hxxps://drive[.]usercontent[.]google[.]com/download?id=1N155TyI1abHZwosbZHeBnhxA3rKWQqV5&export=download&authuser=0&confirm=t&uuid=685ee958-55e5-4933-84fc-d6e6567bb320&at=AN_67v3W-eWR4k52JaI_x7ijiuZw%3A1729701152356

Analysis

max time kernel
300s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
23-10-2024 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.usercontent.google.com/download?id=1N155TyI1abHZwosbZHeBnhxA3rKWQqV5&export=download&authuser=0&confirm=t&uuid=685ee958-55e5-4933-84fc-d6e6567bb320&at=AN_67v3W-eWR4k52JaI_x7ijiuZw%3A1729701152356

Score

6^/10

discovery execution

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

30 discord.com
31 discord.com

flow	ioc
30	discord.com
31	discord.com

Enumerates processes with tasklist 1 TTPs 12 IoCs

discovery

Process Discovery

T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid	process
5692	tasklist.exe
10056	tasklist.exe
9024	tasklist.exe
9960	tasklist.exe
1924	tasklist.exe
5320	tasklist.exe
1264	tasklist.exe
5388	tasklist.exe
4000	tasklist.exe
9100	tasklist.exe
7112	tasklist.exe
8984	tasklist.exe

Drops file in Windows directory 1 IoCs

Processes:

chrome.exe

description ioc process

File opened for modification C:\Windows\SystemTemp chrome.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

4396 powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

pid	process
4396	powershell.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

CrosshairX.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CrosshairX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CrosshairX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CrosshairX.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	CrosshairX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	CrosshairX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	CrosshairX.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	CrosshairX.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133741748124917943"	chrome.exe

Modifies registry class 8 IoCs

Processes:

CrosshairX.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\crosshair-x	CrosshairX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\crosshair-x\URL Protocol	CrosshairX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\crosshair-x\ = "URL:crosshair-x"	CrosshairX.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\crosshair-x\shell\open\command	CrosshairX.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\crosshair-x\shell	CrosshairX.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\crosshair-x\shell\open	CrosshairX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\crosshair-x\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\Crosshair.X.v2024.02.09\\CrosshairX.exe\" \"%1\""	CrosshairX.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

Processes:

chrome.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\CROSSHAIR X (Cazotty) (2).zip:Zone.Identifier chrome.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\CROSSHAIR X (Cazotty) (2).zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

chrome.exepowershell.exechrome.exeCrosshairX.exe

pid	process
3088	chrome.exe
3088	chrome.exe
4396	powershell.exe
4396	powershell.exe
4396	powershell.exe
4396	powershell.exe
7632	chrome.exe
7632	chrome.exe
7632	chrome.exe
7632	chrome.exe
5908	CrosshairX.exe
5908	CrosshairX.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

3088 chrome.exe
3088 chrome.exe
3088 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe
Token: SeShutdownPrivilege	3088	chrome.exe
Token: SeCreatePagefilePrivilege	3088	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe

Suspicious use of SendNotifyMessage 22 IoCs

Processes:

chrome.exeCrosshairX.exe

pid	process
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
3088	chrome.exe
1028	CrosshairX.exe
1028	CrosshairX.exe
1028	CrosshairX.exe
1028	CrosshairX.exe
1028	CrosshairX.exe
1028	CrosshairX.exe
1028	CrosshairX.exe
1028	CrosshairX.exe
1028	CrosshairX.exe
1028	CrosshairX.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

CrosshairX.exe

pid process

1028 CrosshairX.exe
1028 CrosshairX.exe

pid	process
1028	CrosshairX.exe
1028	CrosshairX.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3088 wrote to memory of 3908	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 3908	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 4880	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2248	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2248	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe
PID 3088 wrote to memory of 2200	3088	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.usercontent.google.com/download?id=1N155TyI1abHZwosbZHeBnhxA3rKWQqV5&export=download&authuser=0&confirm=t&uuid=685ee958-55e5-4933-84fc-d6e6567bb320&at=AN_67v3W-eWR4k52JaI_x7ijiuZw%3A1729701152356
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc06edcc40,0x7ffc06edcc4c,0x7ffc06edcc58
2⤵
PID:3908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1732,i,834790570550580104,17698368615831421281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1740 /prefetch:2
2⤵
PID:4880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2076,i,834790570550580104,17698368615831421281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2092 /prefetch:3
2⤵
PID:2248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2160,i,834790570550580104,17698368615831421281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2496 /prefetch:8
2⤵
PID:2200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3048,i,834790570550580104,17698368615831421281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3068 /prefetch:1
2⤵
PID:3336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,834790570550580104,17698368615831421281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3228 /prefetch:1
2⤵
PID:1476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4676,i,834790570550580104,17698368615831421281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4688 /prefetch:8
2⤵
PID:2024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4416,i,834790570550580104,17698368615831421281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5000 /prefetch:1
2⤵
PID:4112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3032,i,834790570550580104,17698368615831421281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5164 /prefetch:8
2⤵
- NTFS ADS
PID:2540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5368,i,834790570550580104,17698368615831421281,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4472 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:7632

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3572

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:888

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
"C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1028

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\CrosshairX /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\CrosshairX\Crashpad --url=https://f.a.k/e --annotation=_productName=CrosshairX --annotation=_version=8.1.7 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=21.4.4 --initial-client-data=0x530,0x538,0x53c,0x50c,0x540,0x7ff79bec06e0,0x7ff79bec06f0,0x7ff79bec0700
2⤵
PID:712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Cryptography" /v MachineGuid"
2⤵
PID:4412

C:\Windows\system32\reg.exe
C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Cryptography" /v MachineGuid
3⤵
PID:4788

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
"C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\CrosshairX" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 --field-trial-handle=1952,i,1398723734410034004,16948714218535048153,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
2⤵
PID:1104

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
"C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\CrosshairX" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2152 --field-trial-handle=1952,i,1398723734410034004,16948714218535048153,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
2⤵
PID:2872

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
"C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CrosshairX" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2780 --field-trial-handle=1952,i,1398723734410034004,16948714218535048153,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
2⤵
PID:1036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -Command "[System.Diagnostics.Process]::GetCurrentProcess().SessionId""
2⤵
PID:4700

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -Command "[System.Diagnostics.Process]::GetCurrentProcess().SessionId"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4396

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
"C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CrosshairX" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1952,i,1398723734410034004,16948714218535048153,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
2⤵
PID:328

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
"C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CrosshairX" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1952,i,1398723734410034004,16948714218535048153,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
2⤵
PID:3080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:1572

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:4000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:9904

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:9960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:8324

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:1924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:8260

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:5320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:3060

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:9100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:680

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:1264

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
"C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\CrosshairX" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3600 --field-trial-handle=1952,i,1398723734410034004,16948714218535048153,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:6244

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:5692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:7572

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:7112

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
"C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CrosshairX" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4340 --field-trial-handle=1952,i,1398723734410034004,16948714218535048153,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
2⤵
PID:7248

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
"C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CrosshairX" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4200 --field-trial-handle=1952,i,1398723734410034004,16948714218535048153,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
2⤵
PID:7280

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
"C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CrosshairX" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3932 --field-trial-handle=1952,i,1398723734410034004,16948714218535048153,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
2⤵
PID:7304

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
"C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CrosshairX" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4320 --field-trial-handle=1952,i,1398723734410034004,16948714218535048153,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
2⤵
PID:7320

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
"C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CrosshairX" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3940 --field-trial-handle=1952,i,1398723734410034004,16948714218535048153,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
2⤵
PID:7328

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
"C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CrosshairX" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3692 --field-trial-handle=1952,i,1398723734410034004,16948714218535048153,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
2⤵
PID:7896

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
"C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CrosshairX" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4316 --field-trial-handle=1952,i,1398723734410034004,16948714218535048153,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
2⤵
PID:7876

C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe
"C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\CrosshairX.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CrosshairX" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\Desktop\Crosshair.X.v2024.02.09\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4556 --field-trial-handle=1952,i,1398723734410034004,16948714218535048153,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
2⤵
PID:7340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:7256

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:8984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:5508

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:10056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:10564

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:5388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /d /s /c "tasklist"
2⤵
PID:5480

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
PID:9024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
b18f7b09e04a956d11a83770ef2ebd18

SHA1
4a2098c23d826760624498462187daa025995ce3

SHA256
12625d493ddd1ceb26897c5d2562b87ac767c517d9b8a30a341c2e8bb5989e59

SHA512
cfb46f73ba4f65a9059155d891e0effe6cad3eaf2de1480d0cca9e262142e599bf2189d613b6ac865c8f0f62c127dfa679de258a5b6df98f1536c09976faa75b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
eca6b8b3e95b6fd383ed7c1b5491a6a0

SHA1
7c153c2fa9f0713f7d8f14f3c48f06477a45287e

SHA256
88593d04d7fd6b2e2a12662afb451b5ddc1dc123d275be432b9817aa202f9249

SHA512
88d7958443b3b009b970bcfc8a7411b3c2a2947f7cbe38d59e4f688e915f938a487dae23b4750152b0b6c86ffa1401e878dcf5814415d7a9010496b922596324

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
95d48d8fc452c562204c4a1722b25cf4

SHA1
921ea7f28202eecdd97b6ac076ce5faa1ed19c97

SHA256
a2acc51711c078b104cba660778e318df0eaf3c9d73c48b8cbb6249da7e1feb0

SHA512
a6ee2793bc375556315ea716149775b1202bdef43320e99cec0c6af2d599236cb8606ff3e03b03a9ead05e3481e378aca75b3f2f10f70c0fbb46bd9bd47d495b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
72990629a70d7bd8f79dcba809d2933d

SHA1
119718ce85218c05cc5af9677bf3539bc7395841

SHA256
ec130ec92f104a6b64c7d4b167deacebc98779ea22f0e157415551eef20b4f30

SHA512
0c78ee55c6ba79bb6c4edcbcbdb2d7e1a606634d3621b7ee22c42177884091034961374a4c7c73432a10cae40502a195bb1037ec9ff1bec68c33739d6096e99b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9c0d972ff259caa9ade277ae147f8606

SHA1
a7097f677b99bd48ab6d7e9a471243bf1bf38964

SHA256
c2cd54b4949d529b3ee8da56b4ab14e5199f184d29bb789c883c851462b8606f

SHA512
2ee065d7961d038ca5de01d1cb2b2963129be3ac839f043fcbcb4d428d4047e216ee8f2c458613549d9a2db98252af7685cb29d6d449f89ebe3fad4b1b48c57f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
13a6f4a86ad8869094953174eda5bf5d

SHA1
13844695925eb3a8de33c03bfbb5156cacfded02

SHA256
007f18b911202ff7004769de5c7f448e3d600a7444e52531ac6b59abda00fe7c

SHA512
da5f42397eba46a7b28c566627029676ed80ace80fb2236984308054aaf36a8dbb6c4987f38fdbdb1eec89186743788ac1fdbeead6aa305afe80ef65e7ba8528

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6f3c14faea5e1d8f39077b158a5c55e7

SHA1
9e5741f42d09c3a52ee265e566d1537c318569f3

SHA256
ebbffbe293e384b4dad70360de7af1a165b5d25977be4fa4187085134024aa04

SHA512
b8820dfe85bc5c9e607973c8b6ac706d6a881958c998334d124ca6d63df95b47a413649ca13342001663c1e0e512b675db23b56438bd1823590486a7e62ed950

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2665edbe69a4e9291ec1333837287379

SHA1
ad3ce65c734b9ca9b2b11ba5c9783fdefee25f3b

SHA256
13fdb6644b6e934af565ce0a88948d2fcbd8ec5e99ba86ba1e9bf8559c691fed

SHA512
3d78651afc31f037d039f8f1527399e52ad4c77e1f567e6166d73e698e8bb22b7b9db24f6bc8c835ce31e4884f0050090f36f1826d02d6446ec8b28c42cf4ba6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6ccaf12d249b1b856c222d667bf9b786

SHA1
7621a4c0d27367ca25c21022a29ff9c5b79358f7

SHA256
df0f0bfbceeb23b67942bd7dcd1d99895da1540d0281e5b64010ebe22938d0f1

SHA512
16f0478ed367f2991c792aa39792bdfe3c4fd0e3a89e7b37977b60ca735ee9ffa2534a43b04d9899adb836d243d6e36c6cf7116a314fe483dffcbb299fc50b0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2869534746a7f524ecfaa4e07e8589d5

SHA1
f3870560c033afb52382e834784717a7acf18eef

SHA256
77776f8ce2da16efdeb088204e4b8387eef7b43a421dbd3c0476efefb02f7ae6

SHA512
7334ad404acd26820d6ff529dee374afeed5e80a39744b87bb82fb2c9e0ddc2e2b66f6fa1b12d44737101264d23a6feedf0d756670e88e12bc7430e679b9abaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4c27a7c2f83de8b6ffcc7828cc03e8cc

SHA1
1687b6cf00419c9af67ff85fb87e8d5ce261c2e9

SHA256
6b3ae7327c28527ff7e32bfaa4dfdcaba65c9f40de8a6fb8ccb424260959f3dc

SHA512
e7285286535696eba53bf8d13a680699912dcb21063e986776b424db4fa4441ada6a69962a4fe20d8d05643dced8492d77b4c8c00da9e9ad71ccceb534367c91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7882e3f46de14de5e4b8c2709138c3c6

SHA1
ac00ee83a2d128695dee3eeb437a6b5a2f037dea

SHA256
ac74a164af258b68f595a94d9a840e1f90414967024c87cdd324356df3ee11b8

SHA512
329481663cb9cd70c7a50466835b0c7cb99776b9a71e9661a027a0d261e6d2e7dae30de120ccdfe98298fd0bab8bdc0a4ad3afd61e1a1ae306e1968862f16263

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a44cf8a817a9e4785ccfd95745d91593

SHA1
898f0f1157aaabb169b3e5fe0bf5cf696dbbefbd

SHA256
9317c3002de1b6320412eda45be55381a1c72a6c8ff5ea5ae073ee24d33de5f3

SHA512
d4ef0b07373718c8d5259e708a0080bb8b37cc8674540f4c9b451eafdb3a5eb301accbbb879a179f5e998a777442d5821165b048bd3d16f2007cdb3b854c9393

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c073da01d4396375c341861724749cd1

SHA1
b442f0a1093a9af2eb4818a9a629814ac4d0d8bc

SHA256
589847ac2181f1c5545c31151cc25051e3a09ea6a9f95f821073c0d5748867bb

SHA512
591f2804fa5eba15a7c9b12a0b99c320780fd0e867d09250ba859a998c42038684cf6f74341a6734fb27cf54f06ca99405fdb637bddc77bfa0b2f30034b86019

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
aa8f9b1538dcad33faac7b96db5d9f30

SHA1
0517edbad0f8b0df73f1c1a205df0741a1572264

SHA256
f68a17615fb7069a10a36d928002df332886e0234ea3ee60fe97c6af5ea89a9d

SHA512
eeac464e197907257440d35078a46675664808bda67642d52d33d05914cb2c5f507c63764d177bee4f37da5f949be40ade76858fcf982e8a7d2b9c8f323f667c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b7656fb1e18cd3c083238deb4f14a9ba

SHA1
06df71936c83608c567d666ad8684456aa7ae1c4

SHA256
78b670152b55abfcc710dc20a505697f2d611fb856ac154b89fec648b1f35ca8

SHA512
0d1b4f29cbec804b1abb4f3942b8e88b6f7f9c90a0da9eb08b3c8eb9d619799a5d75273d205e6ef544ac943ef25508c436a9b7e2b0bd5a88d2e27579583747e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
58d60ef328c9751f34a3ca365c166907

SHA1
9996a203a5485a5eed25ecaecdd1ab029b750a8a

SHA256
175dbf9107db29278626cbc580851dd0386ed4eab1298c36fa0fe840c3ae2fb9

SHA512
5529882fc7763f31bf101cb92a9a4bf94aafa6480911b5463cd2937cd7f5407ba5baf58842b10ee1ffc422b981b8d4f28bd97cbb423993eeb0ad7ee073c33e3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
20c26189ba9ba93b5a4c8d555e0b851e

SHA1
9f2f03721945aab2cdcc50765e77f99fc70924b8

SHA256
56e631f5fd702ab6545a5d5722e0990df56fc9ce93ecfb900306c7bcbdfcb0ba

SHA512
43dee0f19b81123fd562954c70c9482d5f3abfe17c44bcf993c3ebfe3f10ebda5eea8259de93826c4f737150bb36b1fc04a499f741b8b4fc7ddd4370f9389d0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
5e271a359bb3644abb2fafa62d8ed208

SHA1
c8fc5b477ac9e1b1d6a6edc90020bc3617b20a12

SHA256
6afd5a3e2f357af89a9702195df6592e6c8f5295c8c399be203a7cc1a9c6589a

SHA512
dc31ab4aef0196c7af27abcdbf37c6b8aeaf368e1b0cb34da5ec58bf50133cabd11beb06ee8fd6b17d0b008bb261ebabdf728e5217981bb142cf112457d5dccf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
02626ded5c8cf6b1a95795f455f2e63d

SHA1
77bdf475759867bd8451ad2537377a72b071e523

SHA256
09f9fc6187addd04d781698ade4d2a49cabb41c0336e4e466cabfbd9e2f1d80e

SHA512
8962d573f699caf41a0f77ed8745711acb03058f18f30e248855743cc1433a780dc214a25fd69f8b7aa73e61d340700d19eb1f80a865b1d94385c920a3e5e85f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ed97a8f535c029f3247ff7631558191c

SHA1
5816e95be0b10f9908e3faeda46451bc3e4a8224

SHA256
dd1dbed9bc7589c662b0f67dcb0b13dacbb3431ff901e554e2c212d13e70c3c5

SHA512
1e584734148c36b5acf1144c2f47d3978c5e2c1d6d8689ebbd41c156dab0ab86227430224d062328196c1b434f5e3e4c7d92699a4c0c1bd60609277c93e6a8bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4ad2060e05edaddc2ddb1035cefba8b0

SHA1
604bbb77ef302fa43e3613aca1d61d93ac512b38

SHA256
c0c3de5f6dad7913dd0e614ef08df3468d54ef86b59291649cf024801b7bd4ae

SHA512
5b96a610c285748e2622efb34363a65468bc04f4f9bbec2cbb849aab84fdf418818bbafa5fede104ecad744b8db2e5b06fa5002cca87b8a9ad89e7c84fbcf2b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
90351c1adc6aa165af5068e82f8737e1

SHA1
67066acf3ad8f3f6516bf444d2df80ddb02684ca

SHA256
be74f3c504028c4b7d595e0249211dac6266295274f61a5f27c66f1458a520f9

SHA512
b1d5c65bc449aa4d663766e451bbf8996bc740acccafa8dfca552f916fd782260809ba1a0c8589d659ae58fc3fb7de9829db202fa2fad27fa5e51668b939cdb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
0b31b24447537396a4e6d10f1e7ad529

SHA1
c4c249c43c576d01fc22eb146b16e9f0e8fd2c82

SHA256
94d34e5f8a5669c9ac6f9c9bbc1aa50690287eb9562a999ec343d40540bdc919

SHA512
0ed5ebf87004357cba113b92ba6c0d7a0a7174c9009542498a9dbf0b6c562e6732abe15ca70fe7f79216761a46f8ff38c7ffeb3140340d2b72cf3ebf707c65d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
798d1497b4330e63de947c7ae739c4ba

SHA1
1e1bfbc2ce4fadd4f318663fdf2c7f63744826ef

SHA256
3fc4e55170154a7b8421df4eef0cb62088e6ffb7fa367e70fcbba7ff58c72030

SHA512
cfcc668df1cc1d54ed57259319430fbd37ecd1b6c8904198e38555229d7ca4e9263c0465b7a3eaf58ecb388002a3eff8ba91481067c72466c18e82227a495017

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jz2lp3e2.l5y.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\Code Cache\js\index-dir\temp-index

Filesize
144B

MD5
b31dce65cf79f00c4e67d777162428a0

SHA1
b6bbb4fe22e5c9efe8faffe6302dfb8aff7d8e12

SHA256
48c299fb548a02b96db2175ae528e3186c307f734c9841e1c8d453987634785a

SHA512
22510290df5cd888455178f1eabed9fb596e23b0f4e6d62586bc3ba90666132b70355314100ff824f770b41ab5bfb5b65866dceedc575144a0437c5c0b3a150d

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
59cb79439d669b716578c694c586ca58

SHA1
4ca5e79d7e10d2562fd3b7484062e90010a3802d

SHA256
44423f1cb9ec20362fe9a009ed05cedd0cfa0564d66c288fef50ff6f157e36e5

SHA512
8531eb9c7bbe94dbb818e55c313d9bf0ecf30783269b6941848664f72703c167a87115ca7f0541ba0547086b718deb8abecce9fc061789177e37d0c7dcad0661

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\Network\Network Persistent State

Filesize
2KB

MD5
180bdf0fd9616206ecbae111dea4872d

SHA1
a7b0e9f2b42625e635c6f8053d5bad7ce428f21f

SHA256
38d9f4d42984573b8dd5ab5b4f85f887f216db39df9c6a8ccc64858127d86697

SHA512
4c274cfdb1af339be9e81de7ab70342f19232258b34da2665cdbbb5c70ec871ee4ad5d7223e6dbc30acdd36d03ec5c5f5e881fb46a0f26e2279895cf99379d45

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\Network\Network Persistent State

Filesize
1KB

MD5
20acb98ba27d8f44e0c8888e8fecaece

SHA1
b72451452c81e26be0f5d75b9479d0ec0c602f12

SHA256
f5093fa954f9472645ea50e29667efc2f650d108d70ceef37e190af297b63ac5

SHA512
928319a44d9fd76e49f571e1c25db71c6f728f97a5545f9e71d698d379c0939c11ab852c7ec99914d0841bbc7329815d5b2835ac5c3b6f993cfca3a921025079

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\Network\Network Persistent State

Filesize
1KB

MD5
776409d56c79fd875b45fab0eac7f86d

SHA1
f8e2f04d845d6efc215efd8ee37b08d59244dec3

SHA256
1bf0ca32bc44f5d3e3c759297677f889b6199dabe3ed07f471a7235211bbc4d9

SHA512
ef59269a969789d2f4b4b415394ab3c7ce51372f9e175f9d1dfc55572a97b0e929ca263efffdef8947886e18492691ba9cccd3cc94f1c249f93050f619504f34

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\Network\Network Persistent State~RFe5996d7.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\Network\TransportSecurity

Filesize
538B

MD5
6b98c058797223698b8cb7d298fa74f9

SHA1
86e655f2c58bee96edecd760311388f594639089

SHA256
6e201dca3d398dbc70cbf9d21150e108747edf24dc82021b6c7863342a5dec30

SHA512
f1963644296d096fa7c2757ad0c7aa2494b38e6add39b7485d5d76ca2c0990230324d1cf0cd5f52508dfd16e1d291c41321e00f47076b4c04c781440b029d0e0

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\Network\TransportSecurity

Filesize
872B

MD5
101d486a08e6808141a06aa93fa329ff

SHA1
31a1e52738b17839ec29492316028d4f648b56db

SHA256
c276fc65fc6d6386e4ed868e17f79c8dd12ddd00af2f0cf85c59a6f99ae60da1

SHA512
570756c877a01f4ee904de20ebda75340178fe013285c8e7248234e35dacafe31a9f35d78e866cf997ee7ba19ec5d345887e9922dc021d070b063a45e2dd6c24

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\Network\TransportSecurity~RFe59300f.TMP

Filesize
371B

MD5
2ced9363c9288f87b77c8fcb9a716cac

SHA1
c49167ddee3c1d973c850b0fa182a68fa3b1baac

SHA256
8726a26d3ef8db72f6d2e55c1b2d9ce340665fa06167f1e1ff11e34601503a3b

SHA512
b079e8a7682ebfe94285b2e786b5cc19de339c8c886473742bf44e6a3ec3779ea9c6c76a82810b16848cac512cfc5400c02cd21ce8b44f1229247bc23201eeb1

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
2KB

MD5
4479cfee292c2b7db6dcf692b3b99f0a

SHA1
e31230f8d01042293a3bcf851da717704d367038

SHA256
7ef951888bd7f521269b0a616f545616c491abfd4e6a9f461cfdcd0a430bdee9

SHA512
6c65145d5430bfedcebbf4397cffc8bd66398eeedab4def8a98c39bc834ce3ab6fc99aeef4c25ac66d006015d182aa133f5a420d2f96ad5e70250aaf506ef1d7

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
2KB

MD5
d02f330c93c8ff7845228521e91e3f33

SHA1
83fb367f991d6d55661d0d85b134691dee454a4e

SHA256
daa80ff185b7da04e20fb58bba090ce3df670ce5ba595ace460f5b7affe29a0c

SHA512
b2a31be91b5473e7de517e4e0648d9ca9825944d8770648163fe41f80dda38cb7902c193f49051a2928b0fb88ba6a89daee7dcd4d0838d1d6d2ff024383d23e8

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
2KB

MD5
a7d1a911b49988da6a424c448fd36e9e

SHA1
e52a2a2a092e27a7ef2b6ae9188ead80d20595e3

SHA256
0726e3aa88b2358aa4391efe41b75c97ce1fbc5379039b30adf8ae56cd1fb509

SHA512
313e9cab1ec2cc0753e15140c3f02526f31efb35aed9139f772a461ffd4ab3a9df08f5813c8f5ae14f6d16feacc490f2e797c288eae11ec4f60cae3e476c9343

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
2KB

MD5
3ae4d261c0b945d4f4782fdd4ace88e6

SHA1
8510609fe3d7a3925478d8df218c7eef3b8de934

SHA256
77a9e1d92e0bf4bc2df8ce8e391a01a883cbdd448ae512918f59c32b06584090

SHA512
d2f13e43dd9a3ccdd737f5d4dd3a68862b198b3802fa09ae1eed6c85e8720f62cdc632ca6f6ea73d71c08a8a00ef56efed5d909c216100186a5a8f68789b8256

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
2KB

MD5
3a99f73698ba109680a8457ba02a3a49

SHA1
04cfb683222acee994734810aedf3ad2f94386e4

SHA256
70067e1cfe6bd73d0177a1ff26ee85599378d0ac968eaef7b6518e2b6d0731fb

SHA512
3b7f43a67dd387aa4372d140a7d5f74d4fc35097886bfc4a0953e9bd10636a3eedee4a11e7dd937c5b6dca51d46ee799a10f2ce7ca782bfe5c8bcf2cd23399fd

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
4KB

MD5
3521900c4046a68ade0575555711439f

SHA1
9635ad09a559fee699879f5dac4d82774fedca04

SHA256
cfa9569b4d3e52d004081e9d04b3288b77ddf7a28f0d5180d3dac770b378be52

SHA512
dc6f57fd29925a449df06c9bbeedf8e1c956fb57f263edf3ce80e8d333ee2a30598eca1e98a1b88127e8c0f888161ba6586baf77268004481f6bbcf652026c50

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
2KB

MD5
89ebe60f21dde278a500d0bd972635b2

SHA1
919f25794627b3badef01a9fc21dd37753e236e1

SHA256
84275f7e72ef36f8f4444f31880569c5b5a5ad5a6bda701e23b6abc57ab654f9

SHA512
b1ee8aa527e1f508df30ad7d2bafbc4e6e936e570269bb9c3591a1a921bb181bd0b74018ebc4fc8403079858d7331687880ef4b673f03b7f87e00b0b2e319439

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
2KB

MD5
37e18cfe2335fdf7997be9c4c3a2dc96

SHA1
2935615668d1886e13f59278288d950aedc0b17b

SHA256
6cc89bea2c9cf59a4aed4e270492f682c0560db60cbb93a287f377de001ffddb

SHA512
361ce4784ddc253edbfe0a11a07fb0aa1384f7706edb0939e07c5a40bec1cdf710243373f0e41bc1f9df594293527f9c47c5f8acbfe01e5d5d2c5b3e273b7496

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
2KB

MD5
dba555fdef41e5159c6b3126cc6b5fe3

SHA1
5dddabe6dbeabdd900bf4ff9a4970da226ba43be

SHA256
53cb1f42755e03772c96dbfc4710db4eeab6420585f44743406a2cfa30b78d84

SHA512
5e394a02dfb01a4751d208af86e45066dc54f81eaa1b3fa32632448fc15f795d234c6d48993125ed5c14322c12887c630ea4538b713124132095fef7452f335f

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
2KB

MD5
c84c4f6852dd6c1cb6a83af8e5406364

SHA1
e692979b34797af08dd20bd39b2acc894bcad6a9

SHA256
4545116d327a1744251612119ebf71b43363d199ed6043683721cc1fc06a3d2a

SHA512
1c7a3d1beb4eed3618c03e189dda7043eca4f926ffb9a16ea1c647be06925353086cdcdbb6d12cf53f549929ec58ef80198129d5c6e3d3ea1378fcccc3a3ef3c

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
3KB

MD5
8bbcc53e2d79fc15b00e5ca779699919

SHA1
2d3552d5f27e89b6e019f525b56850e88c0f4963

SHA256
fd44f27b31bca904c98eedba984f565b0fee3923d8776a2c164210b4626c0f47

SHA512
d2fccc579f71dfc393cd090b7ba0297ef137b95301e0fb2c8541feab5533bebc62991a8d4f5b35247a35a4d7c1a1740d4d509734aea4bce73d47fa465f817230

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
2KB

MD5
59b26c4986e4f79ac540982d84a255db

SHA1
7ae6141047228b0a8c54b1ee30dba6c94d3cdddc

SHA256
85d57b8b78b439933d26abb506f0389c28f9916f85e488e96b7376ca04df2cf3

SHA512
528d2c5fc7df2737675340d6e7aa6c03bc3ba911da0df9a0885d177108b281c9963007185f74a4f0ccdac5e809bc371d8e96935d9f1fb0eeeafd94d54196bb58

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
3KB

MD5
c53a80848d85d21313126fd99f456ab8

SHA1
b546af526d06f42577d98dfc3615984b1feee29d

SHA256
5eaf8229d51a919146323c2ee73901b14702f1b3cd3c3d68b2c5d21c5d5aec22

SHA512
848efbca46bf7cf360d9114d59076b4d34a7fffc169621fafcd22cedb72c537a8d33d7437361109a94afb0613dfd4e1516749c854766af38b38cc512efdd9728

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
2KB

MD5
04caa7ee391805336aeaab006bebd473

SHA1
0d7faf2e7fc482aa5c729bbb76c999885696fa6f

SHA256
1d4e0cf70032e1bc6737aa12c4a94295819d3082daa7f7bd216abde5a4bc4fe0

SHA512
50e890f1adf6c5af30aeb08f69b2e85a0be125bdd69ef10c2b8e59a82fe195d498a76b334d4d8fc986617f22f81b5c678a4516de3d644b437ac6ab6380a4a8d4

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
2KB

MD5
ba37ea247eecb682d5dd48fdc8440552

SHA1
d3e6e5b9465e9be5151df4c181e9df878d6b5f6d

SHA256
efd6b7da52dfc5f718cd44c80e2d4d4af6a412ac4946053467379f6e2c16e75f

SHA512
6b8203101ec7c562ba331be671e9196d773ca80cb2a8f7bde17dd7bce7bb6ee2d9c8fb85cd01be2388099426c66e2604794e2797455742e995a4f41334d43894

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
2KB

MD5
35b148b3ae292c00ec2c18864b5c6825

SHA1
a3cea2605bfced3a763ef01ee96733764e45b7b8

SHA256
240ea4d0bdfb0e5ac757383dfeff8b41d914aa84c1c0228d707f8e50721a569f

SHA512
ed02a87fde182318a1aebfae1062be87fe5ea015044bbe893e01b766620fd60653a15f20aa62c987ee372a74599d990e24ec49e1910837422a8cf41f9b5e7a98

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
2KB

MD5
ab730f87f1aa6cb0e0569dfe1c7e90a5

SHA1
358b555cca8a59873e842d2196d7817ca84f89af

SHA256
a71a3bc70935793c8baf5390d818cdef04a1937595c8f043bba1b570c27d6653

SHA512
5ba335396067c6fc0c5ba279292608e159a7cd59eb6a4a2361ccebbcc47c0580fb17887dbd26bfaeebaa4c57058f092918bc3ffde5348dbfdf6e852cb15cc8bc

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
2KB

MD5
02776881b9f7adf560a49a30ea3b2d87

SHA1
b7c6e37323f3ea9c1fff165de307ab04c2f15966

SHA256
32f75e763c10c8a1daf8519ef7709e492a8886d107adeb67f5e2f8c1ceba7954

SHA512
6a3b52ae9767d8ed096f50fc036ced5bd5db17f0ae780f2aa463abe7ea3d124eeb11542e077411907781dddabb7a51388e90f99fafbb8e4370b3ab624705084d

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
3KB

MD5
3d93a807cd21f14c8c04fca09313e96e

SHA1
60ae0d9d34dfe67a18c1897ba3f33baf3af0ec03

SHA256
b06ff8c0371a40b8cc879eebf4b879e6a86c170e98d71a52d1c19cc6a41a531b

SHA512
8832aff154032b1ad28f8d53d2b135385822b79824e34a88462061ebd200e7e2b3cd9dfc07f9d6c42f5b8f6c35bd2f3daecd7d52047d32eb2316db1d18b33a88

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json

Filesize
3KB

MD5
7960049262d4ef7fd8e6b57bdfba4239

SHA1
c3176621de69f9d4daa79d0972837335472f349e

SHA256
55fabb7050931c7e69f90ad024114fdca91f95795cfa9e8f80b778e5ed573602

SHA512
4c7846155af9d76ef4ef2d1e93926cd91e4854436fb1a5b98f584394cf8ca423735771debb6655d3fc7dbaedbd57234d1006c0a6ed5ad35dd5d168ed83237792

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-970127185296837d

Filesize
2KB

MD5
0392d36999ac7f9bc33b983cb36cbbf8

SHA1
68ed3765e4c0c77ea70a6edafeb6b37f5b584f57

SHA256
bb55c3234ec8db7432d4e46cce55630b465dccc286b97854e9cbc7a71fa6dadb

SHA512
9ae7f1427c159f1cbbcbe00e2e767e0b9f5aa24e28850595a9bf268a24e1a952da99ad518ab292dbc99f1caa5782ac2f815a77c935dc50531ae22b1335a71a7e

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-9701276178867261

Filesize
2KB

MD5
4d50ca3e468982e70ccd57ddf0c3a72a

SHA1
3d02e24edb947540c090bdb64064a6903cae541c

SHA256
b14f0e7c69477acf6b340518e878db397c2969a4f97e24ae2eb03de83b8cc097

SHA512
6baaf42515a6e2acc442f200c14d9ab8e376b18e24d43436ef7a5c8d448221686a45fd349c5d9ab89ccfecb5770d3f2cd84366c9ae1ca78fbdee80b12c0b2ddb

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-9701276671e5d44d

Filesize
2KB

MD5
36b1ab287e522b5831681fa942521f94

SHA1
b0f5bc85f6834c985a730a4eb182152b735f71fe

SHA256
37ea8ffc648ee76395a26f37b11248ff86b1c650c016030866e00b1884aab8d2

SHA512
d3e3cec8c453799e7dc0c34b0d0685dcc19991924aa2dd171fc3f644ae9e387332033029158b4480a06b4074a6377461b7d265957ced659f3fc066725ce1fd7b

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-9701285990510b04

Filesize
2KB

MD5
a404085de8c9b03ea34a1945f1907e73

SHA1
c15ae47380b72d0677592a35817ec9dda0b416c4

SHA256
0b8b1c9fe59551d7a49b8bdc49d14c8ca27e5ca3cf7932769f1d8285bd6e2040

SHA512
973e6faa4698b46bd8d3798dc604af74eef01bf0044a49a8b17eabb174b1ccdcced8ee972410623114b29d272c89958f444fa7a9c70aca0a34e15171d6446853

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-970130038689fcd4

Filesize
2KB

MD5
9c0e28dfa04ff50cae41fe8c45c354c5

SHA1
4b127a9a9591c9e01b6a5ad89bea1055e7fb76e0

SHA256
fc9b6445fefa2e5917b6d7c526fb01cd4d24364bf3bb92207aa9187adef42848

SHA512
225996e0b2320d12fcb4f4c313c0b7b4266dad03ab172aebe0212fa61cd265025e19be602f39dd0184b6276d89063a9e655a489b431d26c15b2a42ddbf9664f4

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-970131619018ef9f

Filesize
2KB

MD5
1bf9ef5ec40596b7e20971dfe75c9ca5

SHA1
55eeb9674e6f7c319aa068346430d19700f0e34e

SHA256
4dd63fd91444274cbfeed14b9f76b931fa19bf38f02c80b17a75c314e8f96683

SHA512
b709ea76a8df960ca7b08f2aefb50a013a0cf432c3f2c1d444053987c3ec2ebe06550297cbe04a3642203605201e0cd56be87c0694d8a782dc4965e0e1b21d17

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-970131636106babb

Filesize
2KB

MD5
7686131ccd7e55f28f437fd398789bd2

SHA1
7d0ef1399886eb90335d4fd3ee8d22334efa5788

SHA256
df432fb0cfb56c4c8e2faee982481740daa697ad4384200aae95e7501571b77c

SHA512
f5b7dfc4b654e0d82b107ff5a73447032d37b995665b79122e7b9a0486c3c7be515daa20b0747198100c36388a2ae354275aa599cc9a1de3baffcfac0f4c51e1

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-9701316684e71247

Filesize
2KB

MD5
7fe79b23cd097e6736965af6a8a0167b

SHA1
55e30afa189e8307c8541c01be9dcf11109743c4

SHA256
da4dee8e8d7b941a839098b520b8c60372af2ebbe93380bdd07eb432b27064ee

SHA512
5237481e1310edd43d89a9fad59cd31d1586aa8c55298be52106ced98184531e71d738a7bf0d682c604abbbb00523e4f030f0733d22a1f5577a512f625f1cb47

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-9701319597d82eb3

Filesize
2KB

MD5
e03da332c48c8d9f4cf89b7d98e2e486

SHA1
db6fa6c80a14a3bb1d53bb4d3303d9a96a90b61a

SHA256
aaea336f03c4dc89dd1f0f2c0d08208caef47259e0e80420883a5f6198fe43fd

SHA512
9a4189355eb258426d159c6677b28728e722dcd81834f07bdbc3dae8c33b02bd12b1177172154b567a8bb94468a3db36e92605d047d9d085184cc0f03f49eb33

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-9701319621bc84b5

Filesize
2KB

MD5
87e852fe1149b4d0d9c1fb009d190ef1

SHA1
895211b6b93c993c4033119343bbd8cbc7fffd3a

SHA256
44a2928bf7c9efd59b3291118b33a1341e46cadb4ab86cd7f781a750067ca84b

SHA512
b61d3a8bdc13240b1103e58568bfd7b45e060db83d00b1b13a01c8ed71fb0688f5035a612675fec8253370f3ad30f0555a1c01d52ddc99e38effa1eafe49db97

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-97013198376d04b1

Filesize
2KB

MD5
e6b1784db788147ac5b6343bb30372c2

SHA1
c7a0183a4ebf885acd43c1722416c62793eb56e4

SHA256
5b80300211af8249f9adb8b6cfa92ef3d2bf58d52f7d472ed42835edd4ca8801

SHA512
eb92a2e7ac50382d7c73857f98acee8da68b3eafe225787e5d94219467aed20d8de01a2cb15919c69e089dc3839edf873c333813c739bafe4a0b5904629d5693

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-97013200246f9e91

Filesize
2KB

MD5
f2ac98bf64793bbfe26172c16c853f8b

SHA1
6c9fb6c8e5a74e6e01659ee57f0aa8a7e6b3a4f6

SHA256
9080b5291b2483b2b5910e1316de2f2f7ca20bbdd1f57c536966db7207fe4c8e

SHA512
308bb88bb89f3d89685ecd764798b092f6a88eebe69e4d197ed1a0b3cd9d0137ebf7164bcd19f47d08b1acf59f4e99efffaec29da51a36889ac8cf3980247a99

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-9701320591365bfa

Filesize
2KB

MD5
2637a0fc9be9ddfaa0c7058ea00fbbef

SHA1
105909e5cbfa73d5f1287581e7ebc0cb9dadf4a9

SHA256
088b050c19342aa3535d06aa5f377428fd774e93aa8ae7b6ef6b53c7dd8f816a

SHA512
e2efb510ab44fada8c6ea37f3689b07c40d9cde6e10883714d276f10b2667c3ed620ae287896de188d2b575c0f2fec8c448f7a9e8eaa691c6d44be93aca03cbf

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-97013211221e28b1

Filesize
2KB

MD5
226d2373cce158430f510cf8fc8985d6

SHA1
354c1d211234499ec8ba6c7e0086ffe19e592225

SHA256
6fab967ce58e1ae6b9a9219c3fcd628595d647e3457272360c5fc7b22d88919f

SHA512
27e0d066c55121d43308db43c6f50c21aa7c94e7f53f2a94ad99244cc35b37e9603161702c262aa755be081cc29abaa33e91a5be76fdfb9e82215ebc1b18527f

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-9701346572228b55

Filesize
2KB

MD5
fa5e3d2e6327bb7e665df46e716db3c9

SHA1
02fa265c7b406742e23240e2080c7fe6feeec438

SHA256
07476cbf64eb012ba1f5f086547d4dfdb6aeeaa4a8598bd09bdd640207b003f6

SHA512
38fc388a16001ce871cf9aa9c7eb8d0a86a6ae5170c04170b7aac1f5b9031b2532344ed7daf23d81270f19e72a47dd8598765f47ac8161d9cd459745323d78cd

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-9701376464661659

Filesize
2KB

MD5
691a8520525b023fb4a8f12c0dd3f7d9

SHA1
0b37bb159ed083a95cb2763ac478a4b9ceb07412

SHA256
a3c59009fd9aa34f46cadd2f505e8353287aa5f06dd43bb841f7d544d2fbbdb7

SHA512
1ea8e657f70a9bc566324686deec4d1b178dca24e2f6fb9ac98e33d0ebae97b8b9a840a4e368148383c4e452874d78d61ed18b0cf1ff28feca570ffbdb73efb7

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-9701379754512049

Filesize
2KB

MD5
c39b0b423564d1140d28046a967c919a

SHA1
a80276c867031a5207e14e7b6e70fc94f5dd46e7

SHA256
ed57db01731b515cba8b3aecd456d40c4259fe1c367fd6abb39cbc3559565cc0

SHA512
369f3933545980c7ee0acc317ec4616d74587f1e625fb9baa3aa7fdf61af1aa85ba15f820e7a7360504eb608faab4e674edf0791a1103530bcf0022c65b7e6f0

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-970139771105a883

Filesize
3KB

MD5
cbde2e408d1647548bc66f010d358df0

SHA1
c4f945032b7e1e453b297f73daff4bce741e439f

SHA256
3a2cb1eb1a1a0b802f80710cb905ae73ebe36e3cb3702c4677efb889855d3ec4

SHA512
639abd58f85cd67dd74e8f108ecf76832841f141fe34374222bddc495b72673477a1c46b05aa71db7c6cbe0aa443e9fb8f89132bbeb7cde3c289a3d0841f302b

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-9701411624e7c52d

Filesize
3KB

MD5
0206e62b1d87ca711ae23f446e840213

SHA1
774951ed1cb3342d4d767d8bd652c3741a1ceb48

SHA256
24a6f6f45a4700b43d933374597ee324de5fc670f180e606cd9e8836a2f8961d

SHA512
ebe08b347241177829f41f6730bfeffd5a51b6b8a87b98c297167c89daf8a94888586fc192a93920c8e2d5b46e620f0383d7a2720bf27e8c8bb14c10279919fc

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-9701411677bcba67

Filesize
3KB

MD5
31e70e190c3747c206aaa7e9e3bdbef3

SHA1
3f9c247e1160d719fe61f4423aeac08d4b4767ef

SHA256
62a8ac0dd832f21dda7ae8a4dfc8f6ad3eaf61032aabd40d91e724b000bbdbf5

SHA512
00b0ece70994d6349136bddcb91c0fc501cbc99394b1860f76cedc0ac9e69638ffef0cd98e90cd4a4a3330a3aca94eca2c6ebfbef4eb610beb16e054bfb0415d

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\crosshairx-user-preferences.json.tmp-9701411801c9a101

Filesize
3KB

MD5
71d4fdc7dadd2b7fbf828d3a2b9daf9b

SHA1
b71556517e6309dbf0dbd63888a655198b6ac82b

SHA256
5bb62d8176c4e4aa28c8b29cbc28eea92fbd514643b20eb674a777495c4afef9

SHA512
907bf3021cd67ed33dd3037e81b83093f399a6ddaaab5a18caff932544721efc7968dc0558af22e37b32feef5e4f066c84589510f936e337ffe10dd33ab212d7

Download Submit
C:\Users\Admin\AppData\Roaming\CrosshairX\sentry\scope_v3.json

Filesize
54KB

MD5
7d272d0a2d2228d4f1c02af2152e25a9

SHA1
5dc3ba92310e499f6e755e0a55fc1a85858a8a99

SHA256
6c3443bb2320d5d1de71be6eeb84e6ad005f0bac58d08e366d306350df16ea08

SHA512
96f8096bd0a727843c850416b1744fc87dc6fa01040185b863dd3b2bcabcf5fcf65fc3a1793d085bbdd72a0c1a77cc583955ddaf1a4e45e990f351f7790527ac

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\CROSSHAIR X (Cazotty) (2).zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
\??\pipe\crashpad_3088_NKQUPTNTHRXVRZGE

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1104-296-0x00007FFC15810000-0x00007FFC15811000-memory.dmp

Filesize
4KB

Download
memory/1104-3205-0x0000016B92B60000-0x0000016B92BFE000-memory.dmp

Filesize
632KB

Download
memory/4396-359-0x00000232CC8B0000-0x00000232CC8D2000-memory.dmp

Filesize
136KB

Download
memory/5908-11853-0x0000016647DD0000-0x0000016647DD1000-memory.dmp

Filesize
4KB

Download
memory/5908-11854-0x0000016647DD0000-0x0000016647DD1000-memory.dmp

Filesize
4KB

Download
memory/5908-11856-0x0000016647DD0000-0x0000016647DD1000-memory.dmp

Filesize
4KB

Download
memory/5908-11858-0x0000016647DD0000-0x0000016647DD1000-memory.dmp

Filesize
4KB

Download
memory/5908-11847-0x0000016647DD0000-0x0000016647DD1000-memory.dmp

Filesize
4KB

Download
memory/5908-11848-0x0000016647DD0000-0x0000016647DD1000-memory.dmp

Filesize
4KB

Download
memory/5908-11846-0x0000016647DD0000-0x0000016647DD1000-memory.dmp

Filesize
4KB

Download
memory/5908-11855-0x0000016647DD0000-0x0000016647DD1000-memory.dmp

Filesize
4KB

Download
memory/5908-11857-0x0000016647DD0000-0x0000016647DD1000-memory.dmp

Filesize
4KB

Download
memory/5908-11852-0x0000016647DD0000-0x0000016647DD1000-memory.dmp

Filesize
4KB

Download
memory/7340-14049-0x000001A957560000-0x000001A957D0E000-memory.dmp

Filesize
7.7MB

Download
memory/7340-14033-0x000001A956EC0000-0x000001A956F5E000-memory.dmp

Filesize
632KB

Download
memory/7876-13875-0x00007FFC16580000-0x00007FFC16581000-memory.dmp

Filesize
4KB

Download
memory/7876-13876-0x00007FFC14B20000-0x00007FFC14B21000-memory.dmp

Filesize
4KB

Download
memory/7876-14057-0x0000015C6D9D0000-0x0000015C6E17E000-memory.dmp

Filesize
7.7MB

Download
memory/7876-14056-0x0000015C6D360000-0x0000015C6D3FE000-memory.dmp

Filesize
632KB

Download