Overview

overview

10

Static

static

3

CLFsecurity.exe

windows7-x64

10

CLFsecurity.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2024, 17:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CLFsecurity.exe
  • Size 35.1MB
  • Sample241224-vll4fasmav
  • SHA256 23b14288d49610a8eef61977b7fc49a963f1261fe29b1668b4443a04eaf493cb
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
babadedanetsupportcrypterdiscoveryevasionloaderpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Signatures

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

    loadercrypterbabadeda
  • Babadeda Crypter 1 IoCs
  • Babadeda family
    babadeda
  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Netsupport family
    netsupport
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 39 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CLFsecurity.exe
    "C:\Users\Admin\AppData\Local\Temp\CLFsecurity.exe"
    1⤵
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwspro.exe
      "C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwspro.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Users\Admin\AppData\Roaming\NetSupport_v_2.27984\client32.exe
        "C:\Users\Admin\AppData\Roaming\NetSupport_v_2.27984\client32.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:3244
      • C:\Users\Admin\AppData\Roaming\NetSupport_v_2.27984\uninstall.exe
        "C:\Users\Admin\AppData\Roaming\NetSupport_v_2.27984\uninstall.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4408
        • C:\Program Files (x86)\Google\Temp\GUMB97C.tmp\GoogleUpdate.exe
          "C:\Program Files (x86)\Google\Temp\GUMB97C.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={1266CA4D-0917-452A-19FA-B8B51EF60ACD}&lang=ru&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty"
          4⤵
          • Event Triggered Execution: Image File Execution Options Injection
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4388
          • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
            "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:4048
          • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
            "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3856
            • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Modifies registry class
              PID:3004
            • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Modifies registry class
              PID:2712
            • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe
              "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateComRegisterShell64.exe"
              6⤵
              • Executes dropped EXE
              • Modifies registry class
              PID:828
          • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
            "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0U1NEY2NEItRTJFMi00RUFELThENjMtQkMzMjRGNkVCODUwfSIgdXNlcmlkPSJ7NjAwNDREMjktMjA1RC00NjQ0LUFGQjMtMkFCNkMwOUVGRTk2fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezYyQUI0RkY3LUM1NDctNDg2Ni1BRjg5LUUwNUUzNjFERDhCOH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NDMwRkQ0RDAtQjcyOS00RjYxLUFBMzQtOTE1MjY0ODE3OTlEfSIgdmVyc2lvbj0iMS4zLjM2LjM3MSIgbmV4dHZlcnNpb249IjEuMy4zNi4xMzIiIGxhbmc9InJ1IiBicmFuZD0iIiBjbGllbnQ9IiIgaWlkPSJ7MTI2NkNBNEQtMDkxNy00NTJBLTE5RkEtQjhCNTFFRjYwQUNEfSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSI2MjAiLz48L2FwcD48L3JlcXVlc3Q-
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:2912
          • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
            "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={1266CA4D-0917-452A-19FA-B8B51EF60ACD}&lang=ru&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&installdataindex=empty" /installsource taggedmi /sessionid "{3E54F64B-E2E2-4EAD-8D63-BC324F6EB850}"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:396
  • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2776
    • C:\Program Files (x86)\Google\Update\Install\{B219DFF4-8C8C-45CD-BFCB-E8D30F643EC7}\131.0.6778.205_chrome_installer.exe
      "C:\Program Files (x86)\Google\Update\Install\{B219DFF4-8C8C-45CD-BFCB-E8D30F643EC7}\131.0.6778.205_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{B219DFF4-8C8C-45CD-BFCB-E8D30F643EC7}\gui1D37.tmp"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1848
      • C:\Program Files (x86)\Google\Update\Install\{B219DFF4-8C8C-45CD-BFCB-E8D30F643EC7}\CR_D9E38.tmp\setup.exe
        "C:\Program Files (x86)\Google\Update\Install\{B219DFF4-8C8C-45CD-BFCB-E8D30F643EC7}\CR_D9E38.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{B219DFF4-8C8C-45CD-BFCB-E8D30F643EC7}\CR_D9E38.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Program Files (x86)\Google\Update\Install\{B219DFF4-8C8C-45CD-BFCB-E8D30F643EC7}\gui1D37.tmp"
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2232
        • C:\Program Files (x86)\Google\Update\Install\{B219DFF4-8C8C-45CD-BFCB-E8D30F643EC7}\CR_D9E38.tmp\setup.exe
          "C:\Program Files (x86)\Google\Update\Install\{B219DFF4-8C8C-45CD-BFCB-E8D30F643EC7}\CR_D9E38.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.205 --initial-client-data=0x26c,0x270,0x274,0x268,0x278,0x7ff7abe7fd28,0x7ff7abe7fd34,0x7ff7abe7fd40
          4⤵
          • Executes dropped EXE
          PID:4812
        • C:\Program Files (x86)\Google\Update\Install\{B219DFF4-8C8C-45CD-BFCB-E8D30F643EC7}\CR_D9E38.tmp\setup.exe
          "C:\Program Files (x86)\Google\Update\Install\{B219DFF4-8C8C-45CD-BFCB-E8D30F643EC7}\CR_D9E38.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1796
          • C:\Program Files (x86)\Google\Update\Install\{B219DFF4-8C8C-45CD-BFCB-E8D30F643EC7}\CR_D9E38.tmp\setup.exe
            "C:\Program Files (x86)\Google\Update\Install\{B219DFF4-8C8C-45CD-BFCB-E8D30F643EC7}\CR_D9E38.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.205 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7abe7fd28,0x7ff7abe7fd34,0x7ff7abe7fd40
            5⤵
            • Executes dropped EXE
            PID:2612
    • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2912
    • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe
      "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleCrashHandler64.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1760
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0U1NEY2NEItRTJFMi00RUFELThENjMtQkMzMjRGNkVCODUwfSIgdXNlcmlkPSJ7NjAwNDREMjktMjA1RC00NjQ0LUFGQjMtMkFCNkMwOUVGRTk2fSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezBFMUVGMTNGLTIwNkQtNEM2QS04Q0I1LUI0QUNFMzMxREM0Nn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuNjc3OC4yMDUiIGFwPSJ4NjQtc3RhYmxlLXN0YXRzZGVmXzEiIGxhbmc9InJ1IiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNzgiIGlpZD0iezEyNjZDQTRELTA5MTctNDUyQS0xOUZBLUI4QjUxRUY2MEFDRH0iIGNvaG9ydD0iMTpndS9pMTk6IiBjb2hvcnRuYW1lPSJTdGFibGUgSW5zdGFsbHMgJmFtcDsgVmVyc2lvbiBQaW5zIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2xoazQ2N2I0Y3VuZDUydnFncWpuZjJzNHE0XzEzMS4wLjY3NzguMjA1LzEzMS4wLjY3NzguMjA1X2Nocm9tZV9pbnN0YWxsZXIuZXhlIiBkb3dubG9hZGVkPSIxMTYwNTk1MDQiIHRvdGFsPSIxMTYwNTk1MDQiIGRvd25sb2FkX3RpbWVfbXM9IjE1MzQzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3MDciIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI0MDQiIGRvd25sb2FkX3RpbWVfbXM9IjE2MzU0IiBkb3dubG9hZGVkPSIxMTYwNTk1MDQiIHRvdGFsPSIxMTYwNTk1MDQiIGluc3RhbGxfdGltZV9tcz0iMjk1OTEiLz48L2FwcD48L3JlcXVlc3Q-
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:532
  • C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe
    "C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateOnDemand.exe" -Embedding
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4296
    • C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:836
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks system information in the registry
        • Drops file in Program Files directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.205 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ffe845dfd08,0x7ffe845dfd14,0x7ffe845dfd20
          4⤵
          • Executes dropped EXE
          PID:4372
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1960,i,16854282486688707843,5116554461725812017,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:2
          4⤵
          • Executes dropped EXE
          PID:3704
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=2120,i,16854282486688707843,5116554461725812017,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
          4⤵
          • Executes dropped EXE
          PID:4888
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2364,i,16854282486688707843,5116554461725812017,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:1912
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3248,i,16854282486688707843,5116554461725812017,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:3536
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3256,i,16854282486688707843,5116554461725812017,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:1376
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4196,i,16854282486688707843,5116554461725812017,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:2
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:3604
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4708,i,16854282486688707843,5116554461725812017,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:3300
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3904,i,16854282486688707843,5116554461725812017,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:3712
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4896,i,16854282486688707843,5116554461725812017,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:3696
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5816,i,16854282486688707843,5116554461725812017,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:4232
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4052,i,16854282486688707843,5116554461725812017,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:2180
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5932,i,16854282486688707843,5116554461725812017,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:2
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5652
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=728,i,16854282486688707843,5116554461725812017,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5908
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5956,i,16854282486688707843,5116554461725812017,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
          4⤵
          • Executes dropped EXE
          PID:5736
  • C:\Program Files\Google\Chrome\Application\131.0.6778.205\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\131.0.6778.205\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4356
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
    1⤵
      PID:4908

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Image File Execution Options Injection

          1
          T1546.012

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          6
          T1012

          System Information Discovery

          7
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          GoogleUpdateSetup.exe
          • Path C:\Program Files (x86)\Google\Update\1.3.36.132\GoogleUpdateSetup.exe
          • Size 1.3MB
          • SHA256 1308e32b6dea50fa265ed488f3a247b95b97ccff3b519c549a416c88af4c5363
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          GoogleUpdate.exe
          • Path C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
          • Size 164KB
          • SHA256 63854e78780866d2ae56a58958a1fda017a71f54b71fe70cf5403958e961862a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          setup.exe
          • Path C:\Program Files\Google\Chrome\Application\131.0.6778.205\Installer\setup.exe
          • Size 5.7MB
          • SHA256 b4e1af45853fba90f9c771026c4c6a4a259b031db9578837f038bac4d9f742f5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          manifest.json
          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1724_1840842573\manifest.json
          • Size 114B
          • SHA256 a311aa850be76b377f9cf8c39ad706e597b0e52ebf27f5a05dab425271f6652f
          • MD5 SHA1 SHA512
          Submit Download

          crl-set
          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1724_2096582660\crl-set
          • Size 652KB
          • SHA256 0583dad06e8c0755ffab4096bb07825407cefccd86bc2c04d81ac0d9c82878ba
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          manifest.json
          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping1724_2096582660\manifest.json
          • Size 94B
          • SHA256 e5f914cbfbfcbfe61bc8879e9bb5b917d518e38d6b040b0cad3787abea2b2efe
          • MD5 SHA1 SHA512
          Submit Download

          BrowsingTopicsState
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
          • Size 414B
          • SHA256 1125d28ae5e6679462b890e9b193fc78f5a41851943336f921b4cbf5ad6c19c6
          • MD5 SHA1 SHA512
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
          • Size 96B
          • SHA256 b94b5bbf7347fdb79cad285db96df317422fcf2b0cd82842ae178b7222a518fe
          • MD5 SHA1 SHA512
          Submit Download

          messages.json
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json
          • Size 851B
          • SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
          • MD5 SHA1 SHA512
          Submit Download

          dasherSettingSchema.json
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json
          • Size 854B
          • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
          • MD5 SHA1 SHA512
          Submit Download

          Google Profile.ico
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
          • Size 192KB
          • SHA256 024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
          • Size 2KB
          • SHA256 b82c804d85181574c9d08fe83d07cbfd8fe77da251d60ef90e5a23351eb9fb2d
          • MD5 SHA1 SHA512
          Submit Download

          SCT Auditing Pending Reports
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          TransportSecurity
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
          • Size 356B
          • SHA256 16d8fbfaa34bfc05bcfe20b978a160de3161a5d83287f6d7d984f90d3d42aae4
          • MD5 SHA1 SHA512
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
          • Size 11KB
          • SHA256 ad444a030f177ecc5a7618668cafceeac1202146b62ebcce2c13803fbff8eea4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Secure Preferences
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
          • Size 15KB
          • SHA256 066122a972449238b4b1814340dc0eb8125bfd020430b7dd3e827041dd899103
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
          • Size 72B
          • SHA256 51f1b15ef48c8b7ec10480b153e6c5d62b0b79062610c2d44b23459523b5a19a
          • MD5 SHA1 SHA512
          Submit Download

          trusted_vault.pb
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb
          • Size 38B
          • SHA256 f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d
          • MD5 SHA1 SHA512
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 116KB
          • SHA256 ec2dba27f51ffb06b905ff83952b1dc4498e52769426a0c2fcc27675e45db5c7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 115KB
          • SHA256 7f0d53a9c0334f8ed5e33f7a0b8064154bd16fc733cb6f4b7a6e75f3a53b6958
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 195KB
          • SHA256 e4d254c0501b9149b5998c071ef745418537910632055dad0d050e1f8d2f22c2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
          • Size 195KB
          • SHA256 02a5d430b2c2e2d8c08e11cff049727b3c895465271cebd98bf964242f1593c6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Filtering Rules
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.53.0\Filtering Rules
          • Size 73KB
          • SHA256 68ef948a4727c058ed027c201eed5f749a508ae2732518188043af70e6e41e75
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff
          • Size 150KB
          • SHA256 71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BR94DD.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\BRL0000119c\BR94DD.tmp
          • Size 99KB
          • SHA256 75fc64a55afa86173947948d78ba5de98dfc35c487166a6682fe71ed5f6f877a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BR951D.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\BRL0000119c\BR951D.tmp
          • Size 288KB
          • SHA256 f675eba3b22e0a2238ec4961d99de3bacca0ab553ab26eecb49800a12a9371ab
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BR956C.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\BRL0000119c\BR956C.tmp
          • Size 35KB
          • SHA256 78827e2b1ef0aad4f8b1b42d0964064819aa22bfcd537ebaacb30d817edc06d8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BR958C.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\BRL0000119c\BR958C.tmp
          • Size 169KB
          • SHA256 0912c84ded4670c427db1f405eb68a5763eae8fa0a735abe44eea81be7dc44ea
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BR958D.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\BRL0000119c\BR958D.tmp
          • Size 532KB
          • SHA256 5dd27e845af9333ad7b907a37ab3d239b75be6ccc1f51ef4b21e59b037ce778c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BR95AD.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\BRL0000119c\BR95AD.tmp
          • Size 72KB
          • SHA256 5ddee4aab3cf33e505f52199d64809125b26de04fb9970ca589cd8619c859d80
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BR95CE.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\BRL0000119c\BR95CE.tmp
          • Size 14KB
          • SHA256 b017168c69ef40115141813e47122391602e1af28af342c56495b09f1c3c7522
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BR964C.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\BRL0000119c\BR964C.tmp
          • Size 14KB
          • SHA256 f1029f5cca3dabfeffe2c9db6ad84a9ff0f64f5b2fb85cb6ab348740f756e07d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BR9727.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\BRL0000119c\BR9727.tmp
          • Size 74KB
          • SHA256 41788435f245133ec5511111e2c5d52f7515e359876180067e0b5ba85c729322
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          BR9728.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\BRL0000119c\BR9728.tmp
          • Size 150KB
          • SHA256 931c52c91ffbe12d820ff96570ba8db8abc36ac2fb852c87f2ef99271d7183fa
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          messages.json
          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1724_1015869850\CRX_INSTALL\_locales\en\messages.json
          • Size 711B
          • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
          • MD5 SHA1 SHA512
          Submit Download

          DC120V104_32.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\DC120V104_32.dll
          • Size 498KB
          • SHA256 d3934aea56cc3a31756bc7f4b9697d6720bc07982e40a11b285d56cb928ff5d5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          DefaultTheme.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\DefaultTheme.dll
          • Size 1.3MB
          • SHA256 5749bd96a435534f6b0d9088ee7cea7214fd447d325ec048ec0a5472f2202adb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          FastNoise.txt
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\FastNoise.txt
          • Size 1KB
          • SHA256 ad4bdae53bad35e6f0e1c7174225ac9fe6547f63507953010294217492e887d3
          • MD5 SHA1 SHA512
          Submit Download

          GWSPhotographyWorkshop.txt
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\GWSPhotographyWorkshop.txt
          • Size 11KB
          • SHA256 192d2cb44f76b48e5f6977e64fff09838114d972e9ea624b266d210b7926ec1e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          GraphicWorkshopPro12.png
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\GraphicWorkshopPro12.png
          • Size 20KB
          • SHA256 fe8e59d899cb8fe22fa488e33c83038c1f1ab383b39840f888b01c6450b1bf20
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ImageMagickLicense.txt
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\ImageMagickLicense.txt
          • Size 18KB
          • SHA256 8bb1faed08a336d4d9a548a03f032ca8ad8f0e86f4d540a3dc2cf1dd55991d9d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          IteratedSystems.txt
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\IteratedSystems.txt
          • Size 7KB
          • SHA256 662443571e63ce315ddb8f07fc9ebf4fd7def58622e1244559c7c0d967c8db3a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          LIBPQ.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\LIBPQ.dll
          • Size 247KB
          • SHA256 be7ca5471f4bd0a21158fd0f31b5662ef0dbaa7e18d843f672a3e20d30ad42f4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          LibZipLicense.txt
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\LibZipLicense.txt
          • Size 1KB
          • SHA256 5cdf63ebcf8611b4c8db891f4cc26f386e0186623adff4f55c616c556fafc780
          • MD5 SHA1 SHA512
          Submit Download

          OpenCV License.txt
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\OpenCV License.txt
          • Size 1KB
          • SHA256 9bebc63ab0dc093a65b39c1a06253eb1f5c6bfdd2ec5dea721c8e3a655b9564a
          • MD5 SHA1 SHA512
          Submit Download

          RAR License.txt
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\RAR License.txt
          • Size 737B
          • SHA256 aa326761552c992526989d666cad9550ed0a86bb9062fc1b038bd7ce649324d6
          • MD5 SHA1 SHA512
          Submit Download

          api-ms-win-core-console-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-console-l1-1-0.dll
          • Size 11KB
          • SHA256 97955d1f5134350fbe6c829061e01106304978651979f4ecd5ec146bfc70d36b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-datetime-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-datetime-l1-1-0.dll
          • Size 11KB
          • SHA256 4e560ebdfe0bc1193a0f3feaac35634b0655829d5cc7e79d113f3a994f16d3ed
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-debug-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-debug-l1-1-0.dll
          • Size 11KB
          • SHA256 c3003ff52917dbac5d3feec1bdea8ad4163893ec2d320f904b6d3698a6dbc7bc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-errorhandling-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-errorhandling-l1-1-0.dll
          • Size 11KB
          • SHA256 3e8d67f3978e40a636c5fa86c310801d6d6b74127e556c57ff6fde8e1d7b706d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-file-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-file-l1-1-0.dll
          • Size 14KB
          • SHA256 f6eb872448b5147e59f373eee8a9852d1afc5eecb967f713a7f7acb4939e9a63
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-file-l1-2-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-file-l1-2-0.dll
          • Size 11KB
          • SHA256 3c9b67616fd0ceb3dd92e605918b08556683ebab5537aa76dff300fbd54b0337
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-file-l2-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-file-l2-1-0.dll
          • Size 11KB
          • SHA256 e04642684dc7376839c570bc11e9b46cae14420f1a85f7562fd2c4d656a22956
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-handle-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-handle-l1-1-0.dll
          • Size 11KB
          • SHA256 d2926dcb85ab577be75ecab1fc8dcd062318f147e0a9262a3b807bb5acb62beb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-heap-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-heap-l1-1-0.dll
          • Size 11KB
          • SHA256 eb02fc995bb92b214dd684e24c1060735f61ad4884ccb4aafa86c7c1de66d621
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-interlocked-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-interlocked-l1-1-0.dll
          • Size 11KB
          • SHA256 76f092341fbef40d5f35f70bab55f2eeb3e70a9b60f46043b342ceab7f79cef1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-libraryloader-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-libraryloader-l1-1-0.dll
          • Size 11KB
          • SHA256 8784c4912a2f391d5f0c79b38f48baf88e98bf4fa61614ccb9232d9bd1e4ad54
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-localization-l1-2-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-localization-l1-2-0.dll
          • Size 13KB
          • SHA256 43b98f74476c86107c8317749f54a107e2955696e4f79d3d02683dd7034d1d52
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-memory-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-memory-l1-1-0.dll
          • Size 11KB
          • SHA256 5c950723ff3118801884df67b6a14543978263a2d2a0437d8c8b2fe8ef3925d4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-namedpipe-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-namedpipe-l1-1-0.dll
          • Size 11KB
          • SHA256 8979fe86afe23035caedd5df135786da2b28c095b69ce0179b6484fd680c9b91
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-processenvironment-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-processenvironment-l1-1-0.dll
          • Size 12KB
          • SHA256 98ee724aa3f5a8ec4f3f8596be5aba5cd19b556f88ef9fbaff1569051a4d0dc1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-processthreads-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-processthreads-l1-1-0.dll
          • Size 13KB
          • SHA256 50b3e4ffee430c1b45f0ca75959936608f756ae5eb0352e8f3f5f69c5adfaa20
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-processthreads-l1-1-1.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-processthreads-l1-1-1.dll
          • Size 11KB
          • SHA256 6be230837149dc2a8c7772142a674c3f90930a55da7f91d791942d8276d5440b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-profile-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-profile-l1-1-0.dll
          • Size 10KB
          • SHA256 04c0a5392a18a7555635cde23f9111ea4da550c309827b725a74bb6fd4f0cc64
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-rtlsupport-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-rtlsupport-l1-1-0.dll
          • Size 10KB
          • SHA256 a5f4f23b01cac69058b7ec0e30b470f90bfc6d40de20e618c3045bf06e4a2cfd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-string-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-string-l1-1-0.dll
          • Size 11KB
          • SHA256 dcb3fc36c43a402b4b35644f1e7f6d6db31ef8d0a731c3b882e2cf3201a6714c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-synch-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-synch-l1-1-0.dll
          • Size 13KB
          • SHA256 9c1d190c85b9ccfb171d3db4ec363c97a3452bb365dd75dbda5ec9cad1a5d803
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-synch-l1-2-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-synch-l1-2-0.dll
          • Size 11KB
          • SHA256 8b7c8fc657e0dab0f2506001ca4bb76e675ffd18a2b4d9c1e03b876e008a7a26
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-sysinfo-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-sysinfo-l1-1-0.dll
          • Size 12KB
          • SHA256 fb7ffa16bfdf7392535b8e78a86db89ed9032f67a16b127a105582fab118cf2b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-timezone-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-timezone-l1-1-0.dll
          • Size 11KB
          • SHA256 ded52bac23633a03341969c5b98b0d94d24fa3284c1ddd0c489e453b39cec659
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-core-util-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-core-util-l1-1-0.dll
          • Size 11KB
          • SHA256 21c57c8ae9407cedb50bcebf7f844a5933d274676f3194a87997672c7177cadb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-conio-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-crt-conio-l1-1-0.dll
          • Size 12KB
          • SHA256 7b5d400a141f363f553f61fa11e94a6851d1eeb510cb7988012862ed13208c97
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-convert-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-crt-convert-l1-1-0.dll
          • Size 15KB
          • SHA256 060636cfc58587b4344a6d0ff4f44dd77266f2bbdb877cb50cb1b44a7e3969bc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-environment-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-crt-environment-l1-1-0.dll
          • Size 11KB
          • SHA256 369cc4d3bb05f4160a0bc9683feb1df2e94d02f061e4b23d53c3a6e2230cd5e4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-filesystem-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-crt-filesystem-l1-1-0.dll
          • Size 13KB
          • SHA256 9f3eb90963916194f167e98e049707b14fa84a3f11cb8cc7b940d95956601700
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-heap-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-crt-heap-l1-1-0.dll
          • Size 12KB
          • SHA256 9382fc8d5cbcc23c5d05e6f48f4188af3f96efbbdc5a7ec05b37e252440ecfc1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-locale-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-crt-locale-l1-1-0.dll
          • Size 11KB
          • SHA256 43c9ea4ddecf2f34852559cf0b40b5261e6701d3743ab219f48d43a312707ad9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-math-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-crt-math-l1-1-0.dll
          • Size 21KB
          • SHA256 8673dd898f899de831fc3052c8b8254b7b85ee7f2b9b6c422736668689c9b14f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-multibyte-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-crt-multibyte-l1-1-0.dll
          • Size 19KB
          • SHA256 e2c9693500cc7ce5cba81f81a68abf2ca783e187cfbaa9b52dd6c157c940a854
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-private-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-crt-private-l1-1-0.dll
          • Size 64KB
          • SHA256 722edc4fcf0cedc233f56227848b25318e2c211d5b3a4944fc294551f80d2652
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-process-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-crt-process-l1-1-0.dll
          • Size 12KB
          • SHA256 253caf243f9fd21f45c052384ed08f4c10ed0da0dc3ac55aa1c9e4249e1103d9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-runtime-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-crt-runtime-l1-1-0.dll
          • Size 15KB
          • SHA256 8edc95578b8c9ca93a65907e428fa2b57fef8370b902912689332bc61094904c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-stdio-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-crt-stdio-l1-1-0.dll
          • Size 17KB
          • SHA256 3a03d727d291be57057587227273af410eda935438d8a0a165ec63ae772809af
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-string-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-crt-string-l1-1-0.dll
          • Size 17KB
          • SHA256 82d26998b4b3c26dbc1c1fff9d6106109a081205081d3c0669e59d20d918bc5a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-time-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-crt-time-l1-1-0.dll
          • Size 13KB
          • SHA256 b0b8fc7de3641c3f23d30a4792c8584db33db6133ee29135c70bb504e80e4a2c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          api-ms-win-crt-utility-l1-1-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\api-ms-win-crt-utility-l1-1-0.dll
          • Size 11KB
          • SHA256 e36763df57cd26ec2b4d52e27de51a4ca6f18caf86cbac8307bf4817705f9a0e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          apng32.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\apng32.dll
          • Size 570KB
          • SHA256 0d5d934d541754810a90a984730451c6ea060429d86f7eba388d602a9afe7707
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          brotlicommon.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\brotlicommon.dll
          • Size 132KB
          • SHA256 441039fe954cfb6e3545aeca5d5750b7e3322eb9efc633508cca1dbefb26b24b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          brotlidec.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\brotlidec.dll
          • Size 42KB
          • SHA256 d9fce48811df001c7f8fe60361f1ea270fc37df7aa73a06a853fd102317cf49d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          bz2.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\bz2.dll
          • Size 63KB
          • SHA256 f004cd4113a8d832fc4a57f0e28a9001c2fddf67b3544590dd36d0f60d0cef8c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cpuid.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\cpuid.dll
          • Size 65KB
          • SHA256 bcfaf8b17923b18091b47dae3db34967ff773c970cb116e00782acf5bb1b33ec
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          deco_32.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\deco_32.dll
          • Size 222KB
          • SHA256 9ce2cd070187852f1ab624c77f1a21b714e43db13366625089a00b3d97f10345
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          epntwrpr.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\epntwrpr.dll
          • Size 85KB
          • SHA256 ea45a85c9329b2f29cd1c9451f555e235417afd020bad9ed09b38e430b232b77
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          eztwain3.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\eztwain3.dll
          • Size 955KB
          • SHA256 4f8e325f92ec8cb31b895b963042332e057a639d1e16b93f0333db0bc9d71dfd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          fpxacc.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\fpxacc.dll
          • Size 263KB
          • SHA256 37092ad75a8c98198c4a2a1876856884b200a06167cd76c3e9dd117af97e3aa1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          freetype.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\freetype.dll
          • Size 554KB
          • SHA256 ac40311bc17fc9eaf16f4aaf08c07d8a256e07aa4af081c9db9b552b56119e6e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gcsbmp32.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gcsbmp32.dll
          • Size 201KB
          • SHA256 289f87e244f0035faf5ac03e46bdc1f585aed94e915183424b4877d01d2e3429
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gcsgif32.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gcsgif32.dll
          • Size 203KB
          • SHA256 15b9106953681a2a7e3be6ccaa632267427ff8dec94be1917bce305b7e0540d5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gcsjpg32.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gcsjpg32.dll
          • Size 341KB
          • SHA256 0be2a13e61c2c5a32a41662bc3fc702d220260667b6a995f848781b4ea77928c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gcspcx32.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gcspcx32.dll
          • Size 200KB
          • SHA256 458c53ceeea5aaf2c01a56b36d7feeef061200105e20312491acf14d9e9c3de3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gcspng32.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gcspng32.dll
          • Size 440KB
          • SHA256 4a3481818f15287c6c17d45ebccb9460e9b9385bbec76efba2f7f30ef74f1c9b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gcstga32.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gcstga32.dll
          • Size 201KB
          • SHA256 2104851ea84e9a4ce66b3403103b9f102e77b68bbe8e04ade4e585fda6ed768a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gdiplus.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gdiplus.dll
          • Size 1.6MB
          • SHA256 8199452af9e5289c126d0ff9d99f2302c52861ec49008702b7f95d64d316383c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gp
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gp
          • Size 1.3MB
          • SHA256 ecd3c98b032e2df4bc73096f6883460c652869f451663fd2848186345c9f3db2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gumbo.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gumbo.dll
          • Size 477KB
          • SHA256 694ebe2fd5a5f71d6abd8d0c758128aff8238247d11d1095c2f955c0b784ad90
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gumbo.txt
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gumbo.txt
          • Size 11KB
          • SHA256 17fa39b5f12225602d967c908f39d3598be207d652bda3ca9deb6a426e2b909d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gwsaverlib.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwsaverlib.dll
          • Size 212KB
          • SHA256 11cdb6f026ccfba11a7f30ba987befa3c32f447dbdf3100cd3b41048362ab3a5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gwsfiltr.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwsfiltr.dll
          • Size 8.8MB
          • SHA256 76a4ad74a53bef71afa0f7be6c055287a11418aa117c2386881d424fd52d3922
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gwsfiltr.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwsfiltr.dll
          • Size 4.8MB
          • SHA256 9f4b75be391fe0aa48aa7b129f331cc1484fa429b3a9de2bdd5f6cf3312af47a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gwshdp.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwshdp.dll
          • Size 277KB
          • SHA256 5e920fbcc14ac82ec5abf2ca63523fa17f03a261dc09ee6b1976b291c2ab0097
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gwsjpg.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwsjpg.dll
          • Size 529KB
          • SHA256 026b0032a14ea867f640508fa4959e37215af83458d579c469c6f99b7d1b3522
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gwspng.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwspng.dll
          • Size 309KB
          • SHA256 70ab3b3b2f232f2a20e08feadb9ae5286dd10e71f62321f371e5bb532e0b0f38
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gwspro.exe
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwspro.exe
          • Size 21.8MB
          • SHA256 af81ae71376bb3abc9eb1a9f59c76224a43b2a68aceb6e5ac3d93f05fc259715
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gwspro.tip
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwspro.tip
          • Size 13KB
          • SHA256 3cb2a5c6ccba3bc464a9ef69110301f5e3dcb1c34c79a74071874d6aa9388134
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gwsrrsc.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwsrrsc.dll
          • Size 4.1MB
          • SHA256 9d1f3f68b7980066ea033de45cc07624fa55cf249b88f52fd6a0df1b7b6809d6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gwstif.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwstif.dll
          • Size 337KB
          • SHA256 8f91fcc534dd362cd396db278bc77e099e640ae512912356a3270d5bb27af1a1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gwstxtr.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwstxtr.dll
          • Size 8.8MB
          • SHA256 0777a20e126badc87177973bc324963e22ad133b69af0ab71f84b3342487d817
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gwswlppr.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwswlppr.dll
          • Size 50KB
          • SHA256 f7843283a75360e044054c95722acc006ccd64f8efa728a77a2558e25040f016
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          gwszip.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\gwszip.dll
          • Size 223KB
          • SHA256 2ea236b7434f0d570e5d2f480ffe53fc2dda34a4963ebe2a3ba62cb547a6e98f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          imatch.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\imatch.dll
          • Size 353KB
          • SHA256 0e5e4c2ac303baec9c6a5f20d9044ef84c064e48e25ce13cc1c9fb5ac1507b8a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          jpeg.txt
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\jpeg.txt
          • Size 36KB
          • SHA256 7782e494c687284b2f4821f37c19017733d83a3a0f8a06cfa4de5e7fbe095014
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          jpegacc.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\jpegacc.dll
          • Size 101KB
          • SHA256 2aa43154f35acdcde7296daf38607a84961ddd9a4754054ea69b1d49be640d98
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          lame.txt
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\lame.txt
          • Size 605B
          • SHA256 326de616457909152879072ac3cd3f811445a82fef19b6141b50b36cb2f8f40b
          • MD5 SHA1 SHA512
          Submit Download

          lame_enc.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\lame_enc.dll
          • Size 231KB
          • SHA256 c92be45102e00729d6328a11d6fd9bddcbc937cb9eee146205616ba7024d24c3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\libcrypto-3.dll
          • Size 2.7MB
          • SHA256 77e9a6177a7ce319567273897f43c265fdadd8af1e8410adc686cd0079588d03
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libmpg123-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\libmpg123-0.dll
          • Size 261KB
          • SHA256 04439f2b52603a16b17384b22122eaf26222fc088de0bc0a489767da01525b46
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libnoise.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\libnoise.dll
          • Size 174KB
          • SHA256 fe279cfc76c514810bbceba281254e6fd9ff696fc33ecfaba175d778e565a866
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libogg.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\libogg.dll
          • Size 17KB
          • SHA256 b5ee1821c351a38494f69ff5408762fada4ad103b82c1ba4a87e67ddfba1d62a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libpng16.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\libpng16.dll
          • Size 162KB
          • SHA256 1ceae383d27ef1b45d19f7bff2ab8fe02d553c861342ac8c2d6a32f9a6c1b825
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libresample.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\libresample.dll
          • Size 79KB
          • SHA256 3d742f33f681c4eacc3f011170bf597e9d6ae5c41dda0070df61fcf23181f611
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libresample.txt
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\libresample.txt
          • Size 2KB
          • SHA256 bd65e3af3b1e6266b97bd458260e1573e8abdf3d4bb0718626f6b93d949269f1
          • MD5 SHA1 SHA512
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\libssl-3.dll
          • Size 441KB
          • SHA256 6c79bb2a98f61dadec8b56547d52c8f50edbd861988b0521c064a524d4f879fb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libup40.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\libup40.dll
          • Size 23KB
          • SHA256 ecaf6da2a4dbe72fca16b9a758ed0bc2751884d9315411285555d8781617ef58
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libvorbis.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\libvorbis.dll
          • Size 641KB
          • SHA256 0ddf0cb5fa7cd28918b4b7efcb131948ad6c13c65be6b26dbedd62534530f126
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          mpg123.txt
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\mpg123.txt
          • Size 25KB
          • SHA256 48e27fa4fea30b20d7ed02fc2321f9bdc5b479bc3c19a5224bc0269dce0dbd74
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msvcp140.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\msvcp140.dll
          • Size 428KB
          • SHA256 21570bcb7a77e856f3113235d2b05b2b328d4bb71b4fd9ca4d46d99adac80794
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          oggvorbis.txt
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\oggvorbis.txt
          • Size 2KB
          • SHA256 2cba6d23f7c45935cb9fb68589b6b622bfc5df4d7ddebfff3e6e0a87a15e0d0f
          • MD5 SHA1 SHA512
          Submit Download

          pcdlib32.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\pcdlib32.dll
          • Size 185KB
          • SHA256 30a5ccaa5b1f4e122a40ba8a6351d1b97d2ba615d60580de7e280202c1d6ad6e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pcdwrip.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\pcdwrip.dll
          • Size 320KB
          • SHA256 b4d83e808ccccb077e93253d7187dc11b0724a84be91452184f082fe564a46dc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pcsbmp32.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\pcsbmp32.dll
          • Size 201KB
          • SHA256 b4a23618928c34614e75adb737acfa4203bc9858c64057903cb148992fb84027
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pcspng32.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\pcspng32.dll
          • Size 440KB
          • SHA256 fc9f60026ad842cd76689ddd84427f3a61a81e170ef1770bd20d6e103e00b61c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pcstga32.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\pcstga32.dll
          • Size 201KB
          • SHA256 9e99c78791001b86f930aa49e22495b24b89f780abf6a3cd270b378edd3ae43f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pcswebp32.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\pcswebp32.dll
          • Size 334KB
          • SHA256 d13072f7ff1fa2dafe71823df97390c7b3d01c7978a3e41eedd0206c463fcb69
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          qtmlClient.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\qtmlClient.dll
          • Size 232KB
          • SHA256 cdf59914f79903e0964facb10c19558ef398f95519587fdcd53cbf181cf254a6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sfwfmt.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\sfwfmt.dll
          • Size 120KB
          • SHA256 1828696734e091fc5adb507f0aaf2731cfebb3c402faf4314fbcc07dd85eb794
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          swfex.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\swfex.dll
          • Size 180KB
          • SHA256 87eb8bc7404a7f7019dda05896831f77649479dbe761ac1efc8af37e4ea2bcb0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          turbojpeg.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\turbojpeg.dll
          • Size 664KB
          • SHA256 ad75b80862195b952053322b9054e3c75983897591f9420b897fa2343c428b36
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\ucrtbase.dll
          • Size 880KB
          • SHA256 6255112c9978c07a05c6feaee01cf4be74b2920dc7017fbc1a42f8f5d23c20f9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          unrar.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\unrar.dll
          • Size 171KB
          • SHA256 edf1bb28df67d04f73bb290338a3488a7267be2ea7c68340a568f847513f7adf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          uri.dat
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\uri.dat
          • Size 3.6MB
          • SHA256 1caa74873b477cb828057300c12b9788cb088f8f4c0d4abe4d492e18377397f1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          uriparser.txt
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\uriparser.txt
          • Size 1KB
          • SHA256 23f2cd0c81dc56b88f1a048928775830b6f322257bd7a009f2fe7d74ec37ba85
          • MD5 SHA1 SHA512
          Submit Download

          util32.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\util32.dll
          • Size 67KB
          • SHA256 1edcb48235a8740203238dc23e047a77f9692699439021fe3f30a408e57570b8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          vcruntime140.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\vcruntime140.dll
          • Size 77KB
          • SHA256 141690572594dbd3618a4984712e9e36fc09c9906bb845ce1a9531ac8f7ad493
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          w7lib.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\w7lib.dll
          • Size 52KB
          • SHA256 7540f41195740520f4b36635e1c5eeb5875cec535b2bc0a310eda95cda0da847
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          webp.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\webp.dll
          • Size 523KB
          • SHA256 888461862802a909b5d63fd4eb447ee0969c2b6840587481e74cdba0473738d1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          webp.txt
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\webp.txt
          • Size 1KB
          • SHA256 17c029a902ad45a199dfe8e3a1c39305ab28d302b0703360c4a27351a4673dcb
          • MD5 SHA1 SHA512
          Submit Download

          wthnl.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\wthnl.dll
          • Size 109KB
          • SHA256 b32cddf0c6e505ea0bb75873b85879c763b73a83b32eaf3bf2b88ea6196ca127
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          zlib1.dll
          • Path C:\Users\Admin\AppData\Roaming\Steelray Project Viewer\zlib1.dll
          • Size 76KB
          • SHA256 59281018c70bfec371d593d4bd005f8c52c8a3440d96fdf28ad4881bf3c4d78f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/2392-1227-0x000000000E970000-0x000000000F23B000-memory.dmp
          Download

          memory/2392-1229-0x0000000016050000-0x000000001610C000-memory.dmp
          Download

          memory/2392-1278-0x000000000E770000-0x000000000E803000-memory.dmp
          Download

          memory/2392-1277-0x000000000DD90000-0x000000000E65C000-memory.dmp
          Download

          memory/2392-1276-0x000000000DCE0000-0x000000000DD23000-memory.dmp
          Download

          memory/2392-1275-0x000000000DC80000-0x000000000DCDE000-memory.dmp
          Download

          memory/2392-1274-0x000000000DC50000-0x000000000DC72000-memory.dmp
          Download

          memory/2392-1273-0x0000000003B90000-0x0000000003BA9000-memory.dmp
          Download

          memory/2392-1272-0x0000000003BC0000-0x0000000003C0F000-memory.dmp
          Download

          memory/2392-1271-0x0000000003B30000-0x0000000003B86000-memory.dmp
          Download

          memory/2392-1270-0x0000000003AA0000-0x0000000003B26000-memory.dmp
          Download

          memory/2392-1212-0x0000000003C10000-0x0000000003C3D000-memory.dmp
          Download

          memory/2392-1269-0x0000000000400000-0x00000000019D6000-memory.dmp
          Download

          memory/2392-1210-0x0000000003BC0000-0x0000000003C0F000-memory.dmp
          Download

          memory/2392-1208-0x0000000003B30000-0x0000000003B86000-memory.dmp
          Download

          memory/2392-1206-0x0000000003AA0000-0x0000000003B26000-memory.dmp
          Download

          memory/2392-1217-0x000000000DC80000-0x000000000DCDE000-memory.dmp
          Download

          memory/2392-1240-0x0000000016050000-0x000000001610C000-memory.dmp
          Download

          memory/2392-1242-0x0000000016050000-0x000000001610C000-memory.dmp
          Download

          memory/2392-1244-0x0000000016050000-0x000000001610C000-memory.dmp
          Download

          memory/2392-1218-0x000000000DCE0000-0x000000000DD23000-memory.dmp
          Download

          memory/2392-1219-0x000000000DD30000-0x000000000DD85000-memory.dmp
          Download

          memory/2392-1245-0x0000000016050000-0x000000001610C000-memory.dmp
          Download

          memory/2392-1243-0x0000000016050000-0x000000001610C000-memory.dmp
          Download

          memory/2392-1279-0x000000000E970000-0x000000000F23B000-memory.dmp
          Download

          memory/2392-1280-0x000000000E810000-0x000000000E96B000-memory.dmp
          Download

          memory/2392-1222-0x000000000E660000-0x000000000E69B000-memory.dmp
          Download

          memory/2392-1224-0x000000000E6A0000-0x000000000E6E2000-memory.dmp
          Download

          memory/2392-1225-0x000000000E6F0000-0x000000000E765000-memory.dmp
          Download

          memory/2392-1221-0x000000000DD90000-0x000000000E65C000-memory.dmp
          Download

          memory/2392-1214-0x0000000003B90000-0x0000000003BA9000-memory.dmp
          Download

          memory/2392-1228-0x000000000E810000-0x000000000E96B000-memory.dmp
          Download

          memory/2392-1226-0x000000000E770000-0x000000000E803000-memory.dmp
          Download

          memory/2392-1216-0x000000000DC50000-0x000000000DC72000-memory.dmp
          Download

          memory/2392-1234-0x0000000016050000-0x000000001610C000-memory.dmp
          Download

          memory/2392-1239-0x0000000016050000-0x000000001610C000-memory.dmp
          Download

          memory/4508-1326-0x0000000066C00000-0x0000000066C14000-memory.dmp
          Download

          memory/4508-1519-0x0000000000E60000-0x000000000110C000-memory.dmp
          Download

          memory/4508-1520-0x0000000075990000-0x00000000759AD000-memory.dmp
          Download

          memory/4508-1313-0x0000000075990000-0x00000000759AD000-memory.dmp
          Download

          memory/4508-1301-0x0000000000E60000-0x000000000110C000-memory.dmp
          Download

          memory/4508-1319-0x0000000066680000-0x000000006668E000-memory.dmp
          Download

          memory/4508-1321-0x00000000712C0000-0x00000000712EE000-memory.dmp
          Download

          memory/4508-1322-0x0000000067C80000-0x0000000067D0C000-memory.dmp
          Download

          memory/4508-1324-0x0000000075650000-0x000000007565B000-memory.dmp
          Download

          memory/4508-1325-0x0000000066C40000-0x0000000066C4B000-memory.dmp
          Download

          memory/4508-1327-0x0000000074FB0000-0x0000000074FDA000-memory.dmp
          Download