5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f

Analysis

user interaction
yes
max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
windhawk_setup.exe
Size 11.0MB
Sample260422-pc8cesev5j
SHA256 5116cc1703384aac88b8d7a3b57f172aea5da32b6df7355fb2f8247d23813c8f
MD5 a1a8fbcbde2d70638957f3e69a8e034b
SHA1 8185ffb95f72fc75f0fc4d964b2438b59a1fa653
SHA512 31ce367360058938998772e90b1caa9ce5733f67f4c13f3876a2710e15b14558c0ba01cd88cc5410fddcc1aa3780af0390c312e23545e00494c1ac6c39f28d60
SSDEEP 196608:xUDfxSCdVYdU5mqmm1o+79m8heSzXuF8hLzG5x6dHH+suqmIaS:xUFScYdUI5kZ9m8hN5c5x6dzuhS
TLSH
T106C6331233F1E653D6394E702218A7B79768AE71F644EE89A3C4904FC7005F27A4BE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3224	powershell.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	windhawk_setup.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\WindhawkRunUITask	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\WindhawkUpdateTask	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windhawk\Compiler\include\c++\v1\__bit\blsr.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\c++\v1\__cxx03\__ranges\container_compatible_range.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\dvec.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\bidispl.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\lib\libwevtapi.a	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\c++\v1\__compare\compare_three_way_result.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\lib\libdimsntfy.a	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\winrt\impl\Windows.ApplicationModel.UserDataAccounts.SystemAccess.1.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\winrt\impl\Windows.Services.Maps.OfflineMaps.0.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\winrt\Windows.Storage.Pickers.Provider.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\bin\x86_64-w64-windows-gnu.cfg	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\c++\v1\__cxx03\__type_traits\is_function.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\c++\v1\__numeric\pstl.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\msstkppg.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\triedit.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\lib\libresutils.a	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\lib\libwinhvemulation.a	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\winrt\Windows.Graphics.Printing.Workflow.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\c++\v1\__expected	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\i686-w64-mingw32\lib\libodbc32.a	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\c++\v1\__cxx03\__algorithm\min.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\htiface.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\lib\libwabimp.a	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\UI\resources\app\extensions\configuration-editing\dist	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\aarch64-w64-mingw32\lib\libdxva2.a	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\aarch64-w64-mingw32\lib\libp2p.a	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\i686-w64-mingw32\lib\libwdsclientapi.a	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\c++\v1\__cxx03\__compare\common_comparison_category.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\c++\v1\__thread\timed_backoff_policy.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\compressapi.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\vds.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\winrt\impl\Windows.Media.SpeechSynthesis.2.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\ddk\srb.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\netlistmgr.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\wctype.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\lib\libd3dxof.a	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\winrt\impl\Windows.ApplicationModel.AppService.0.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\winrt\impl\Windows.UI.Xaml.Automation.Peers.1.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\winrt\Windows.Media.Effects.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\winrt\winui3\impl\Microsoft.UI.System.0.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\aarch64-w64-mingw32\lib\libncrypt.a	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\bits5_0.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\c++\v1\__cxx03\__ranges\drop_view.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\c++\v1\__tuple\ignore.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\winrt\winui3\impl\Microsoft.UI.Xaml.Interop.0.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\c++\v1\complex	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\winrt\impl\Windows.UI.Xaml.Data.0.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\winrt\winui3\impl\Microsoft.Windows.Widgets.2.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\c++\v1\__type_traits\is_primary_template.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\ctxtcall.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\dirent.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\lib\clang\20\include\fxsrintrin.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\UI\resources\app\resources\win32\default.ico	windhawk_setup.exe
File created	C:\Program Files\Windhawk\UI\resources\app\extensions\windhawk\webview\locales\pl\translation.json	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\i686-w64-mingw32\lib\libc++.a	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\c++\v1\__cxx03\__format\indic_conjunct_break_table.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\c++\v1\__cxx03\__ranges\lazy_split_view.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\datetimeapi.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\lib\libmcastmib.a	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\include\winrt\impl\Windows.Data.Pdf.1.h	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\winrt\impl\Windows.Devices.Usb.2.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\aarch64-w64-mingw32\lib\libwinspool.a	windhawk_setup.exe
File created	C:\Program Files\Windhawk\Compiler\include\scrptids.h	windhawk_setup.exe
File opened for modification	C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\lib\libcscui.a	windhawk_setup.exe

Executes dropped EXE 54 IoCs

pid	Process
3060	windhawk.exe
620	winlogon.exe
784	svchost.exe
876	WUDFHost.exe
940	svchost.exe
1012	svchost.exe
1032	svchost.exe
1104	svchost.exe
1112	svchost.exe
1124	svchost.exe
1220	svchost.exe
1292	svchost.exe
1300	svchost.exe
1356	svchost.exe
1396	svchost.exe
1516	svchost.exe
1552	svchost.exe
1688	svchost.exe
1708	svchost.exe
1812	svchost.exe
1860	svchost.exe
1900	svchost.exe
1916	svchost.exe
2020	svchost.exe
1852	svchost.exe
2100	svchost.exe
1980	svchost.exe
2148	svchost.exe
2168	svchost.exe
2300	svchost.exe
2348	svchost.exe
2536	svchost.exe
2576	svchost.exe
2584	svchost.exe
2696	svchost.exe
2760	svchost.exe
2772	svchost.exe
3068	sihost.exe
2088	svchost.exe
2856	svchost.exe
3176	svchost.exe
3272	Explorer.EXE
3392	svchost.exe
3668	StartMenuExperienceHost.exe
4504	RuntimeBroker.exe
4236	svchost.exe
4956	svchost.exe
3264	SppExtComObj.exe
992	svchost.exe
2108	TextInputHost.exe
2924	svchost.exe
2040	svchost.exe
1228	windhawk.exe
3228	windhawk.exe

Loads dropped DLL 64 IoCs

pid	Process
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
3060	windhawk.exe
1196	svchost.exe
2704	svchost.exe
3728	RuntimeBroker.exe
1764	Conhost.exe
4016	RuntimeBroker.exe
1256	OfficeClickToRun.exe
3440	svchost.exe
5004	windhawk_setup.exe
3840	svchost.exe
4428	TrustedInstaller.exe
892	svchost.exe
468	TiWorker.exe
1228	windhawk.exe
5004	windhawk_setup.exe
2184	schtasks.exe
5004	windhawk_setup.exe
3252	schtasks.exe
5004	windhawk_setup.exe
2476	cmd.exe
2096	schtasks.exe
3224	powershell.exe
5004	windhawk_setup.exe
2624	Conhost.exe
4352	Conhost.exe
1240	schtasks.exe
5004	windhawk_setup.exe
5004	windhawk_setup.exe
3228	windhawk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windhawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windhawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windhawk_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windhawk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3252	schtasks.exe
1240	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3224	powershell.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5004	windhawk_setup.exe
Token: SeSecurityPrivilege	5004	windhawk_setup.exe
Token: SeSecurityPrivilege	5004	windhawk_setup.exe
Token: SeDebugPrivilege	3060	windhawk.exe
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeAuditPrivilege	2696	svchost.exe
Token: SeDebugPrivilege	3224	powershell.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1228	windhawk.exe
1228	windhawk.exe
1228	windhawk.exe
1228	windhawk.exe
3272	Explorer.EXE
3272	Explorer.EXE
1228	windhawk.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1228	windhawk.exe
1228	windhawk.exe
1228	windhawk.exe
1228	windhawk.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4352	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 620	3060	windhawk.exe	5
PID 3060 wrote to memory of 784	3060	windhawk.exe	8
PID 3060 wrote to memory of 876	3060	windhawk.exe	11
PID 3060 wrote to memory of 940	3060	windhawk.exe	12
PID 3060 wrote to memory of 1012	3060	windhawk.exe	13
PID 3060 wrote to memory of 1032	3060	windhawk.exe	16
PID 3060 wrote to memory of 1104	3060	windhawk.exe	17
PID 3060 wrote to memory of 1112	3060	windhawk.exe	18
PID 3060 wrote to memory of 1124	3060	windhawk.exe	19
PID 3060 wrote to memory of 1196	3060	windhawk.exe	20
PID 3060 wrote to memory of 1220	3060	windhawk.exe	21
PID 3060 wrote to memory of 1292	3060	windhawk.exe	22
PID 3060 wrote to memory of 1300	3060	windhawk.exe	23
PID 3060 wrote to memory of 1356	3060	windhawk.exe	24
PID 3060 wrote to memory of 1396	3060	windhawk.exe	25
PID 3060 wrote to memory of 1516	3060	windhawk.exe	26
PID 3060 wrote to memory of 1552	3060	windhawk.exe	27
PID 3060 wrote to memory of 1688	3060	windhawk.exe	28
PID 3060 wrote to memory of 1708	3060	windhawk.exe	29
PID 3060 wrote to memory of 1812	3060	windhawk.exe	30
PID 3060 wrote to memory of 1860	3060	windhawk.exe	31
PID 3060 wrote to memory of 1900	3060	windhawk.exe	32
PID 3060 wrote to memory of 1916	3060	windhawk.exe	33
PID 3060 wrote to memory of 2020	3060	windhawk.exe	34
PID 3060 wrote to memory of 1852	3060	windhawk.exe	35
PID 3060 wrote to memory of 1980	3060	windhawk.exe	36
PID 3060 wrote to memory of 2100	3060	windhawk.exe	37
PID 3060 wrote to memory of 2148	3060	windhawk.exe	38
PID 3060 wrote to memory of 2168	3060	windhawk.exe	39
PID 3060 wrote to memory of 2300	3060	windhawk.exe	41
PID 3060 wrote to memory of 2348	3060	windhawk.exe	42
PID 3060 wrote to memory of 2536	3060	windhawk.exe	43
PID 3060 wrote to memory of 2576	3060	windhawk.exe	44
PID 3060 wrote to memory of 2584	3060	windhawk.exe	45
PID 3060 wrote to memory of 2696	3060	windhawk.exe	46
PID 3060 wrote to memory of 2704	3060	windhawk.exe	47
PID 3060 wrote to memory of 2760	3060	windhawk.exe	48
PID 3060 wrote to memory of 2772	3060	windhawk.exe	49
PID 3060 wrote to memory of 3068	3060	windhawk.exe	51
PID 3060 wrote to memory of 2088	3060	windhawk.exe	52
PID 3060 wrote to memory of 2856	3060	windhawk.exe	54
PID 3060 wrote to memory of 3176	3060	windhawk.exe	55
PID 3060 wrote to memory of 3272	3060	windhawk.exe	56
PID 3060 wrote to memory of 3392	3060	windhawk.exe	57
PID 3060 wrote to memory of 3576	3060	windhawk.exe	58
PID 3060 wrote to memory of 3668	3060	windhawk.exe	59
PID 3060 wrote to memory of 3728	3060	windhawk.exe	60
PID 3060 wrote to memory of 3812	3060	windhawk.exe	61
PID 3060 wrote to memory of 4016	3060	windhawk.exe	62
PID 3060 wrote to memory of 4504	3060	windhawk.exe	65
PID 3060 wrote to memory of 4236	3060	windhawk.exe	68
PID 3060 wrote to memory of 4956	3060	windhawk.exe	69
PID 3060 wrote to memory of 3264	3060	windhawk.exe	70
PID 3060 wrote to memory of 992	3060	windhawk.exe	71
PID 3060 wrote to memory of 1256	3060	windhawk.exe	72
PID 3060 wrote to memory of 3440	3060	windhawk.exe	73
PID 3060 wrote to memory of 3904	3060	windhawk.exe	74
PID 3060 wrote to memory of 2108	3060	windhawk.exe	75
PID 3060 wrote to memory of 2924	3060	windhawk.exe	76
PID 3060 wrote to memory of 2040	3060	windhawk.exe	77
PID 3060 wrote to memory of 5004	3060	windhawk.exe	82
PID 3060 wrote to memory of 3840	3060	windhawk.exe	85
PID 3060 wrote to memory of 4428	3060	windhawk.exe	88
PID 3060 wrote to memory of 892	3060	windhawk.exe	89

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Executes dropped EXE
PID:620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Executes dropped EXE
PID:784
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3576
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  - Loads dropped DLL
  PID:3728
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3812
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  - Loads dropped DLL
  PID:4016
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3904
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
  2⤵
  - Loads dropped DLL
  PID:468

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f256aa4a-b9b4-4b3d-9fa2-152d3a26a1ed -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-471c6ddc-e6de-43f1-a928-6c8986539cea -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b2d61951-a593-4fc0-af69-0fde6462632c -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-1b4b2088-3e26-4a05-ab46-4a2ff8172bde -LifetimeId:d481b2ea-f32d-4fb7-bb0d-a23de6c6682b -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
- Executes dropped EXE
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
- Executes dropped EXE
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
- Executes dropped EXE
PID:1012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
- Executes dropped EXE
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
- Executes dropped EXE
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
- Executes dropped EXE
PID:1112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
- Executes dropped EXE
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
- Loads dropped DLL
PID:1196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Executes dropped EXE
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
- Executes dropped EXE
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
- Executes dropped EXE
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
- Executes dropped EXE
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
- Executes dropped EXE
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
- Executes dropped EXE
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
- Executes dropped EXE
PID:1552
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  - Executes dropped EXE
  PID:3068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
- Executes dropped EXE
PID:1688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
- Executes dropped EXE
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
- Executes dropped EXE
PID:1812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
- Executes dropped EXE
PID:1860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
- Executes dropped EXE
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
- Executes dropped EXE
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
- Executes dropped EXE
PID:2020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
- Executes dropped EXE
PID:1852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
- Executes dropped EXE
PID:1980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
- Executes dropped EXE
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
- Executes dropped EXE
PID:2148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Executes dropped EXE
PID:2168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
- Executes dropped EXE
PID:2300

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
- Executes dropped EXE
PID:2348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
- Executes dropped EXE
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
- Executes dropped EXE
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
- Executes dropped EXE
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Loads dropped DLL
PID:2704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
- Executes dropped EXE
PID:2760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
- Executes dropped EXE
PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
- Executes dropped EXE
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
- Executes dropped EXE
PID:2856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
- Executes dropped EXE
PID:3176

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3272
- C:\Users\Admin\AppData\Local\Temp\windhawk_setup.exe
  "C:\Users\Admin\AppData\Local\Temp\windhawk_setup.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn WindhawkRunUITask /f
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn WindhawkRunUITask /xml "C:\Users\Admin\AppData\Local\Temp\nst5A81.tmp\WindhawkRunUITask.xml"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3252
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /S /C "powershell -ExecutionPolicy Bypass -Command "& {$ErrorActionPreference = \"Stop\";$scheduler = New-Object -ComObject \"Schedule.Service\";$scheduler.Connect();$task = $scheduler.GetFolder(\"\").GetTask(\"WindhawkRunUITask\");$sec = $task.GetSecurityDescriptor(0xF);$sec = $sec + '(A;;GRGX;;;AU)';$task.SetSecurityDescriptor($sec, 0)}" -FFFeatureOff"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2476
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Loads dropped DLL
      PID:2624
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -Command "& {$ErrorActionPreference = \"Stop\";$scheduler = New-Object -ComObject \"Schedule.Service\";$scheduler.Connect();$task = $scheduler.GetFolder(\"\").GetTask(\"WindhawkRunUITask\");$sec = $task.GetSecurityDescriptor(0xF);$sec = $sec + '(A;;GRGX;;;AU)';$task.SetSecurityDescriptor($sec, 0)}" -FFFeatureOff
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn WindhawkUpdateTask /f
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn WindhawkUpdateTask /xml "C:\Users\Admin\AppData\Local\Temp\nst5A81.tmp\WindhawkUpdateTask.xml"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1240
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:4352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Executes dropped EXE
PID:3392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
- Executes dropped EXE
PID:4236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Executes dropped EXE
PID:4956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Executes dropped EXE
PID:992

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Loads dropped DLL
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Loads dropped DLL
PID:3440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Executes dropped EXE
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
- Executes dropped EXE
PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Loads dropped DLL
PID:3840

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Loads dropped DLL
PID:4428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Loads dropped DLL
PID:892

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Loads dropped DLL
PID:1764

C:\Program Files\Windhawk\windhawk.exe
"C:\Program Files\Windhawk\windhawk.exe" -service
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files\Windhawk\windhawk.exe
  "C:\Program Files\Windhawk\windhawk.exe" -tray-only
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1228

C:\Program Files\Windhawk\windhawk.exe
"C:\Program Files\Windhawk\windhawk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3228
- C:\Program Files\Windhawk\UI\VSCodium.exe
  "C:\Program Files\Windhawk\UI\VSCodium.exe" "C:\ProgramData\Windhawk\EditorWorkspace" --locale=en --no-sandbox --disable-gpu-sandbox
  2⤵
  PID:412
- - C:\Program Files\Windhawk\UI\VSCodium.exe
    "C:\Program Files\Windhawk\UI\VSCodium.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1544 --field-trial-handle=1804,i,54508829045733834,7898035689797310526,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    PID:1536
- - C:\Program Files\Windhawk\UI\VSCodium.exe
    "C:\Program Files\Windhawk\UI\VSCodium.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --mojo-platform-channel-handle=1916 --field-trial-handle=1804,i,54508829045733834,7898035689797310526,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    PID:2076
- - C:\Program Files\Windhawk\UI\VSCodium.exe
    "C:\Program Files\Windhawk\UI\VSCodium.exe" --type=renderer --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --app-user-model-id=RamenSoftware.Windhawk --app-path="C:\Program Files\Windhawk\UI\resources\app" --no-sandbox --no-zygote --enable-blink-features=HighlightAPI,WebAppWindowControlsOverlay --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2696 --field-trial-handle=1804,i,54508829045733834,7898035689797310526,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --vscode-window-config=vscode:7361861d-69f2-487f-a276-540415d346d1 /prefetch:1
    3⤵
    PID:1772
- - C:\Program Files\Windhawk\UI\VSCodium.exe
    "C:\Program Files\Windhawk\UI\VSCodium.exe" --type=renderer --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --app-user-model-id=RamenSoftware.Windhawk --app-path="C:\Program Files\Windhawk\UI\resources\app" --no-sandbox --no-zygote --node-integration-in-worker --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1804,i,54508829045733834,7898035689797310526,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --vscode-window-config=vscode:01dd851f-c617-4c60-bea6-eb083ad464d1 --vscode-window-kind=shared-process /prefetch:1
    3⤵
    PID:4228
  - - C:\Program Files\Windhawk\UI\VSCodium.exe
      "C:\Program Files\Windhawk\UI\VSCodium.exe" "c:\Program Files\Windhawk\UI\resources\app\out\bootstrap-fork" --type=ptyHost --logsPath C:\ProgramData\Windhawk\UIData\user-data\logs\20260422T131507
      4⤵
      PID:1216
  - - C:\Program Files\Windhawk\UI\VSCodium.exe
      "C:\Program Files\Windhawk\UI\VSCodium.exe" "c:\Program Files\Windhawk\UI\resources\app\out\bootstrap-fork" --type=fileWatcher
      4⤵
      PID:1792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"
      4⤵
      PID:2748
- - C:\Program Files\Windhawk\UI\VSCodium.exe
    "C:\Program Files\Windhawk\UI\VSCodium.exe" --inspect-port=0 "c:\Program Files\Windhawk\UI\resources\app\out\bootstrap-fork" --type=extensionHost --skipWorkspaceStorageLock
    3⤵
    PID:1748
  - - C:\Program Files\Windhawk\UI\VSCodium.exe
      "C:\Program Files\Windhawk\UI\VSCodium.exe" "c:\Program Files\Windhawk\UI\resources\app\extensions\json-language-features\server\dist\node\jsonServerMain" --node-ipc --clientProcessId=1748
      4⤵
      PID:3656
- - C:\Program Files\Windhawk\UI\VSCodium.exe
    "C:\Program Files\Windhawk\UI\VSCodium.exe" --type=renderer --user-data-dir="C:\ProgramData\Windhawk\UIData\user-data" --standard-schemes=vscode-webview,vscode-file --secure-schemes=vscode-webview,vscode-file --bypasscsp-schemes --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --streaming-schemes --app-user-model-id=RamenSoftware.Windhawk --app-path="C:\Program Files\Windhawk\UI\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI,WebAppWindowControlsOverlay --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1804,i,54508829045733834,7898035689797310526,131072 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --vscode-window-config=vscode:7361861d-69f2-487f-a276-540415d346d1 /prefetch:1
    3⤵
    PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gcrt2.o

Path C:\Program Files\Windhawk\Compiler\aarch64-w64-mingw32\lib\gcrt2.o
Size 2KB
SHA256 1d163f676a38f291ca9eedf549cdf088e7525423757e5cbe6e05a6288051370c
MD5 915a7b6888d7ff732e4765e1757182ee
SHA1 5a83b0f612c062592b7855f7df376d472f4a64ca
SHA512 e20fb3f63370493af6fc43d85ca0a98b550fd369b5d46322148b71b3e3794f6338f8df0a2a61ef23cac685abdcbe54ab242d445f481c3a3e3630894f90b4611b
TLSH
T1A7516545DA608B7AEC62967081EF03359F30A2465B41CF871E85E031BA035E97FC7F86
MD5 SHA1 SHA512 TLSH

Submit Download

libssp_nonshared.a

Path C:\Program Files\Windhawk\Compiler\aarch64-w64-mingw32\lib\libssp_nonshared.a
Size 8B
SHA256 f0a17a43c74d2fe5474fa2fd29c8f14799e777d7d75a2cc4d11c20a6e7b161c5
MD5 ab0a4c8c62da160eaae565341c07f202
SHA1 c98a17c08a612b399bcbcffed621456142bf10af
SHA512 220dbd2e437313c441bc34a9707ccc2e70a9c864399cfcb2aad34a012b75c45316758f8b6e85c668920beb510e0a4bc11a3129ee4d9df25a3fd090e944437dab
MD5 SHA1 SHA512

Submit Download

libc++.dll

Path C:\Program Files\Windhawk\Compiler\i686-w64-mingw32\bin\libc++.dll
Size 2.1MB
SHA256 a0f36ff21a32fa09de8de64d8021f444de57e48f469fe8152cc41e3dc58a1d90
MD5 8e566bd390c1624239b1705823da9fd5
SHA1 70ce2e49fb58fc4ebb26ef598970203f08e54dcf
SHA512 5f17647aecff920d39362968dd5da3b277a412e446fd9d0883528b97c1e7e8073454307b6824edf0bc5c72eec573fe1e19bc711ebe5c0f4fc6e8df0e920af4af
SSDEEP 24576:6nmZ3mJNi0rvnl478JCSFoKk8zH9RBchSMXl2hXhGR7lrSLu+n2vgkF2PmeBXyJr:V2JNi0rvi72yK/7ngvuNCx
TLSH
T16AA56C4157FB8EA6E88A3B7491CF333B93385E216BB789E79A00876055433D75E3A740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libunwind.dll

Path C:\Program Files\Windhawk\Compiler\i686-w64-mingw32\bin\libunwind.dll
Size 215KB
SHA256 f48eaae7c06622b81b55ffa09338af4b7778121847f2f9bf1f0e6cef32d8695e
MD5 a9374f3368b8fbfe0ce96e550e640213
SHA1 b45572aeb3b9be84c04c0bce43128e3b18d16807
SHA512 6e7cabe491974c6de6abc6f6796edaf9fabab8ddfc2856db549c19495cc3fa2bd9919f589fad5f1bb3bd0366dad282258a7c59cb819795f11ae73f8cee8106c0
SSDEEP 3072:OVF83GlmW+loC68ZVFdtP+frNRMLukyy8gEPedeCH:b3Km1nx9qMB7
TLSH
T131246C59A7D29F7BC545433998EB1324DB35C0392BC35E8B2E080A706F533E5ED62A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gcrt2.o

Path C:\Program Files\Windhawk\Compiler\i686-w64-mingw32\lib\gcrt2.o
Size 2KB
SHA256 96e7ddac57be6ac210342a7a1fa064c620052d3fc903e70bc27f82b636d68cf0
MD5 38fde7ef03fb5287ede28219cac6721e
SHA1 bad2de2695ada87fd0cdfbd962a6ec06ea2a2641
SHA512 ee26e3c77e01f307b48ca58fa8749a623756a234feb2226169f22cd10c82fecc63d4958158631473d99a08c66e8dcfa1215f0aacb8396a2aa2fd1f0e96cf37f5
TLSH
T1E8514341CA308767CDD99A7849AF0320AF206A869B414B432F89E130BB17BED1DC7B05
MD5 SHA1 SHA512 TLSH

Submit Download

libd3dcompiler_35.a

Path C:\Program Files\Windhawk\Compiler\i686-w64-mingw32\lib\libd3dcompiler_35.a
Size 3KB
SHA256 d6015cd8643fbda48ef6de3320eb906b1dd4db36bcf0c94d0391b6bd8946adb2
MD5 e1d26e4d26fe25cb40ed6cd8a1751cc8
SHA1 d0bcb6605c74499ebfd69477450325527021fc98
SHA512 9416858c7b7f983b803a00efbbd9f82ec0aaeabfb1b62c7811021265a3ec089816d682862356037e0a69109c0993ac28a4f5b7e8964481eca423dd0ea48494f3
TLSH
T1A1716DBEA33E4C0BD37D927C9B069093079C85454A431C033A2C5799F7EA111643BE3A
MD5 SHA1 SHA512 TLSH

Submit Download

scardsrv.h

Path C:\Program Files\Windhawk\Compiler\include\scardsrv.h
Size 238B
SHA256 a32207b286686ad5f42d72a5c96308b96c5cb5f42fb2a7deef01843e657c6035
MD5 1f0d70d404140b0b980828d2d02345ce
SHA1 cc21371a235a392bd17807d6774c60e64ff5bb28
SHA512 d1a5589be969b15e09379c630fd56849d2a57eb6d26068899753c7701c97ff695fefe63648749f2bc7526cd0fd8816970ecec00d5f476f84f9cb10c0e9a377a0
TLSH
T141D0A751CBD997B241410A119704D3D9521CE1ACA1B75605381602A9BF04E714727ECD
MD5 SHA1 SHA512 TLSH

Submit Download

txctx.h

Path C:\Program Files\Windhawk\Compiler\include\txctx.h
Size 237B
SHA256 255a11df990657af623e682c7c3a81274fbb4a80c10f1dc2280cb3ce4eb98cf4
MD5 78e0d5a995d78a006930de3633bbd3be
SHA1 f58a7650dece31af5c4f3931981dc9bb2584c101
SHA512 18a5f5166a12b157e5727e7e4187c1b9521530419fefbb355be693da8fa959a852a6b00eadf4d759c74931f7943ca3f08ce01ac7497a80892b79489aa1bf8b38
TLSH
T160D0A751CBD987B241420B019714D3D55208A0ACA2B75609391702A9BF01A714327EC9
MD5 SHA1 SHA512 TLSH

Submit Download

cfloat.inc

Path C:\Program Files\Windhawk\Compiler\share\libc++\v1\std.compat\cfloat.inc
Size 440B
SHA256 ba6d2968e387be16375170a945d210b42a3f103bb7c1c8ab7c9d3d190c746105
MD5 c90884b4b37c4416bc9e06b7e05eee83
SHA1 a7910f32378931a4c8cf86186cde5f0488c96196
SHA512 6f0ecb0f9e5a65747e6f59b29b4e6a1da04a1d17fffcf971936193df58423dbfac0ca4898d3ef924b1244f515553755534b3685584da567b65401efc08b180e1
TLSH
T1C3F0CD53AD93122303C7C9C5DFD5938FE99DC74E05888E3F840097B1905456116DD053
MD5 SHA1 SHA512 TLSH

Submit Download

cfloat.inc

Path C:\Program Files\Windhawk\Compiler\share\libc++\v1\std\cfloat.inc
Size 461B
SHA256 dde40ec35e6728a5ddcde229fe62f85c6c8d2a573126de3a3603fc8981ae6d2a
MD5 2d594af0d5a963e56d9f77abf7042abb
SHA1 c716f93b2bd4c23a05bee2830b99756bfbf69de6
SHA512 4a3a0f8593a6f84e3884b9ad06a59c305a834f59ba357714d3a7f07d5440fbd93c6ac049c4390a67c198299999be7839d2b034d31a0b3c287d132c50740c2928
TLSH
T1B2F07D13ADD2622703D7C8C0DFD962DFED9DC74E49888E7F841096A0409446102CD053
MD5 SHA1 SHA512 TLSH

Submit Download

COPYING

Path C:\Program Files\Windhawk\Compiler\share\widl\COPYING
Size 2KB
SHA256 99a69660981156c21336fdb5661f89341b013c94e4bf9e1c7467b4745718397f
MD5 bb936f0e04d8f1e19ad545100cee9654
SHA1 ca7a993958b886d2435da65fe6996b89e57e8354
SHA512 07e171b66b74e967e3a233639de62df503304c8ec7185019cd61849ec82c5f0e33fcce1b92fc3fc2fc3116b6b17f332d1b31571f804e970a8a624fafb625b693
TLSH
T11841854F214447F31AD11A866A0AEDDCE04AA03E3B2756053C7DE24C6B2783DE6F65E5
MD5 SHA1 SHA512 TLSH

Submit Download

gcrt2.o

Path C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\lib\gcrt2.o
Size 2KB
SHA256 9b2b03211475012a5c11bd5f6c30b6156934e35c8a626f22d8b44eefcacb31db
MD5 dcf5cb815d01a3c7c1836c661add0697
SHA1 d63b56db4ba15951656d11552a3bbfa3e0f9e2e9
SHA512 519dd233640861b8b6fcf8db73455b9adf4a92bec09cfd0bb5b3d27398a4e34454d03b50e7dac3718d4000da9edf479af237e84dfe673bc5f00ec80660d9bc20
TLSH
T181513E8487708B7AED64967180AB43358F20B6460F01CF472E8860627A5B6D93ECBB5A
MD5 SHA1 SHA512 TLSH

Submit Download

libc++.modules.json

Path C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\lib\libc++.modules.json
Size 561B
SHA256 a6e5422724e82ee365cdafd73eca17e0987c60fee96c501482240e23b30c5a01
MD5 2fdb9133d6c165da367a89d81eeea28e
SHA1 c267a80c88e8ef284344d35fbf0c569e7daf97ad
SHA512 58c5a0ebcb0a84f92e10f2824106eeefd04e688924d253aab2cf1a9980161e62fdeeedf44ca33dff124dffd2cf6e29a4659085ad62a755886f7b151b29ebc7d0
TLSH
T16BF0E206E1B4ACB735DA5678701545420B2CC59729643D2C72DF0B8CCF08AFE1ABA7AA
MD5 SHA1 SHA512 TLSH

Submit Download

libd3dcompiler_35.a

Path C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\lib\libd3dcompiler_35.a
Size 3KB
SHA256 17c968c88091e986eb81761a865971b80b71ec1cdd36d5ba66c95743dec926e2
MD5 d560624ef181887096f4ad7ec947ee5a
SHA1 d855914137b75a049a40f22ff3c31f8f1ddd6b6e
SHA512 f0f4d3dbe12ccc4d508350e8251abdbd749e084a01600acbbbe7ff83699cef646c3e5ee6cdbbee225016f30e18982f59ef04a0e0f3be5a55a3887d3bbffe9329
TLSH
T1A97125FD672D0C4EDB38537C9753906307DC968602032C1B3A1C5999F3BA222667BD3A
MD5 SHA1 SHA512 TLSH

Submit Download

libmapi32.a

Path C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\lib\libmapi32.a
Size 33KB
SHA256 7cce176a4fb4c4bfdce9d543c34bab6925372fe91ac2bbc182dd33d80fed5dfe
MD5 a0487339268210b32ceffecb6e8d1daf
SHA1 4f401e8011d8b476dd1639206ccf9da865660d83
SHA512 78281b2955fac5ede819b6dedba2dee3630ab8c619e518f014017545ddaaac869aaba8d32094a44b1e58b2548a224b52bbab8ace2fd3cc94c526e28355a189a4
SSDEEP 384:7uHt99P7ZGgd3TRFnxIYOit0jdnxUdtxAO4nEIXCYi5En7LWw9iSQwI01poK5uX5:q/9BRyiyiAy9E7ag5W7
TLSH
T100F2563961149D8EEBBC233B9326B8E8635D85037923982F352F65C78B75AEFC503610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpthread.dll.a

Path C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\lib\libpthread.dll.a
Size 32KB
SHA256 c90edbdad5b064894d8f364e386d3c2f58a726efce59b6779a7fdc17430610d3
MD5 6fd5f66c54d7e62d831cb82556b9d749
SHA1 5c738a5a07b7f252f0110d3c8e503e919aad6f89
SHA512 420c67affbc3a76164777e94987353f76b241272ce30d7d89f3846abd81cabf23d9af8def65c487490c671f1b5fb6a37bc98e1232a66d9a4a808f5114c049917
SSDEEP 768:0cZR9E7l2ItZNdbyVPm3YGLlifvtAuSTzg:0cZR9E7l2I3NdbyVPm3YYlifvtAuST8
TLSH
T130E2153665BC4ECEE9B41E3A8B71B2E94A0F485553076C03F36ED18287BDE1AE443C59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COPYING.MinGW-w64-runtime.txt

Path C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\share\mingw32\COPYING.MinGW-w64-runtime.txt
Size 10KB
SHA256 e9b2dc02451ea29092a1f25fa0f3c07207ed421f1807dffb0c4e6dce69dee7bd
MD5 3edacf7e64e1b7a634666ac043f6b13c
SHA1 a9f34f60580d0af27aca03e7e1a77a2d2ed011a6
SHA512 221649d9175ab4ef57161ee694fe77adfe8839f353a7389c309d664f3e4c8fb78d22005df43c4b40c294893fbbd2deb5d86ac666b2c30a6b10501e5237432d7e
SSDEEP 192:ZqrHYKQrUcrUBe6Wj3+3HmEtzm/8Yrs0rs73M303OgXSHCZ5uXSfWj3Uj4qVAugT:mHYVrUcrUBe6W7QHbtzmlrs0rs73emDc
TLSH
T1CA32D94B23D057B555E24BE23955B8CCF209E03E37136D09386DE2A8531BF6FD4BA1A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COPYING.MinGW-w64.txt

Path C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\share\mingw32\COPYING.MinGW-w64.txt
Size 5KB
SHA256 f38e6194bd3bfa1b654f118e5acefe0aead437bbe669eee43957ccc65a7127f1
MD5 5bb2c9f26ed3acd4c9cfa4445a7a9772
SHA1 5ce7fd3afd927fd1ea74f96d0731e12849ad3629
SHA512 8958f66aecb87cd7651c3fdd6dc274958edb7a23aba714314b1e7de152289e496ea3f87d39db1e183553fd35ef5460120f65e7a29b55c8a6f96fa5ee7c66ecd2
SSDEEP 96:YjK/PgtxoE4SorYJKrYJCTZ3V3ziAETIgvIz/YEFqshQHTodqshQHTou:YjCItxaSorsKrsCTZ3V3WAORvG/YENQl
TLSH
T179C1C81B33845773199212A26A2968C2F21AA13E376B2D05343DF2D4233B73ED5FB854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COPYING.winpthreads.txt

Path C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\share\mingw32\COPYING.winpthreads.txt
Size 2KB
SHA256 63263614cdd29f2f93cba85e992f041b31f9fc7b4033692f31269489a8a1b177
MD5 06a442d2c46dd1e90807932a0c544789
SHA1 107213526be152ad43a78fcf38b067629fd82782
SHA512 5ed1321e3a2a1b0f0e300844530215bbbcf5bdb72a3d8da1457c2717d64b7af107a5ae954045f4163cff793c73a689426c2d4dc5ea785d869ee9292e98478727
TLSH
T16D51955E2350179315E216B1562E6DC4B15EA06F3E373A08286EE3581F6B47ED4BBC50
MD5 SHA1 SHA512 TLSH

Submit Download

COPYING.winstorecompat.txt

Path C:\Program Files\Windhawk\Compiler\x86_64-w64-mingw32\share\mingw32\COPYING.winstorecompat.txt
Size 1KB
SHA256 fa7368d1f93d890c173177475d8ec7aff265a7d08f1f364d66f74d138978ce36
MD5 068096d98f519d6e1e14a99a23b8cb88
SHA1 ac5cfbf864bd05601cb16352c1e1496b7a502d6a
SHA512 760f7340135c2688416ae161a4a64af8aa5292c1554a8eb078b4869bcb48b4808b676e607387e2c5d4c0ce5f7950c399ecc3a2aaf0d1c38604e7023380074672
TLSH
T14511632E73610772299613A095796CD5F22B725F7AAF2684146EF344232E06CC5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

windhawk.dll

Path C:\Program Files\Windhawk\Engine\1.7.3\32\windhawk.dll
Size 905KB
SHA256 67cdaaf26d342b3f2a2a84ea6f7474ac43340711675b66edef34cc3fcee1ea8f
MD5 f7bb000645c99f89ff38c6f7616c205f
SHA1 4f76a9b030ecb1b9b9861e5be2787f63e78c0723
SHA512 33623281a35d29ee18d59fc9d286b9c83903d781b5634d4d9fc7918cc5b74027cb2d9f6fd8ecf35391c201549068d1898cada742c6947c00bfc9cbb91c1ee6e7
SSDEEP 12288:vPtFKXRL67yB1dEQ3d6GHBKLP+M+sWe1NUtcpNd+5w6uZNZcLpixp:3tRI1dvBOWM+sWeDww6uXZcLpixp
TLSH
T132153A72EE41B433ED3419345DA6076B663E91A0976281C7278C293E5DD1BD02F32FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windhawk.dll

Path C:\Program Files\Windhawk\Engine\1.7.3\64\windhawk.dll
Size 956KB
SHA256 0aad074caf156200be7a77e4615f9171cea884cde96baf90397366c28c4f10a1
MD5 5e377e811ac2772eb6ecaaf04063ac3d
SHA1 6d1f24c87be48ef93ffd6773957f73eda7652192
SHA512 3b5686eb8501015edf228d9552f55c89450934f69f2553069018188b5483b1f9ced43010a9a105cdc29dbf012f300a6652e60662f4c1a76b198b8ceb019d5af2
SSDEEP 12288:LuItYj/l9fjIoAQ2BAM7UtcpNj+5goVuQxrDY:L8j/zUoArAKu7Vu+4
TLSH
T105253BB3EF502476E831953489B30727A27BB4909761C6CB2748252E1ED2BE02F36F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

engine.ini

Path C:\Program Files\Windhawk\Engine\1.7.3\engine.ini
Size 224B
SHA256 2f26a1ccca3d95df17fab8eabc10fb5044e5aecd82a5ce5c7a83c47ca7baeb0c
MD5 661660d0a71bca718d5fd4f1904628c0
SHA1 35f63c8a3a8cf039fc71f097c4368ab50780ecd6
SHA512 ef93f9db7488cbae267ab2ab9ec6c9ecc1e3d6501546afb2b522bad58234e79d0dec63c005b984877a2465e60f1cc87eb7f13b760334c190ced0724578b889b5
TLSH
T18BD012133BE5002CF2F75A46ABB094308766FEA82648C84D31C8C28D54F1A808D033F3
MD5 SHA1 SHA512 TLSH

Submit Download

extension.js.LICENSE.txt

Path C:\Program Files\Windhawk\UI\resources\app\extensions\markdown-language-features\dist\extension.js.LICENSE.txt
Size 5KB
SHA256 38ee4192b4a1f7da0535d4f2bd219ab5b108b1d3b6b9871ca00c762464b60701
MD5 1ec85b4d25937dcbeff1c35b7fa5c6bc
SHA1 e782b747b88450957391619b376abf98f11f7aa3
SHA512 95ded5456a7ce6fb3af391bc859cfb1d964e718d3540cc29c5f1288550f109fc12dbbcf9ffff923cd486f23bd90d5f2020e7d580724fe445480be09a1f173573
SSDEEP 96:gbm4F7JXJz25t3g3n0JK4F7JXJz25t3g3n0J84F7JXJz25t3g3n0Jwu1oH:UF95q5t3g3SnF95q5t3g3SVF95q5t3gL
TLSH
T11BB1875B03502BA31BE227E26A55ADC8744CD07E3F332D0618AAE3989F6B12DD5B7C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DO_NOT_EDIT.txt

Path C:\Program Files\Windhawk\UI\resources\app\extensions\windhawk\webview\locales\de\DO_NOT_EDIT.txt
Size 176B
SHA256 46cf50bf090de247776fbf1c7ff10936a2e2b65e8127ea7854292068204d893a
MD5 60fb4341f7453f2b539a34c7c676ffa5
SHA1 4089f43f516294bdf40727c051629eb54e83e644
SHA512 4e174bc700c4f2686f1f2ac8d5272992e73cce3a7dcb1e4420310be322ad5bb6d3fa4ea7a7d29302b6dfa0083a92c358ae975a79f43f41a57238115e43de37e9
TLSH
T1F4C0C0D0301045E3081023C07F40C3B9AE3B505CC36D044632050C0943124270FBFC31
MD5 SHA1 SHA512 TLSH

Submit Download

processExplorer.js

Path C:\Program Files\Windhawk\UI\resources\app\out\vs\code\electron-sandbox\processExplorer\processExplorer.js
Size 42KB
SHA256 b5e31fcdc54694d52b1955c2d57134bbd8b0f9f0b2ce28de5b9a9b92eaab19a4
MD5 fc848a0f835f1bdd835ea2efd680cca0
SHA1 751ba7ee0e9740557981b670502b10a8ca38f41b
SHA512 03bc050c287d7948d350fff8ba25d3e75903fe27b2f89faba3b7d40487b2e70c93bf50c39c61cbab3a8d54d5221c85a1cc50d1c5443b5e80e8e3fba91ba73607
SSDEEP 768:8xKLm6CGQGy9SKeKhucZ3oXUAHXSE+QwJZMbEFxToqrg2DOA6eCJQ5ZezNhq0WER:MEfQVQs9TJDbFEK7xe
TLSH
T1F213E7CAB3A574234397B4E4D07F401BA7BAD669500C8428B20DD9DD2CBD98AA537F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

letterpress-hcLight.svg

Path C:\Program Files\Windhawk\UI\resources\app\out\vs\workbench\browser\parts\editor\media\letterpress-hcLight.svg
Size 4KB
SHA256 0602eb49509d57434b724afed57b1f2dcbb8b78a731e38ed8eb61aaf75c6397b
MD5 70ab425ac6de0c114b7b57b180a73219
SHA1 e8612a2c34c219d543f79486e1c5c10d581f084d
SHA512 ee762d3656cb2851d3cf116c1dcdd2b58dedfece1784166bd27741e4f6ca52dcfa6599436bc7a060fdcc149aa71802d1163b9f90a7bc789eebc8bebaeaed4453
SSDEEP 96:g7oy0k443xmg38oqooTP9vJ8gIbixBpHLfov/LQnXxg9gcwmd:fkPx9bRoTP9vJ8gIGHW/MnjcwY
TLSH
T1509198C9DBB472B4AAC657BDA1344C5D7E5374BD27318B28C27C9A84A683E5CC7488C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windhawk.exe

Path C:\Program Files\Windhawk\windhawk.exe
Size 815KB
SHA256 52db87dee0160a13cf51e31bee6320da09767582f1f359f8cf9a787d1228bf44
MD5 fee446a7a51556046a5979ef2e983182
SHA1 b13a3e2e666cbfee618a13025fb81759fbf41320
SHA512 2d767fff8c67418af355ba4766d3cd37b5672726276b82cb6474cd6083e43110f46921881b847f32e09a15a052d04fa03f1f8fe10a3c8a98db1790570c5bad23
SSDEEP 24576:YJPq5oUkIxqujKeT/Zvdp/Lrk6jBqmuN0x:YAoUkI4ujKeT/ZvTDrHjBqmu2x
TLSH
T1F9054911779AC039E6B226B099399BA6453EBC717B76DCCB23C4796D48306E15E30B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windhawk.ini

Path C:\Program Files\Windhawk\windhawk.ini
Size 314B
SHA256 57feabeb0b89b91fa67c66101bef23227ee935e15f9e595449adfb3fd35e8994
MD5 661364fcb00857ec69e7dc53d6503239
SHA1 6b9be16e7bc20ef954209bf615432a27ce31a6ea
SHA512 a227e5c68830598a6ec0c8985f9eb5caee51eba66eaa850a79e6363a43945086e243f22e436213f95f6796a46b4288f1922292a51b02bcf01340b98dcc49cf75
TLSH
T188E0171737E5001CF1F72E85FBB59430C336F9242A48D94C20D4824D84F15D048073B3
MD5 SHA1 SHA512 TLSH

Submit Download

Windhawk.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windhawk.lnk
Size 1KB
SHA256 27e1bea7827a0c5f55f1c7a08a8d9c8fc65b19baa47e1c600d048cc39432c4ba
MD5 46ce355e7bac80cccfa75a0de1aa7eb6
SHA1 45e50071f1d981bdf1f6082d21006b48008d6b2e
SHA512 2ae2bcf65692d3dcbd4a84c4e30ea20801922882cf20ae15387c86f3f19dde3538c08cc52215fb1cd91452be0dd862abb5b85423b50248743f76da083d17f8ba
TLSH
T19F3156506BD55B0DE2F38AB259B177218632B868F52983CF41C982C95CA9310E91DEF7
MD5 SHA1 SHA512 TLSH

Submit Download

Windhawk.lnk~RFe5a93e5.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windhawk.lnk~RFe5a93e5.TMP
Size 1KB
SHA256 46036368986b61051d6659c3a53f3d8d083ab7d9242a1f533a8297020696bca6
MD5 7c2cd261f75c3944a5d56701e3e90772
SHA1 3091da5ff95a81d8749cbcd01b471c3b5cd3e466
SHA512 cfee3ac2f33340f8bacbc8cf693bcc2f29c7572ca5ed15ea5584dfc802ca9017993756cc77dbbd27f338c76a1bcbad6c9fb3b974bf2ce116521abb8d1cf6d40e
TLSH
T1723157502BD55B1DE2F38AB119B177208733F868EA2953CF41C982C45CA5300E919EF3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\ProgramData\Windhawk\EditorWorkspace\.vscode\settings.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\ProgramData\Windhawk\EditorWorkspace\.vscode\settings.json
Size 132B
SHA256 212bf7f1772994c8399eaacee875d378e3ac263e6a4950d117666a4f1dce4f08
MD5 dba8585757015ec118827534ea6b9a93
SHA1 0caa2c4753afd6e61e5aafe74f2e3e75671c2e8e
SHA512 bcc5263c683b149f8c0f7f638c5cfff6e18d39ca83685998b28c43e864020de124047061f614c630e278157b28fe8e4eebbbf673e0493f904adafa506ca11ce7
TLSH
T191C09228E01128BF08B63258B10899B5A7242962E3410B03B1BEC72A2BF07F22220CE0
MD5 SHA1 SHA512 TLSH

Submit Download

libunwind.whl

Path C:\ProgramData\Windhawk\Engine\Mods\64\libunwind.whl
Size 211KB
SHA256 6e6d1e74d17ee361b3f3661faa3d07fa7597257df1cd3dd360719222e54aa36c
MD5 30a2d4c1be541c3e7b15f25b07f710b3
SHA1 6039918e2df8935ba3e8c8811d39855ef7824cb3
SHA512 05e5e1926052000138bf87dc76020fc6a868da102b9978c9ba75766fed764f5b490b09d4195f8234778c82c7ae0c91ac43723c00af6cc60991252656087d8aae
SSDEEP 1536:B/OQPJIbKEP1Qs7WdfVf/HrJW5hsfhmMHU3jXvLmbAY2j8SCmQ2FIeXi2MIL80Yl:B/OQPJIbj1lydtXavKwBl3FvXitIAJz
TLSH
T1C7244B4A97D1DE7BC91182328CA70718BB35E4911B439FCB2F0811797F637D8AE76A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\ProgramData\Windhawk\UIData\extensions\extensions.json
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_4lnu1whg.slr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4lnu1whg.slr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

AccessControl.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5A81.tmp\AccessControl.dll
Size 15KB
SHA256 5fd5d8aec97cffaad9b7df6371b348d436cf1401e86fab614dc4cb8575428e52
MD5 d74bb4447af48da081c7d9b499f3a023
SHA1 dadf6e140e6fd8e49a1851cc144bb022e0adb185
SHA512 9a15de5c6b08914f5e5bbc1c318fb0e84da28a316cf51ccddca8dfb64cd67b7ad06acac307b41d5086a0740055d327007ff890807d6853bb2e767179a3b3d758
SSDEEP 192:0hdGZ2E0hm+Gc7ROMzCPvXWROt086dXHGrEKcDDi0b5ZsgMgiCXyo1Fp01eLLuIt:0hdGZ2E0YWV2908oj21ILud8
TLSH
T1B362A6124FF90BFEF1F16B352AB5553303A2B50124B1C21D5B91CE9A2831B9B5D74327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApplicationID.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5A81.tmp\ApplicationID.dll
Size 198KB
SHA256 f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
MD5 91c2e2f34b5bba068e9a6178e13a4e5c
SHA1 affcac00894c9afd152e55d0bff7899349edcd6c
SHA512 ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
SSDEEP 3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy
TLSH
T1B8149F11B491C172D1BF16340979DAA65A3C7D600BA88AEFA7D84D3E4F781C06B31BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5A81.tmp\INetC.dll
Size 25KB
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
TLSH
T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5A81.tmp\LangDLL.dll
Size 5KB
SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
MD5 4b8a750993567ac9a350ba9768fabfa0
SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
TLSH
T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SimpleSC.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5A81.tmp\SimpleSC.dll
Size 1.1MB
SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
MD5 7b89329c6d8693fb2f6a4330100490a0
SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
TLSH
T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5A81.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5A81.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5A81.tmp\nsExec.dll
Size 7KB
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nst5A81.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Windhawk.lnk

Path C:\Users\Public\Desktop\Windhawk.lnk
Size 1KB
SHA256 54c956e7b3619c5314f349a8963f5a684f7fdc11f9c1913a70fe01db426504d5
MD5 d28146d500dc5f983a8264a0843e0d39
SHA1 57765837fffbdbacc2fa14bd2244c7f595e4a9ab
SHA512 cbeb94bdd0158e47f4b819e7ff5e72e47e9e0403ced7f44a9df805e2cada7b44660152eafa92b47d2dfb6e71b88d85d1ebab12dd8939bf0915832be09dc7367b
TLSH
T1FC3178506FD5471EE2F38AB259B177218632B868F52982CF41CDC2C55C65310D91DAF7
MD5 SHA1 SHA512 TLSH

Submit Download

Windhawk.lnk~RFe5a93f4.TMP

Path C:\Users\Public\Desktop\Windhawk.lnk~RFe5a93f4.TMP
Size 1KB
SHA256 412d4a8b8840521dae7e8f5aead6478a58cf16ee882c257eb226c5482365b054
MD5 ca41d6b0686d2b4634beeb9a8e3c2266
SHA1 b6fc6fdaee36c044fadf877fe6b93d5b9fd6ecec
SHA512 5652fe00a65ee92a1491091733446f1a4667c00a1ad59f664eb7e59b6cd2e1f39a679f9196fc75d5b21eef995948125023b0d6995e14a6371ccc2dc0a3a6f1a6
TLSH
T1883127501BD5461DE2F38AB559B167208633F868E92952CF41C982C45C65310D919AF7
MD5 SHA1 SHA512 TLSH

Submit Download

WindhawkRunUITask

Path C:\Windows\System32\Tasks\WindhawkRunUITask
Size 2KB
SHA256 10b198979ca99ca5bb387af5684014227687a00cf9e0ff71ea8a0ccfcf8250fc
MD5 c5a8c610ef39cca87d8eb9c43b85184d
SHA1 059446b83be2ada64e91e7b86b51dc55bfdd1355
SHA512 1c0f5a36df78d5734ee139138b903dbdf85108d7b78abc76cdb1afd528103fba514e403404bff2eef9b7ad7f115b5b365cf1767377ed56d22fc27de175df3a31
TLSH
T1EE512A5367EA1109F2F75B6CBEB620618EA7BC555D38C46D00AC240DCBF7E2289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/620-18060-0x0000000016040000-0x0000000016041000-memory.dmp

Download

memory/620-18064-0x00007FFA24650000-0x00007FFA24660000-memory.dmp

Download

memory/784-18065-0x0000000018070000-0x0000000018071000-memory.dmp

Download

memory/876-18067-0x000000001F240000-0x000000001F241000-memory.dmp

Download

memory/940-18069-0x0000000039100000-0x0000000039101000-memory.dmp

Download

memory/992-18236-0x00000000315C0000-0x00000000315C1000-memory.dmp

Download

memory/1012-18071-0x000000000F510000-0x000000000F511000-memory.dmp

Download

memory/1032-18073-0x000000001DD40000-0x000000001DD41000-memory.dmp

Download

memory/1104-18075-0x00000000221D0000-0x00000000221D1000-memory.dmp

Download

memory/1112-18077-0x0000000001530000-0x0000000001531000-memory.dmp

Download

memory/1124-18079-0x000000000F7E0000-0x000000000F7E1000-memory.dmp

Download

memory/1196-18081-0x0000000008E50000-0x0000000008E51000-memory.dmp

Download

memory/1220-18083-0x0000000036140000-0x0000000036141000-memory.dmp

Download

memory/1256-18238-0x0000000038FE0000-0x0000000038FE1000-memory.dmp

Download

memory/1292-18085-0x0000000038970000-0x0000000038971000-memory.dmp

Download

memory/1300-18087-0x0000000033F30000-0x0000000033F31000-memory.dmp

Download

memory/1356-18089-0x000000002AA90000-0x000000002AA91000-memory.dmp

Download

memory/1396-18091-0x000000003C500000-0x000000003C501000-memory.dmp

Download

memory/1516-18093-0x000000003EDF0000-0x000000003EDF1000-memory.dmp

Download

memory/1552-18095-0x000000002CCD0000-0x000000002CCD1000-memory.dmp

Download

memory/1688-18097-0x0000000023550000-0x0000000023551000-memory.dmp

Download

memory/1708-18099-0x0000000037C30000-0x0000000037C31000-memory.dmp

Download

memory/1812-18101-0x0000000022390000-0x0000000022391000-memory.dmp

Download

memory/1852-18111-0x0000000003770000-0x0000000003771000-memory.dmp

Download

memory/1860-18103-0x0000000010280000-0x0000000010281000-memory.dmp

Download

memory/1900-18105-0x0000000027B90000-0x0000000027B91000-memory.dmp

Download

memory/1916-18107-0x000000002C960000-0x000000002C961000-memory.dmp

Download

memory/1980-18113-0x0000000035710000-0x0000000035711000-memory.dmp

Download

memory/2020-18109-0x0000000031220000-0x0000000031221000-memory.dmp

Download

memory/2088-18163-0x0000000022370000-0x0000000022371000-memory.dmp

Download

memory/2100-18115-0x000000003D430000-0x000000003D431000-memory.dmp

Download

memory/2148-18139-0x0000000019B30000-0x0000000019B31000-memory.dmp

Download

memory/2168-18141-0x0000000007450000-0x0000000007451000-memory.dmp

Download

memory/2300-18143-0x00000000359B0000-0x00000000359B1000-memory.dmp

Download

memory/2348-18145-0x000000003D230000-0x000000003D231000-memory.dmp

Download

memory/2536-18147-0x0000000013CB0000-0x0000000013CB1000-memory.dmp

Download

memory/2576-18149-0x0000000033110000-0x0000000033111000-memory.dmp

Download

memory/2584-18151-0x00000000325C0000-0x00000000325C1000-memory.dmp

Download

memory/2696-18153-0x000000002BB80000-0x000000002BB81000-memory.dmp

Download

memory/2704-18155-0x0000000028490000-0x0000000028491000-memory.dmp

Download

memory/2760-18157-0x000000001E1B0000-0x000000001E1B1000-memory.dmp

Download

memory/2772-18159-0x000000003CD50000-0x000000003CD51000-memory.dmp

Download

memory/2856-18165-0x00000000377D0000-0x00000000377D1000-memory.dmp

Download

memory/3068-18161-0x0000000026B40000-0x0000000026B41000-memory.dmp

Download

memory/3176-18167-0x000000001E6C0000-0x000000001E6C1000-memory.dmp

Download

memory/3224-18330-0x00000000055D0000-0x0000000005BF8000-memory.dmp

Download

memory/3224-18365-0x0000000005DB0000-0x0000000005DD2000-memory.dmp

Download

memory/3224-18451-0x0000000006AC0000-0x0000000006ADA000-memory.dmp

Download

memory/3224-18450-0x0000000007EE0000-0x000000000855A000-memory.dmp

Download

memory/3224-18381-0x00000000065D0000-0x000000000661C000-memory.dmp

Download

memory/3224-18380-0x0000000006590000-0x00000000065AE000-memory.dmp

Download

memory/3224-18377-0x00000000060A0000-0x00000000063F4000-memory.dmp

Download

memory/3224-18368-0x0000000005F30000-0x0000000005F96000-memory.dmp

Download

memory/3224-18324-0x0000000002BE0000-0x0000000002C16000-memory.dmp

Download

memory/3224-18367-0x0000000005E50000-0x0000000005EB6000-memory.dmp

Download

memory/3264-18234-0x000000000E310000-0x000000000E311000-memory.dmp

Download

memory/3272-18169-0x0000000000E00000-0x0000000000E01000-memory.dmp

Download

memory/3392-18171-0x000000001F720000-0x000000001F721000-memory.dmp

Download

memory/3440-18240-0x0000000033200000-0x0000000033201000-memory.dmp

Download

memory/3576-18173-0x0000000022E60000-0x0000000022E61000-memory.dmp

Download

memory/3668-18175-0x0000000012020000-0x0000000012021000-memory.dmp

Download

memory/3728-18177-0x000000000DC90000-0x000000000DC91000-memory.dmp

Download

memory/3812-18223-0x000000002A700000-0x000000002A701000-memory.dmp

Download

memory/3904-18242-0x0000000020E60000-0x0000000020E61000-memory.dmp

Download

memory/4016-18226-0x0000000001920000-0x0000000001921000-memory.dmp

Download

memory/4236-18230-0x0000000026520000-0x0000000026521000-memory.dmp

Download

memory/4504-18228-0x00000000297C0000-0x00000000297C1000-memory.dmp

Download

memory/4956-18232-0x000000000EAA0000-0x000000000EAA1000-memory.dmp

Download

memory/5004-18041-0x0000000005740000-0x000000000585C000-memory.dmp

Download

memory/5004-6715-0x00000000031B0000-0x0000000003213000-memory.dmp

Download

memory/5004-39-0x00000000031B0000-0x0000000003213000-memory.dmp

Download

memory/5004-22-0x00000000031B0000-0x0000000003213000-memory.dmp

Download

memory/5004-20-0x00000000031B0000-0x0000000003213000-memory.dmp

Download

memory/5004-15-0x00000000031B0000-0x0000000003213000-memory.dmp

Download