5f5

                                                                                                                                                  SHA512

                                                                                                                                                  2b972cc3ba03677d2e4c94e2163f4e43d3c7534647571ff749a2f66508a3e3ff5b48a1d89b75cef3bf129a5fff7f623eec3315b3c4519e368a048d557213a425

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                  Filesize

                                                                                                                                                  16KB

                                                                                                                                                  MD5

                                                                                                                                                  248cab51686c805a66b72c2c054101d2

                                                                                                                                                  SHA1

                                                                                                                                                  10c462afb744070085b4c1f01fc817b2264fc950

                                                                                                                                                  SHA256

                                                                                                                                                  29f84afc4920d99b7195b3d28c5abe3af955445f5f048e81aab41f7d852aea37

                                                                                                                                                  SHA512

                                                                                                                                                  fa12cc6f0aa92ea7e20ede01f9c6ea2a5490a74a7b0325575560f7bf8c39de4b683b8b0613e009861bbbd967e6c5f3f9eb7e5d5a45eb1f9b2c236c9b6ba2abf2

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  Filesize

                                                                                                                                                  259KB

                                                                                                                                                  MD5

                                                                                                                                                  fc1f0c521171787e496aa824078793ea

                                                                                                                                                  SHA1

                                                                                                                                                  a0b936ca156353032bc598e8430e7003b00f038a

                                                                                                                                                  SHA256

                                                                                                                                                  84c9b1890b3651045dbe3fd85fd041a60ec32c612baa15bc2c51603ebd33d97e

                                                                                                                                                  SHA512

                                                                                                                                                  6fc87bd1d42da97705870c7870a772ce756e20f5754e8c6da5d109b36f9feaf325fe4b9cbe7c71d886cbdeba3be50c2e1f1e6b8ac2862c37b46aba2e2956d905

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  Filesize

                                                                                                                                                  259KB

                                                                                                                                                  MD5

                                                                                                                                                  224410292602f86ad00452f366fcf483

                                                                                                                                                  SHA1

                                                                                                                                                  86eda5692d0ac26705a3a24fe0fc862e33fb3e57

                                                                                                                                                  SHA256

                                                                                                                                                  990c70fdd5835221d4112d9623e851b4d69542f3a2cf0720d7581e1fc16d1e16

                                                                                                                                                  SHA512

                                                                                                                                                  45fb3d891e019849e9a4bdd5cb0a673b3e90a5c5cbe82a016d809bd12f6fd9c1e78232823f02dbbf6bea6699a858d768d36d15249b5c068078a98252e68620e9

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                  Filesize

                                                                                                                                                  133KB

                                                                                                                                                  MD5

                                                                                                                                                  884c3d449ba9a47a4a236ac1122fa275

                                                                                                                                                  SHA1

                                                                                                                                                  2ac5daccde9d546abfc013001f1b009365363275

                                                                                                                                                  SHA256

                                                                                                                                                  83fb9adcd98e2c39a68dac36fe4fc027c99e4dd98a7fe9a169c65075c76495ea

                                                                                                                                                  SHA512

                                                                                                                                                  1883b644337872bc820e525f15830f9a307f1c68fbd9322a5e66d268d76dd5dee8c18e44f99faa9c79ef6e607c46724cfd5d7c2e1724c3fc28992d61c835cdb6

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                                                                                  Filesize

                                                                                                                                                  96KB

                                                                                                                                                  MD5

                                                                                                                                                  311b2db0bbbdefa62e8fa683906f0189

                                                                                                                                                  SHA1

                                                                                                                                                  ac3ba19f8a836942ea87308a22f7cd16673b818b

                                                                                                                                                  SHA256

                                                                                                                                                  04b7a983e38b1db7c7245aae826cb2d4a3c4784607cb7a64b9ccf5b217832668

                                                                                                                                                  SHA512

                                                                                                                                                  ab206d60d8a0f55246f519ad24a8bc4469e0dff9296f9a75ab23d3601d8ac91e0796b47505b4926cb0145da47cae808c8b27d38b3f0fd8be0fbb690ade243614

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                                                                                  Filesize

                                                                                                                                                  104KB

                                                                                                                                                  MD5

                                                                                                                                                  efa9631bc0bb264d4c23b71b2e645ec3

                                                                                                                                                  SHA1

                                                                                                                                                  d10a9005c6d508c74f7e431e87159bd12a5f219c

                                                                                                                                                  SHA256

                                                                                                                                                  1f8c9648d0cdb9770cddd76500050fc170d9fe21eda4ae6b404287d375be7e35

                                                                                                                                                  SHA512

                                                                                                                                                  333155456d1525f633e21b9e7508d20e445347d3e415c695f86acc2eaa8f351a535c2288adbae7bcedbd738a7efc5b7441d2c14f6a4e4a4faed7bf59536f5201

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                                                                                  Filesize

                                                                                                                                                  103KB

                                                                                                                                                  MD5

                                                                                                                                                  d444e58778bc0ea0c3722876ffc55e47

                                                                                                                                                  SHA1

                                                                                                                                                  707985d1ff3034687f65fccfbc1c570640c84911

                                                                                                                                                  SHA256

                                                                                                                                                  562d3971273370f28873a06c5cbb6af7fa3effd2f1c78a125894ec8bce18527d

                                                                                                                                                  SHA512

                                                                                                                                                  94ff918b87e80a674df914d20528ee067717302cdbe57e534c2ebae688461cb953c063fe8d05ec3c52dc3485e895ac375d16ad89397b814311870d068a111aef

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5d2185.TMP
                                                                                                                                                  Filesize

                                                                                                                                                  88KB

                                                                                                                                                  MD5

                                                                                                                                                  439d3fb8ccbbbbaf5316adfe7d8118cf

                                                                                                                                                  SHA1

                                                                                                                                                  dcf8b20f6301db2e986bb5b8320ddb3978068103

                                                                                                                                                  SHA256

                                                                                                                                                  59b6fdee11de224e4de331cd2fd655b54d1ecba7816ac658835a16dc22c92d08

                                                                                                                                                  SHA512

                                                                                                                                                  9efcdd2b4a1aa02f3c06e065f03597bdda51de6ba19c3fc3023080ec7ab666d780cb55b48ea131ce522ceea763564c559bd9a3ef18f717e814a8e14310967101

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                  Filesize

                                                                                                                                                  152B

                                                                                                                                                  MD5

                                                                                                                                                  eaa3db555ab5bc0cb364826204aad3f0

                                                                                                                                                  SHA1

                                                                                                                                                  a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

                                                                                                                                                  SHA256

                                                                                                                                                  ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

                                                                                                                                                  SHA512

                                                                                                                                                  e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                  Filesize

                                                                                                                                                  152B

                                                                                                                                                  MD5

                                                                                                                                                  4b4f91fa1b362ba5341ecb2836438dea

                                                                                                                                                  SHA1

                                                                                                                                                  9561f5aabed742404d455da735259a2c6781fa07

                                                                                                                                                  SHA256

                                                                                                                                                  d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

                                                                                                                                                  SHA512

                                                                                                                                                  fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87fcecee-8f4e-45c9-885a-3148ae4031c8.tmp
                                                                                                                                                  Filesize

                                                                                                                                                  6KB

                                                                                                                                                  MD5

                                                                                                                                                  cfb8de3b86fe0aa32e72fbcc5027401f

                                                                                                                                                  SHA1

                                                                                                                                                  0a3feadf885bda43c2e46c996e98be1a218988de

                                                                                                                                                  SHA256

                                                                                                                                                  fa4d40dbf0be9cf68b3979d6d433e1aa1c18897d7eb9e5f7a0dc4dbb041d22ba

                                                                                                                                                  SHA512

                                                                                                                                                  4fc7f741b5cb5acbdc5fe9ac3b5823ff5df0ded1fdc7cc270b7d98af33b0e4e1e23c11664ff1c8b4bfc7104018b9cff23c00eea27c6d09f98b7bfe8840f3378c

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                  Filesize

                                                                                                                                                  96B

                                                                                                                                                  MD5

                                                                                                                                                  7de1f4e5f1355bda93c0836600f2289f

                                                                                                                                                  SHA1

                                                                                                                                                  caac83365e7d85108d29bc66c9592dfbbb207011

                                                                                                                                                  SHA256

                                                                                                                                                  edbeb70d57a37e14cbaab93d8c472aafe525e37168dbfe4269efbd239483b6df

                                                                                                                                                  SHA512

                                                                                                                                                  169acde7f3fff4476e5fecb858a6940cc7644b57737d9fd935632a64adcb768d538ac951197b2d3506cfbfd5ebcf57ccf5b5f3938508ab2b8d25f3f8380e125d

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
                                                                                                                                                  Filesize

                                                                                                                                                  264KB

                                                                                                                                                  MD5

                                                                                                                                                  6486004c14163f1b3b64a4fb523dd612

                                                                                                                                                  SHA1

                                                                                                                                                  27d82be16d342687b5ccddb87158c430c47c891a

                                                                                                                                                  SHA256

                                                                                                                                                  b6017e4deac8a8d7b7dfcc308c5cf38467049ada15892274b14a1dd2714131e8

                                                                                                                                                  SHA512

                                                                                                                                                  d7659d0e31fcc3e57a51d698cbde9069ab0f5d2a0c99c4504ae510abee6cecab5d0a71d90c82de57ec147b20c024f6555db64d47fa737f0691aec731fd3b5056

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                  Filesize

                                                                                                                                                  196B

                                                                                                                                                  MD5

                                                                                                                                                  c0ade2d10a8e058b128e955bc7fb7f2e

                                                                                                                                                  SHA1

                                                                                                                                                  441e8cc9eb86e1ba6c557b49d4d78ded9a5ffb0d

                                                                                                                                                  SHA256

                                                                                                                                                  689bae0730ec99ba273d9932cbcb931a93e5233085d608aa00ddd3fb4de3029f

                                                                                                                                                  SHA512

                                                                                                                                                  2f4363aa5dc1cca522d023a1a97208bc2dd6c5a77aa52ddc115aef6e5966fbe4833926e2ed2f4e5b5bed5f7369f01dfc268dd1e9699938111934e091190c29b0

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                  Filesize

                                                                                                                                                  5KB

                                                                                                                                                  MD5

                                                                                                                                                  e9fd417834d763929a00f4d3b77b4e2c

                                                                                                                                                  SHA1

                                                                                                                                                  8cef7f490af491359a5a903ea12a3de661fdbea3

                                                                                                                                                  SHA256

                                                                                                                                                  d603cd00f0ed9941eee041f0a23d03d3ba65da29b00bb18bee3c1fd433aebd65

                                                                                                                                                  SHA512

                                                                                                                                                  6c3f3f33ae245cae2bfa96b90c4fd894c6384b4f3a79d0214fcabe7bd6762b2051ba900077493e2ef48da5557accfa53d18fb05abf7a82729a7a413ed8d80f64

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                  Filesize

                                                                                                                                                  6KB

                                                                                                                                                  MD5

                                                                                                                                                  1b1b3de620a2dc16fbb9510a6738417a

                                                                                                                                                  SHA1

                                                                                                                                                  b7ab00f8791679a2830867b020edd3e3355e03fe

                                                                                                                                                  SHA256

                                                                                                                                                  2895093b43b795ea044312ab74efb4ac8c894de7c8ea46998ecdb29a89d88778

                                                                                                                                                  SHA512

                                                                                                                                                  5560bef7ad94510d0a53c3bb0d62352d38786ef500f2b09c7b3515b38cad8123a66340448e93e4cfd281ad7936649e26ec70204a20541a320c856e211678e1e5

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                  Filesize

                                                                                                                                                  6KB

                                                                                                                                                  MD5

                                                                                                                                                  291f98bbc949ce30128b02c9781f7473

                                                                                                                                                  SHA1

                                                                                                                                                  06f0f9aa3d601d811bd68b18488b0aa77932f6ee

                                                                                                                                                  SHA256

                                                                                                                                                  5ce6bb59c791c5da8332748f53ed4b24f76758b1e4afbfbb9ca49b0abd6005cc

                                                                                                                                                  SHA512

                                                                                                                                                  8e46ff3eb54ee6b8c219f094f1e8e8e651bee3fd4c97d2b13d0963207df5b058549c2e1651aee6d29fae94fdba6ea27150e2a71b8101daa717018a465098daa9

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                  Filesize

                                                                                                                                                  6KB

                                                                                                                                                  MD5

                                                                                                                                                  41596ca79a6a8a4fab5ccfbff10ca2e7

                                                                                                                                                  SHA1

                                                                                                                                                  4456e89d953bdbf3f14e0c08f0eb964b13a2162c

                                                                                                                                                  SHA256

                                                                                                                                                  452b77dd849553884b5ecc96b47c858a2f44915067ef6d451fa308e044f763e0

                                                                                                                                                  SHA512

                                                                                                                                                  61c9a6d7afb7fdbe9e0b90b26a891dc1240be5e8bd462b193f158e6b670682e7a36eb5bdb902fb8ad685d3175e1230ce645fd95bce5702995085e2759a717cee

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                  Filesize

                                                                                                                                                  16B

                                                                                                                                                  MD5

                                                                                                                                                  46295cac801e5d4857d09837238a6394

                                                                                                                                                  SHA1

                                                                                                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                  SHA256

                                                                                                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                  SHA512

                                                                                                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                  Filesize

                                                                                                                                                  16B

                                                                                                                                                  MD5

                                                                                                                                                  206702161f94c5cd39fadd03f4014d98

                                                                                                                                                  SHA1

                                                                                                                                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                                                  SHA256

                                                                                                                                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                                                  SHA512

                                                                                                                                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                  Filesize

                                                                                                                                                  12KB

                                                                                                                                                  MD5

                                                                                                                                                  432ed1aace602aaa5a14bc34ea8f2585

                                                                                                                                                  SHA1

                                                                                                                                                  a604e998af4ce526512b9ce581e28623056e0bf2

                                                                                                                                                  SHA256

                                                                                                                                                  567aa12213693d541ac05510e98ab1eea1de27b7fe9f101fe509260c00754505

                                                                                                                                                  SHA512

                                                                                                                                                  0f2b50957089c1cf6b24e3a29bea98d535009fa5f7026fbae84d223af1c6e11765fd8c0b1fa0409376eb70ddfb43dc40101c01ed7cf048b4cd7967127344ebe1

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                  Filesize

                                                                                                                                                  12KB

                                                                                                                                                  MD5

                                                                                                                                                  5f8552699fe5f11541803db253f35268

                                                                                                                                                  SHA1

                                                                                                                                                  f46db8a0dd9486f79684153e4df1e8006f7df164

                                                                                                                                                  SHA256

                                                                                                                                                  a03b194b649722dd0fb046ce093d77587e3e6e8f917e073bf45d140ac0841052

                                                                                                                                                  SHA512

                                                                                                                                                  46381faafa069b9ca18dfd2c47155fda91556763f7b3f1231851233f677653c0525b3ede4c5d342a508d46b50ed20bf242c7d2e90e1851c5b669b58e98a6e510

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                  Filesize

                                                                                                                                                  11KB

                                                                                                                                                  MD5

                                                                                                                                                  aabdd3eb149c283fcc1e6a84a6582e72

                                                                                                                                                  SHA1

                                                                                                                                                  6807edf3845cf1e627b7020f9e4c6ddaaf615789

                                                                                                                                                  SHA256

                                                                                                                                                  792f01f936cb174348aef789b4ba3ea60f851fe3f9b0bbf313d24ac2b0692114

                                                                                                                                                  SHA512

                                                                                                                                                  f40794b71b7476191cef8e5a3337e3f4f7b1ae9500c4bb60a1a0eed8109fee281aaa34c31aa412c5f48cb1913b16c875c9cb2d7bcbeb08e1e50570d1645371a8

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
                                                                                                                                                  Filesize

                                                                                                                                                  81B

                                                                                                                                                  MD5

                                                                                                                                                  79d221283c0d1389b849165306d9015e

                                                                                                                                                  SHA1

                                                                                                                                                  fcaad52b3b0d49e98d71a56aac199ed95c1301f1

                                                                                                                                                  SHA256

                                                                                                                                                  fd6682599238b669f85bd201e7803c6dd304b6b3a36ca0557b0cc92e21bfa86e

                                                                                                                                                  SHA512

                                                                                                                                                  d70e9a2d137172b45cf6a912e93a6313728003c303fd4235811fd1ec588c9a4c4f924eb9a2588825883c3a8369e5918aa11f485442ec2eacd28deb7410ff308e

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                                                                                                  Filesize

                                                                                                                                                  1.5MB

                                                                                                                                                  MD5

                                                                                                                                                  78b7a9a33ab3c3a17336ad38f5ba9f65

                                                                                                                                                  SHA1

                                                                                                                                                  0089d32e98292c2cf7d16d98616635eac0d90508

                                                                                                                                                  SHA256

                                                                                                                                                  65c2cb5539c0957ab57281f4294cc01876285461f47847eb83304732e0cf4b1c

                                                                                                                                                  SHA512

                                                                                                                                                  53fdef293137c431729181426a47cac1ffc9855c1a7622a7f36dc750a8bafc3607ae81fdb3102f6eb1d4684ef66e2e62116b741243b39a4d8a33d2425f7f122b

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\SystemTrayCache_Admin\ESD82BVHO8KH85O4T38QKLPQEUBPCOI7.cache
                                                                                                                                                  Filesize

                                                                                                                                                  198B

                                                                                                                                                  MD5

                                                                                                                                                  37cab7554d56739071aa7e693d252d8f

                                                                                                                                                  SHA1

                                                                                                                                                  5f78b9001fc9af8719a777de464c3f4cc183bea1

                                                                                                                                                  SHA256

                                                                                                                                                  9c25cc2e102d76914f883dd89a7b2698db8c3d6ede5074bf4029011ee1fac7a1

                                                                                                                                                  SHA512

                                                                                                                                                  c2a98db47826a9d5a97a4bf9db7a192eb8fd33436d1d251b64ca3ebf4df9cd7bfb8519fdfebdf23136db878e454a8561a7ba9925275c5fb79f37df5f1ba182f7

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna5565843683221994923.dll
                                                                                                                                                  Filesize

                                                                                                                                                  248KB

                                                                                                                                                  MD5

                                                                                                                                                  34d12b1e2af72d9bb267bbc8c0d53e4a

                                                                                                                                                  SHA1

                                                                                                                                                  d9ed8776645f6b4f52df16132450863c47ea92d7

                                                                                                                                                  SHA256

                                                                                                                                                  13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03

                                                                                                                                                  SHA512

                                                                                                                                                  c0a063477cf63a8b647ea721842968b506d70ea22c586a412707d7293b46c218b6a510f34b7dbedd3ed29a9d4b5dc5c6a1995403d65884b17348a9545e580a10

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tnoodle.log
                                                                                                                                                  Filesize

                                                                                                                                                  756B

                                                                                                                                                  MD5

                                                                                                                                                  e9886ebd8601f9e5a839518702ac8585

                                                                                                                                                  SHA1

                                                                                                                                                  d0fade8a99993be5f5c63a62fd9c49e899525ae2

                                                                                                                                                  SHA256

                                                                                                                                                  4e2c537c601b06613f66fdd030b591f2bc554c6420caf804269aa76c28ad8d49

                                                                                                                                                  SHA512

                                                                                                                                                  7164587cbf34867507e08848365273c44ec2d133276dee7d976c847c38d71fe90e68ccecf5c326f89b7a91e606a67bd7c2fb1cd3c64b0f8e2b4c37242372934e

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData
                                                                                                                                                  Filesize

                                                                                                                                                  22B

                                                                                                                                                  MD5

                                                                                                                                                  4ac65fd0505524c840e4b8ed9352125f

                                                                                                                                                  SHA1

                                                                                                                                                  f914b6f0df85ed7b5aa059afdbd993e18748493f

                                                                                                                                                  SHA256

                                                                                                                                                  913ef675aa4754fbb1a0b07e73b75d515b05c2058cb1144bc115e0430a90cc11

                                                                                                                                                  SHA512

                                                                                                                                                  9e8913b2e71ca3c0d422a2ed1ca6e2bee3c7c7f493a0f79573ca4e0341946ffb1d38f669521190b1303b4f3f6f392e20b7694ed25a177301c93816bb8b073438

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings
                                                                                                                                                  Filesize

                                                                                                                                                  24B

                                                                                                                                                  MD5

                                                                                                                                                  dd4a3bd8b9ff61628346391ea9987e1d

                                                                                                                                                  SHA1

                                                                                                                                                  474076c122cacaaf112469fc62976bb69187aa2b

                                                                                                                                                  SHA256

                                                                                                                                                  7c22c759ca704106556bbc4fc10b7f53404ca1f8b40f01038d3f7c4b8183f486

                                                                                                                                                  SHA512

                                                                                                                                                  fdaf3d9f8072ed7de9b2528376c10e3c3fdbea74347710a4795becf23c6577b3582b2e89d3c04ef0523c98fe0a46f2af3629490701a20b848c63ba7b26579491

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store
                                                                                                                                                  Filesize

                                                                                                                                                  10KB

                                                                                                                                                  MD5

                                                                                                                                                  b155e776dcbdca13b4899854c40ac218

                                                                                                                                                  SHA1

                                                                                                                                                  d2a57f2763b5b953b786831513b3564439495e0d

                                                                                                                                                  SHA256

                                                                                                                                                  18a5968369db2ab7445ccdbe58df9df1416be77aab0fa99d7ba0a797812a5aff

                                                                                                                                                  SHA512

                                                                                                                                                  c7fd9be314e38cab32d4e214c67a046652b6cf902cf65d84e4f1bda975efcdb076c9640dd90258eb5ecebf2b3281877a84b756cee7c8a28a0838835955dc74ef

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei
                                                                                                                                                  Filesize

                                                                                                                                                  23KB

                                                                                                                                                  MD5

                                                                                                                                                  c63b7499f61c1898163fc4f67e15e841

                                                                                                                                                  SHA1

                                                                                                                                                  16866b7ae9ee31dfef23075e14f8d7ab1c8fa36f

                                                                                                                                                  SHA256

                                                                                                                                                  74cb01e0b1117f40e598c095f8d05d8c0c93f07d4153d64003d6e1b1846844b9

                                                                                                                                                  SHA512

                                                                                                                                                  22ace4110a6e53f431a73c12e506f6cd558583b79c8fba4980b863ad7708491ab52b1cab1105739d027cdde9c1819a5ea575a0eeb0f1d50ed14d1a38581ada81

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storek
                                                                                                                                                  Filesize

                                                                                                                                                  264B

                                                                                                                                                  MD5

                                                                                                                                                  69e96c61c64026315f52d3b44d7f0de7

                                                                                                                                                  SHA1

                                                                                                                                                  8cb343e9b88d4587cefcc3cd91d81a368b8a0397

                                                                                                                                                  SHA256

                                                                                                                                                  0967c2e00db960cf58d6a0417400f2d080ff40f7fd87c656c10bdf3de25a1e38

                                                                                                                                                  SHA512

                                                                                                                                                  7e8aaf007b2332194f05aa5f263886dda559375dbcd006451aabafd7181b7ff8465a6aff0c6e6e36b4e95e6d7fbb8c7a63dee0cd9d6a405471bdea226ea67e6c

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav
                                                                                                                                                  Filesize

                                                                                                                                                  36B

                                                                                                                                                  MD5

                                                                                                                                                  5c6b932a79952b4b27833691305e61db

                                                                                                                                                  SHA1

                                                                                                                                                  09804db0986a989c2c49cdcea563567fb4c7b1a0

                                                                                                                                                  SHA256

                                                                                                                                                  dee5a5925227b125f4ac6d9b70a277e6ec8494ffc73d1cce9e08cc7a78d6208a

                                                                                                                                                  SHA512

                                                                                                                                                  4faa9585bb10156d5dea3b62d3a3a1bfa92430ba6e1e3381fc4c76c3071c85e53d5cbce0016dba1d1f9ea1b7af37b4a4efbaf4f3106b7d958b6e2e90aa0df059

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav
                                                                                                                                                  Filesize

                                                                                                                                                  54B

                                                                                                                                                  MD5

                                                                                                                                                  6a614a7743b0c781aaeca60448e861d6

                                                                                                                                                  SHA1

                                                                                                                                                  67b7df5ebeb4527e4c31f3f9b7e52a0581dc4b6d

                                                                                                                                                  SHA256

                                                                                                                                                  9703120dc62c2c3f843bad5b1e77594682ca7820f0345ae0bbd73021c1427146

                                                                                                                                                  SHA512

                                                                                                                                                  3a45b27ed6f3aaa8c2113fbb21637675cc91d1239754447a7032d1a86cb1e7381575b28f992e5ffc9986354c2b9c173c614f1f703ca4c2bee63ab3bc6ed909a6

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                  Filesize

                                                                                                                                                  2B

                                                                                                                                                  MD5

                                                                                                                                                  f3b25701fe362ec84616a93a45ce9998

                                                                                                                                                  SHA1

                                                                                                                                                  d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                                                                  SHA256

                                                                                                                                                  b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                                                                  SHA512

                                                                                                                                                  98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\discord\234418a2-49d6-4450-bcb1-024b2b97e916.tmp
                                                                                                                                                  Filesize

                                                                                                                                                  57B

                                                                                                                                                  MD5

                                                                                                                                                  58127c59cb9e1da127904c341d15372b

                                                                                                                                                  SHA1

                                                                                                                                                  62445484661d8036ce9788baeaba31d204e9a5fc

                                                                                                                                                  SHA256

                                                                                                                                                  be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

                                                                                                                                                  SHA512

                                                                                                                                                  8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\discord\DawnCache\data_0
                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                  MD5

                                                                                                                                                  cf89d16bb9107c631daabf0c0ee58efb

                                                                                                                                                  SHA1

                                                                                                                                                  3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                                                                                                                                  SHA256

                                                                                                                                                  d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                                                                                                                                  SHA512

                                                                                                                                                  8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\discord\DawnCache\data_2
                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                  MD5

                                                                                                                                                  0962291d6d367570bee5454721c17e11

                                                                                                                                                  SHA1

                                                                                                                                                  59d10a893ef321a706a9255176761366115bedcb

                                                                                                                                                  SHA256

                                                                                                                                                  ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                                                                                                                                  SHA512

                                                                                                                                                  f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_3
                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                  MD5

                                                                                                                                                  41876349cb12d6db992f1309f22df3f0

                                                                                                                                                  SHA1

                                                                                                                                                  5cf26b3420fc0302cd0a71e8d029739b8765be27

                                                                                                                                                  SHA256

                                                                                                                                                  e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                                                                                                                                  SHA512

                                                                                                                                                  e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\discord\Local State
                                                                                                                                                  Filesize

                                                                                                                                                  979B

                                                                                                                                                  MD5

                                                                                                                                                  6ce7775b29a40426e20703ea302bde2f

                                                                                                                                                  SHA1

                                                                                                                                                  433f94ab857ba49cfc4a18286a0e95ecf6db95e0

                                                                                                                                                  SHA256

                                                                                                                                                  8b88221e195843f391a2fa0bb4aaa6eeb49e1c0831815b3635738bdf611f2ac5

                                                                                                                                                  SHA512

                                                                                                                                                  0e746a196883f7f5e53656a5835e0c1fe2c0657f20d51ccb27f8d20d26278600b3d2150f888678bfe56be824d5237d3dfb46d2c669f0d2a473aa6e7c983db2ce

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\MANIFEST-000001
                                                                                                                                                  Filesize

                                                                                                                                                  41B

                                                                                                                                                  MD5

                                                                                                                                                  5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                                                  SHA1

                                                                                                                                                  d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                                                  SHA256

                                                                                                                                                  f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                                                  SHA512

                                                                                                                                                  de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\discord\MediaFoundationWidevineCdm\x64\1.0.2738.0\_metadata\verified_contents.json
                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  3e839ba4da1ffce29a543c5756a19bdf

                                                                                                                                                  SHA1

                                                                                                                                                  d8d84ac06c3ba27ccef221c6f188042b741d2b91

                                                                                                                                                  SHA256

                                                                                                                                                  43daa4139d3ed90f4b4635bd4d32346eb8e8528d0d5332052fcda8f7860db729

                                                                                                                                                  SHA512

                                                                                                                                                  19b085a9cfec4d6f1b87cc6bbeeb6578f9cba014704d05c9114cfb0a33b2e7729ac67499048cb33823c884517cbbdc24aa0748a9bb65e9c67714e6116365f1ab

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\discord\MediaFoundationWidevineCdm\x64\1.0.2738.0\manifest.fingerprint
                                                                                                                                                  Filesize

                                                                                                                                                  66B

                                                                                                                                                  MD5

                                                                                                                                                  d30a5bbc00f7334eede0795d147b2e80

                                                                                                                                                  SHA1

                                                                                                                                                  78f3a6995856854cad0c524884f74e182f9c3c57

                                                                                                                                                  SHA256

                                                                                                                                                  a08c1bc41de319392676c7389048d8b1c7424c4b74d2f6466bcf5732b8d86642

                                                                                                                                                  SHA512

                                                                                                                                                  dacf60e959c10a3499d55dc594454858343bf6a309f22d73bdee86b676d8d0ced10e86ac95ecd78e745e8805237121a25830301680bd12bfc7122a82a885ff4b

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\discord\Network\Network Persistent State
                                                                                                                                                  Filesize

                                                                                                                                                  313B

                                                                                                                                                  MD5

                                                                                                                                                  e33aa16ed630e8cd48696d4328a4f070

                                                                                                                                                  SHA1

                                                                                                                                                  641d7807a60d6526aa22317e7cd2c2b7d0db6e1c

                                                                                                                                                  SHA256

                                                                                                                                                  671a03907f1de2a7967cdcc87a0ae433ce340eca08b89bd02fb826da4ede7b07

                                                                                                                                                  SHA512

                                                                                                                                                  93e31c8da21e575c8d24017d41cf025bdcc47d97a75c4bf9d349ee3c971929add6802cd8c50358b4572cf87bbbb01791e453dd3296f7988703bb1b9f1a538536

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\discord\Network\Network Persistent State
                                                                                                                                                  Filesize

                                                                                                                                                  592B

                                                                                                                                                  MD5

                                                                                                                                                  0b00b7fb7e59b8736257197634ba65b1

                                                                                                                                                  SHA1

                                                                                                                                                  8ca13fca7762cb51e11e5c7b14369b91a2d2e8f7

                                                                                                                                                  SHA256

                                                                                                                                                  9ca3eff651a3b868ed358903301d6e74e0129a60e1162136f4d9b97528ffab6b

                                                                                                                                                  SHA512

                                                                                                                                                  cb22b3b14530cab2590a490d19ec8e291d315737ef9f356a03dbb1037dedce8623cf8cfdcb3a250319758f5d5d8aee7229b8dd43248636e9a687bc5b42f2ed0f

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\discord\Network\TransportSecurity
                                                                                                                                                  Filesize

                                                                                                                                                  355B

                                                                                                                                                  MD5

                                                                                                                                                  b2ebccbeccae0ea37c2d80f01f9f5227

                                                                                                                                                  SHA1

                                                                                                                                                  9c49cfd1af43bd3d3d5f3b1c1feaf242feb1b626

                                                                                                                                                  SHA256

                                                                                                                                                  7723076f1ed0dd934d628b70b9cb6764603f708c7cf3a0400bd04e8a3240016e

                                                                                                                                                  SHA512

                                                                                                                                                  35523c73cc4483f5d7d1d6478d26450545e0e0e739c9238fed9b576d02a1b860cc0c1aef22a7f7664e0773d719b3525415e73ebdf9089d355df7a2c1bb195f7a

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\discord\component_crx_cache\neifaoindggfcjicffkgpmnlppeffabd_1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed
                                                                                                                                                  Filesize

                                                                                                                                                  1.1MB

                                                                                                                                                  MD5

                                                                                                                                                  f265d47475ffd3884329d92deefae504

                                                                                                                                                  SHA1

                                                                                                                                                  98c74386481f171b09cb9490281688392eefbfdd

                                                                                                                                                  SHA256

                                                                                                                                                  c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed

                                                                                                                                                  SHA512

                                                                                                                                                  4fd27594c459fb1cd94a857be10f7d1d6216dbf202cd43e8a3fa395a268c72fc5f5c456c9cb314f2220d766af741db469c8bb106acbed419149a44a3b87619f1

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\discord\component_crx_cache\oimompecagnajdejgnnjijobebaeigek_1.d9a253514b6a010dfc1916c55246797e5773f13844ea3ec2d25078e845fef760
                                                                                                                                                  Filesize

                                                                                                                                                  13.7MB

                                                                                                                                                  MD5

                                                                                                                                                  17c227679ab0ed29eae2192843b1802f

                                                                                                                                                  SHA1

                                                                                                                                                  cc78820a5be29fd58da8ef97f756b5331db3c13e

                                                                                                                                                  SHA256

                                                                                                                                                  d9a253514b6a010dfc1916c55246797e5773f13844ea3ec2d25078e845fef760

                                                                                                                                                  SHA512

                                                                                                                                                  7e33288afd65948a5752323441c42fcc437d7c12d1eaf7a9b6ae1995784d0771e15637f23cc6bc958e40ea870414543d67a27b4c20331fde93d5b6dc6a59cbaf

                                                                                                                                                  Download Submit

                                                                                                                                                • C:\Users\Admin\Downloads\Unconfirmed 295261.crdownload
                                                                                                                                                  Filesize

                                                                                                                                                  263KB

                                                                                                                                                  MD5

                                                                                                                                                  b142769ef44dbaec7aeb63a0d1d9a503

                                                                                                                                                  SHA1

                                                                                                                                                  afc6d35ba61a376742e07c6c26d0d098fa51cce1

                                                                                                                                                  SHA256

                                                                                                                                                  c80856f65c05cec494f795bdf10c56acaf806c457d9851b22ae78f50c1802b01

                                                                                                                                                  SHA512

                                                                                                                                                  0b0178b59b7b8f260d2d0fda8b636741b58640a454147fb8e9809bd6493813072db12ec3c61cefddf80c2d8aae002d83cf25ef4130b3e48d08f759ddd3bebd52

                                                                                                                                                  Download Submit

                                                                                                                                                • memory/2380-58-0x000002855F5A0000-0x000002855F5B0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2380-12-0x000002855DAA0000-0x000002855DAA1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2380-14-0x000002855F590000-0x000002855F5A0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2380-16-0x000002855F5A0000-0x000002855F5B0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2380-18-0x000002855F5B0000-0x000002855F5C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2380-22-0x000002855F5C0000-0x000002855F5D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2380-48-0x000002855F320000-0x000002855F590000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.4MB

                                                                                                                                                  Download

                                                                                                                                                • memory/2380-51-0x000002855F590000-0x000002855F5A0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2380-67-0x000002855F5B0000-0x000002855F5C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2380-69-0x000002855F5C0000-0x000002855F5D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/2380-2-0x000002855F320000-0x000002855F590000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.4MB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-120-0x0000021B01B30000-0x0000021B01B40000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-235-0x0000021B037B0000-0x0000021B037C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-238-0x0000021B01AD0000-0x0000021B01AD1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-249-0x0000021B01AD0000-0x0000021B01AD1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-236-0x0000021B03860000-0x0000021B03870000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-222-0x0000021B037A0000-0x0000021B037B0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-223-0x0000021B03850000-0x0000021B03860000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-221-0x0000021B03790000-0x0000021B037A0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-314-0x0000021B03880000-0x0000021B03890000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-313-0x0000021B037C0000-0x0000021B037D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-500-0x0000021B037D0000-0x0000021B037E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-215-0x0000021B03780000-0x0000021B03790000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-216-0x0000021B03840000-0x0000021B03850000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-526-0x0000021B037E0000-0x0000021B037F0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-527-0x0000021B037F0000-0x0000021B03800000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-532-0x0000021B03800000-0x0000021B03810000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-210-0x0000021B03750000-0x0000021B03760000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-211-0x0000021B03760000-0x0000021B03770000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-547-0x0000021B03810000-0x0000021B03820000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-548-0x0000021B03820000-0x0000021B03830000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-212-0x0000021B03770000-0x0000021B03780000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-573-0x0000021B03830000-0x0000021B03840000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-213-0x0000021B03830000-0x0000021B03840000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-205-0x0000021B03740000-0x0000021B03750000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-206-0x0000021B03820000-0x0000021B03830000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-203-0x0000021B03810000-0x0000021B03820000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-202-0x0000021B03730000-0x0000021B03740000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-199-0x0000021B03720000-0x0000021B03730000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-200-0x0000021B03800000-0x0000021B03810000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-195-0x0000021B03710000-0x0000021B03720000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-196-0x0000021B037E0000-0x0000021B037F0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-197-0x0000021B037F0000-0x0000021B03800000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-192-0x0000021B03700000-0x0000021B03710000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-193-0x0000021B037D0000-0x0000021B037E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-188-0x0000021B036F0000-0x0000021B03700000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-189-0x0000021B037C0000-0x0000021B037D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-186-0x0000021B037B0000-0x0000021B037C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-185-0x0000021B036E0000-0x0000021B036F0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-182-0x0000021B036D0000-0x0000021B036E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-183-0x0000021B03790000-0x0000021B037A0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-184-0x0000021B037A0000-0x0000021B037B0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-181-0x0000021B036C0000-0x0000021B036D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-173-0x0000021B03750000-0x0000021B03760000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-179-0x0000021B03780000-0x0000021B03790000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-178-0x0000021B036B0000-0x0000021B036C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-174-0x0000021B03760000-0x0000021B03770000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-175-0x0000021B03770000-0x0000021B03780000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-172-0x0000021B036A0000-0x0000021B036B0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-167-0x0000021B01AD0000-0x0000021B01AD1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-165-0x0000021B03690000-0x0000021B036A0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-166-0x0000021B03740000-0x0000021B03750000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-158-0x0000021B03680000-0x0000021B03690000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-159-0x0000021B03730000-0x0000021B03740000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-155-0x0000021B01AD0000-0x0000021B01AD1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-152-0x0000021B01AD0000-0x0000021B01AD1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-151-0x0000021B01AD0000-0x0000021B01AD1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-150-0x0000021B01AD0000-0x0000021B01AD1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-145-0x0000021B03670000-0x0000021B03680000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-146-0x0000021B03720000-0x0000021B03730000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-142-0x0000021B03660000-0x0000021B03670000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-143-0x0000021B03710000-0x0000021B03720000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-136-0x0000021B03650000-0x0000021B03660000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-137-0x0000021B03700000-0x0000021B03710000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-134-0x0000021B01AD0000-0x0000021B01AD1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-121-0x0000021B036F0000-0x0000021B03700000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-118-0x0000021B01AD0000-0x0000021B01AD1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-116-0x0000021B03640000-0x0000021B03650000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-117-0x0000021B036E0000-0x0000021B036F0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-112-0x0000021B03630000-0x0000021B03640000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-113-0x0000021B036C0000-0x0000021B036D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-114-0x0000021B036D0000-0x0000021B036E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-103-0x0000021B03620000-0x0000021B03630000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-104-0x0000021B036B0000-0x0000021B036C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-100-0x0000021B03610000-0x0000021B03620000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-101-0x0000021B036A0000-0x0000021B036B0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-96-0x0000021B03600000-0x0000021B03610000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-97-0x0000021B03690000-0x0000021B036A0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-89-0x0000021B01AD0000-0x0000021B01AD1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-90-0x0000021B03680000-0x0000021B03690000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-88-0x0000021B035F0000-0x0000021B03600000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-83-0x0000021B01AD0000-0x0000021B01AD1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-82-0x0000021B03670000-0x0000021B03680000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-81-0x0000021B035E0000-0x0000021B035F0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-78-0x0000021B035D0000-0x0000021B035E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-79-0x0000021B03660000-0x0000021B03670000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-75-0x0000021B03360000-0x0000021B035D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.4MB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-76-0x0000021B03650000-0x0000021B03660000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-70-0x0000021B01B30000-0x0000021B01B40000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-68-0x0000021B03640000-0x0000021B03650000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-59-0x0000021B03630000-0x0000021B03640000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-52-0x0000021B03620000-0x0000021B03630000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-49-0x0000021B03610000-0x0000021B03620000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-45-0x0000021B03600000-0x0000021B03610000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-42-0x0000021B035F0000-0x0000021B03600000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-40-0x0000021B035E0000-0x0000021B035F0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-39-0x0000021B035D0000-0x0000021B035E0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-36-0x0000021B01AD0000-0x0000021B01AD1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                  Download

                                                                                                                                                • memory/4344-27-0x0000021B03360000-0x0000021B035D0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  2.4MB

                                                                                                                                                  Download