Overview

overview

7

Static

static

1

GearUP-2.6...gq.exe

windows11-21h2-x64

7

Resubmissions

11/05/2026, 00:41

260511-a116pagy4w6

11/05/2026, 00:18

260511-allgpagx2x7

11/05/2026, 00:07

260511-aelh4sgv5v6

Analysis

  • user interaction
    yes
  • max time kernel
    1034s
  • max time network
    1034s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    11/05/2026, 00:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    GearUP-2.66.0-discord-Iacaj7gq.exe
  • Size 33.7MB
  • Sample260511-allgpagx2x
  • SHA256 ca96ec9e8d0ad79abbf6a48e69518236544ac0cc7afd0a6c8864d9045599a318
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarebootkitdefense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Downloads MZ/PE file 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 53 IoCs
  • Loads dropped DLL 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 6 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 24 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 59 IoCs
  • Modifies registry key 1 TTPs 10 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: LoadsDriver 7 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 62 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GearUP-2.66.0-discord-Iacaj7gq.exe
    "C:\Users\Admin\AppData\Local\Temp\GearUP-2.66.0-discord-Iacaj7gq.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious use of WriteProcessMemory
    PID:2804
    • C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe
      "C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe" x "C:\Program Files (x86)\GearUP\gearup_booster_temp\gearup_booster.zip" -o"C:\Program Files (x86)\GearUP\" -aoa
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4240
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c rd /s /q "C:\Program Files (x86)\GearUP\gearup_booster_temp\"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5856
    • C:\Program Files (x86)\GearUP\launcher.exe
      "C:\Program Files (x86)\GearUP\launcher.exe" /install_shortcut 1 /install_autorun 0 /install_id 愶㄰〲㌸昹㔲愶愰〷挰〲晢
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1244
      • C:\Program Files (x86)\GearUP\9253\gearup_booster.exe
        "C:\Program Files (x86)\GearUP\9253\gearup_booster.exe" /install_shortcut 1 /install_autorun 0 /install_id 愶㄰〲㌸昹㔲愶愰〷挰〲晢
        3⤵
        • Writes to the Master Boot Record (MBR)
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:5632
        • C:\Program Files (x86)\GearUP\9253\crashpad_handler.exe
          "C:\Program Files (x86)\GearUP\9253\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --url=https://sentry.guinfra.com:443/api/30/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=e59bef2d0cf245eaa0d97f08c5eab5fe --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_proxy.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_tun.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_lsp.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\ae4d3755-f741-4745-4c22-103eb85598b1.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\ae4d3755-f741-4745-4c22-103eb85598b1.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\ae4d3755-f741-4745-4c22-103eb85598b1.run\__sentry-breadcrumb2 --initial-client-data=0x47c,0x480,0x484,0x458,0x488,0x73865160,0x73865174,0x73865184
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2328
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c wmic csproduct get uuid
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2976
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic csproduct get uuid
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2848
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --lang=en --mojo-named-platform-channel-pipe=5632.3020.16796719758512134530
          4⤵
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of WriteProcessMemory
          PID:4164
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffb70c7b078,0x7ffb70c7b084,0x7ffb70c7b090
            5⤵
              PID:3236
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1676,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=1656 /prefetch:2
              5⤵
                PID:3308
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1988,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:11
                5⤵
                  PID:3096
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2264,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:13
                  5⤵
                    PID:5736
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3404,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
                    5⤵
                      PID:5048
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3836,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
                      5⤵
                        PID:4976
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4000,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:1
                        5⤵
                          PID:4880
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4036,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
                          5⤵
                            PID:3360
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5124,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
                            5⤵
                              PID:6916
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4304,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
                              5⤵
                                PID:2672
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5168,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:10
                                5⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3684
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4736,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
                                5⤵
                                  PID:4996
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5100,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
                                  5⤵
                                    PID:7024
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5364,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
                                    5⤵
                                      PID:6660
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5404,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
                                      5⤵
                                        PID:6588
                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5576,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
                                        5⤵
                                          PID:8152
                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5684,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
                                          5⤵
                                            PID:6728
                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5328,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
                                            5⤵
                                              PID:812
                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4544,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
                                              5⤵
                                                PID:2816
                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5472,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
                                                5⤵
                                                  PID:6160
                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4684,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
                                                  5⤵
                                                    PID:6628
                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5360,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
                                                    5⤵
                                                      PID:6940
                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5692,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
                                                      5⤵
                                                        PID:796
                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5636,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
                                                        5⤵
                                                          PID:4400
                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5628,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
                                                          5⤵
                                                            PID:6232
                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5552,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
                                                            5⤵
                                                              PID:4932
                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=6040,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
                                                              5⤵
                                                                PID:6952
                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5712,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
                                                                5⤵
                                                                  PID:4564
                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=6072,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
                                                                  5⤵
                                                                    PID:6596
                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5900,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
                                                                    5⤵
                                                                      PID:6996
                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5616,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
                                                                      5⤵
                                                                        PID:3592
                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.66.0.15 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5244,i,14369960170117687674,4601155832150032805,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
                                                                        5⤵
                                                                          PID:1848
                                                                      • C:\Program Files (x86)\GearUP\9253\gearup_ball.exe
                                                                        C:\Program Files (x86)\GearUP\9253\gearup_ball.exe /main_form_wnd 393298 /show_flag 0 /pos_x -1 /pos_y -1 /version 9253 /client_id 6a01208acbbd07144c0288e6 /gray 0
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SendNotifyMessage
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:6080
                                                                        • C:\Program Files (x86)\GearUP\9253\crashpad_handler.exe
                                                                          "C:\Program Files (x86)\GearUP\9253\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball --url=https://sentry.guinfra.com:443/api/133/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=617dd3108af34ecb8ee616e78b9e2adf --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\04d3a530-9bd7-4406-5c89-a10dee03038d.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\04d3a530-9bd7-4406-5c89-a10dee03038d.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\04d3a530-9bd7-4406-5c89-a10dee03038d.run\__sentry-breadcrumb2 --initial-client-data=0x460,0x464,0x468,0x43c,0x46c,0x73865160,0x73865174,0x73865184
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:6016
                                                                      • C:\Program Files (x86)\GearUP\9253\7za.exe
                                                                        "C:\Program Files (x86)\GearUP\9253\7za.exe" x "C:\Users\Admin\AppData\Local\Temp\GU6FAD.tmp\UU_9254_202f1b1e0d3d22c40b4d567c4fc31034_28507736.7z" -o"C:\Program Files (x86)\GearUP\" -aoa
                                                                        4⤵
                                                                        • Drops file in Program Files directory
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3340
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://win.booster.gearupportal.com/login/google/0Wbjf4s1ZJa1amCvjstmDzAc3LKWyILdIzgrawt1URN3oeFX5BskcejLVhqLhrI5?channel=discord
                                                                        4⤵
                                                                          PID:3520
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://win.booster.gearupportal.com/login/google/0Wbjf4s1ZJa1amCvjstmDzAc3LKWyILdIzgrawt1URN3oeFX5BskcejLVhqLhrI5?channel=discord
                                                                            5⤵
                                                                            • Drops file in Windows directory
                                                                            • Enumerates system info in registry
                                                                            • Modifies data under HKEY_USERS
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            PID:4428
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7ffb6aa2c188,0x7ffb6aa2c194,0x7ffb6aa2c1a0
                                                                              6⤵
                                                                                PID:5108
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,15714080040762094526,7104757062079016322,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
                                                                                6⤵
                                                                                • System Time Discovery
                                                                                PID:1104
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,17456628343956693460,10922651215415734786,262144 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
                                                                                6⤵
                                                                                  PID:1380
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,1953836296904620061,9715761559613578291,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
                                                                                  6⤵
                                                                                    PID:1056
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,2367173294745534754,13863686942213277643,2097152 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
                                                                                    6⤵
                                                                                      PID:3564
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,12872537046334434983,10750216441895519898,2097152 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
                                                                                      6⤵
                                                                                        PID:6364
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4872,i,210476119996138926,3641295732265340168,2097152 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
                                                                                        6⤵
                                                                                          PID:6656
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3576,i,11253749210108406122,13101609632620506574,2097152 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
                                                                                          6⤵
                                                                                            PID:1476
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,1472415649041596691,10871343750417711041,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:12
                                                                                            6⤵
                                                                                              PID:5232
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,9319771541629333952,10608315121761447904,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
                                                                                              6⤵
                                                                                              • Modifies registry class
                                                                                              PID:1076
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,17287967689378271546,2993463483770682487,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
                                                                                              6⤵
                                                                                                PID:6396
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,1024603709164852160,11814630789357777008,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
                                                                                                6⤵
                                                                                                  PID:6952
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,3071041473812742917,2461431494283824202,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
                                                                                                  6⤵
                                                                                                    PID:2456
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,5903075774497168845,3434729180380726086,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
                                                                                                    6⤵
                                                                                                      PID:6816
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                                                                        cookie_exporter.exe --cookie-json=1132
                                                                                                        7⤵
                                                                                                          PID:7176
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,3071041473812742917,2461431494283824202,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
                                                                                                        6⤵
                                                                                                          PID:1980
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,14490206419058916474,8147639751892658798,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
                                                                                                          6⤵
                                                                                                            PID:7412
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,9715529736866735473,5474176945405222363,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
                                                                                                            6⤵
                                                                                                              PID:7424
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,1436500233131393961,337603317822893933,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
                                                                                                              6⤵
                                                                                                                PID:7432
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,4164727995763737031,10356340810004848478,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
                                                                                                                6⤵
                                                                                                                  PID:7680
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,924162030645775774,138472927675300564,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
                                                                                                                  6⤵
                                                                                                                    PID:6268
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6876,i,4166572617201792295,4765869138398305258,2097152 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
                                                                                                                    6⤵
                                                                                                                      PID:7892
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6964,i,11451989296716662595,10270016772752975191,2097152 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
                                                                                                                      6⤵
                                                                                                                        PID:7956
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,14907834756736284955,1619557202402169744,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:14
                                                                                                                        6⤵
                                                                                                                          PID:7184
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=2916,i,17036104896840400735,7115353794440240614,2097152 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
                                                                                                                          6⤵
                                                                                                                            PID:7604
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,12900173465999211568,8729219986858531701,524288 --field-trial-handle=2188,i,3738105101073498143,693247753494215947,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
                                                                                                                            6⤵
                                                                                                                              PID:7300
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                                                              6⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Enumerates system info in registry
                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                              • Modifies registry class
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              PID:8108
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffb6aa2c188,0x7ffb6aa2c194,0x7ffb6aa2c1a0
                                                                                                                                7⤵
                                                                                                                                  PID:8104
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,8588273668712943314,17040209312023922571,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:11
                                                                                                                                  7⤵
                                                                                                                                  • System Time Discovery
                                                                                                                                  PID:6560
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,13869523560951382596,908163048856939856,262144 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
                                                                                                                                  7⤵
                                                                                                                                    PID:7496
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,13151597901584523846,13951964428234153315,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:13
                                                                                                                                    7⤵
                                                                                                                                      PID:7324
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,14028437229715385239,5413521769191826230,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
                                                                                                                                      7⤵
                                                                                                                                        PID:6244
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,14028437229715385239,5413521769191826230,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
                                                                                                                                        7⤵
                                                                                                                                          PID:5064
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,9668900250129194773,7493612607544450903,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
                                                                                                                                          7⤵
                                                                                                                                            PID:7008
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,7963288718801594150,3801018408935804730,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
                                                                                                                                            7⤵
                                                                                                                                              PID:7000
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,2636743135383032112,4165516331710462909,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
                                                                                                                                              7⤵
                                                                                                                                                PID:8060
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,1584324270228968398,17133088147849544336,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
                                                                                                                                                7⤵
                                                                                                                                                  PID:5232
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,6466905903849244781,7536401858789861439,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
                                                                                                                                                  7⤵
                                                                                                                                                    PID:1056
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,18155473085089685433,313617312466885986,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
                                                                                                                                                    7⤵
                                                                                                                                                      PID:7476
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,3347257158774677025,14048525692079000076,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
                                                                                                                                                      7⤵
                                                                                                                                                        PID:1712
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5192,i,16821227811025396715,9561215787705844240,262144 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:10
                                                                                                                                                        7⤵
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        PID:5568
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,2340238913720127586,10094899342450843949,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
                                                                                                                                                        7⤵
                                                                                                                                                          PID:7208
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3336,i,11429445089907774527,7897114312637562174,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14
                                                                                                                                                          7⤵
                                                                                                                                                            PID:5272
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4072,i,4730151176520581842,5919653807536533799,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:14
                                                                                                                                                            7⤵
                                                                                                                                                              PID:7564
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,4976117895587604597,5702783057054698835,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
                                                                                                                                                              7⤵
                                                                                                                                                                PID:7804
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,12407698055040650761,12729582740519601052,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:4848
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,1057557033458529206,1798494584034017098,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:14
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:8136
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,13451676418464606489,2815459239586837029,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:14
                                                                                                                                                                    7⤵
                                                                                                                                                                      PID:3428
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,14520927221556726622,7459035161838147096,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:14
                                                                                                                                                                      7⤵
                                                                                                                                                                        PID:6412
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3280,i,4674032580656044936,9148221254397198510,524288 --field-trial-handle=2172,i,1723365256389993028,14930786609148063867,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
                                                                                                                                                                        7⤵
                                                                                                                                                                          PID:4804
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://activity.booster.gearupportal.com/discord/login/EaeLbJQPRZC7tXamD6z5w4eSYXjPWiFjL18pZfRhacZ03PcVHNzPzOPmii5zoHy6
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:7312
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9200c728,0x7ffb9200c734,0x7ffb9200c740
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:7356
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://activity.booster.gearupportal.com/discord/login/ZONxHM7OVzIZ3ymdRCIZGNMivppaChGHQ1PF5esVtVryXL8AMIxFS2kBjzCU2kI8
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:2072
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9200c728,0x7ffb9200c734,0x7ffb9200c740
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:6156
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" https://activity.booster.gearupportal.com/discord/login/SNca4Es4qv8skjp8P2tCEr0SmaWhhjtTrQR7gL4FX2DZbGZJZybF1c4xk4of4OEc
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                            PID:6780
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9200c728,0x7ffb9200c734,0x7ffb9200c740
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:6152
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1960,i,1634782714692641857,15607583035170634785,524288 --field-trial-handle=2028,i,8346216972006509836,443826438507940259,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=2052 /prefetch:11
                                                                                                                                                                                5⤵
                                                                                                                                                                                • System Time Discovery
                                                                                                                                                                                PID:4812
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,15312225157489853697,9354825721974969277,262144 --field-trial-handle=2028,i,8346216972006509836,443826438507940259,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=2024 /prefetch:2
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:5276
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,9961023962216460573,18040307774989898971,524288 --field-trial-handle=2028,i,8346216972006509836,443826438507940259,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=2512 /prefetch:13
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:3740
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,2211793778645039164,14296393094290104830,2097152 --field-trial-handle=2028,i,8346216972006509836,443826438507940259,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=3244 /prefetch:1
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:4648
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,15441085033343180493,6394923113588901579,2097152 --field-trial-handle=2028,i,8346216972006509836,443826438507940259,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=3264 /prefetch:1
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:3736
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,8246403873132294627,7825305761743937214,2097152 --field-trial-handle=2028,i,8346216972006509836,443826438507940259,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=4440 /prefetch:1
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:7416
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4660,i,12556800381365582332,2731456001944714105,524288 --field-trial-handle=2028,i,8346216972006509836,443826438507940259,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=4712 /prefetch:14
                                                                                                                                                                                          5⤵
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          PID:8096
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4672,i,12867301374681243960,11604657831547125967,524288 --field-trial-handle=2028,i,8346216972006509836,443826438507940259,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=4692 /prefetch:12
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:8176
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,16457045970623091230,17282188796156381470,524288 --field-trial-handle=2028,i,8346216972006509836,443826438507940259,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=5324 /prefetch:14
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:4332
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5328,i,8174130979759643074,15112994060088833144,2097152 --field-trial-handle=2028,i,8346216972006509836,443826438507940259,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=5656 /prefetch:1
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:4180
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,10826994701461871684,16829904410990172744,524288 --field-trial-handle=2028,i,8346216972006509836,443826438507940259,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=3344 /prefetch:14
                                                                                                                                                                                                5⤵
                                                                                                                                                                                                  PID:5012
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3356,i,3788651139529446724,4594133326843879400,524288 --field-trial-handle=2028,i,8346216972006509836,443826438507940259,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=3332 /prefetch:14
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:1588
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3388,i,17820648304835531053,18362866569852508907,524288 --field-trial-handle=2028,i,8346216972006509836,443826438507940259,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=5844 /prefetch:14
                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                      PID:4452
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://activity.booster.gearupportal.com/discord/login/h1cCHi9dBC8aieBOa6aLt9NdCpYcKYoXChr5vEqPbLWTkYVfku53WExK8D1tqC2h
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                    PID:1056
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9200c728,0x7ffb9200c734,0x7ffb9200c740
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:5744
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1800,i,3581975354200849561,8199512168148444618,524288 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=2056 /prefetch:11
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                        • System Time Discovery
                                                                                                                                                                                                        PID:960
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1568,i,2973925045465053411,15301779870825188533,262144 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=2020 /prefetch:2
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:5932
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,8371535437706037754,1817609325579335567,524288 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=2540 /prefetch:13
                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                            PID:7400
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,1312279528993379201,14642031937101397559,2097152 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=3240 /prefetch:1
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:2936
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,8472611127731744399,5919660267611101759,2097152 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=3304 /prefetch:1
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:4804
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,8918879200491353334,5829159496009304674,2097152 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=4496 /prefetch:1
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:3452
                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4812,i,17050753952694145760,8634214329511131738,524288 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=4832 /prefetch:12
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:4692
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4792,i,15205113790106649239,10889506264890156332,524288 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=4852 /prefetch:14
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    PID:2556
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,1688882615724278320,160936567864445647,524288 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=5468 /prefetch:14
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:2604
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5748,i,15236271438810893682,15702359796612497727,2097152 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=5696 /prefetch:1
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:6104
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5848,i,1103859864186528641,5121624642843984740,2097152 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=5500 /prefetch:1
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:4596
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6072,i,12966866172874890112,295198934678521362,2097152 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=6028 /prefetch:1
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:2368
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,8540672268133699704,6425314688972560780,524288 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=5716 /prefetch:14
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:6528
                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,7643643299130027684,3540404722199464698,524288 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=5988 /prefetch:14
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:6304
                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,4442511682438365264,17627861147014155567,524288 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=5800 /prefetch:14
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:6332
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5384,i,18387540988020813180,8130133850358547923,2097152 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=4556 /prefetch:1
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:6348
                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4512,i,14878813204257989250,13015694227038669018,262144 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=5392 /prefetch:10
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                    PID:708
                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3484,i,11507140226372994729,6853441959855684222,2097152 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=2312 /prefetch:1
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:4768
                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3344,i,12733582586616019167,13006263301022452168,2097152 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=4468 /prefetch:1
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:7504
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5812,i,7417110894799276442,6234851061307976497,2097152 --field-trial-handle=2024,i,2315219531584532693,16254485902934718498,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=5384 /prefetch:1
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:4388
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://activity.booster.gearupportal.com/discord/login/o28Arf2bvifV0gKxko4WD4MrTA82ZIMU4m1Si9Cf0OXC45ggJHoDOLZ7iVbk6IZg
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:5724
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9200c728,0x7ffb9200c734,0x7ffb9200c740
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:2440
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                            netsh advfirewall firewall delete rule name="GearUP Booster"
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:6552
                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                      PID:5480
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9200c728,0x7ffb9200c734,0x7ffb9200c740
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:3480
                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,7178115263942442317,13157272817773223804,262144 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2004 /prefetch:2
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:444
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,5082830731524505895,12236039675447274574,524288 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2336 /prefetch:11
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Downloads MZ/PE file
                                                                                                                                                                                                                                            • System Time Discovery
                                                                                                                                                                                                                                            PID:3276
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,7715659989996899896,10248889820803304596,524288 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2432 /prefetch:13
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:3972
                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,16215633490955262194,11234347863417901818,2097152 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3500 /prefetch:1
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:5224
                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,12922758241467100121,8423604109963361886,2097152 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3536 /prefetch:1
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:5972
                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4340,i,6150523708340325725,10418865286643176085,2097152 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4416 /prefetch:9
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:5528
                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4684,i,1048836409042253951,1812477933254401543,2097152 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4732 /prefetch:1
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:908
                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,11335554766299769074,15036968019017186530,524288 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5416 /prefetch:14
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:4540
                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5892,i,16239526603524688950,16725374336224722539,2097152 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5900 /prefetch:1
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:3884
                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4688,i,14491974140598507138,17420296613905730394,2097152 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4876 /prefetch:1
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:364
                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,6426136616419760215,1234341472758102690,524288 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6068 /prefetch:12
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:4828
                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,15404445218527768581,5834031895269769508,524288 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3724 /prefetch:14
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:3044
                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3548,i,5004344331579945747,7254801924307726763,524288 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3492 /prefetch:14
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:2072
                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3552,i,12852102329125669685,14300530251810641158,524288 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3684 /prefetch:14
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:4224
                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3704,i,6703011803262218369,7238584780530761290,524288 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3700 /prefetch:14
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                                                                                                                                                    • NTFS ADS
                                                                                                                                                                                                                                                                    PID:4048
                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3716,i,2286800987892408450,5112702678032600718,262144 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5640 /prefetch:10
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                    PID:6100
                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3732,i,9654348076375798832,4563812273993852520,524288 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3260 /prefetch:14
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:8
                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4608,i,7793219398381987115,15827013480146160584,2097152 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3548 /prefetch:1
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:112
                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6460,i,550026424089425764,2860926245096469667,2097152 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6280 /prefetch:1
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:4676
                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6612,i,2546136607626959785,2434704310408645777,524288 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5860 /prefetch:14
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                          PID:6916
                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4748,i,8582416265954518885,17597381945169271939,2097152 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3880 /prefetch:1
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:6472
                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6552,i,7543981713270492256,9530071286504918082,2097152 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6504 /prefetch:1
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:7304
                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3548,i,17256236909728191224,4592579404366500779,2097152 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6560 /prefetch:1
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:1092
                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6344,i,4960491501570452187,91191381636985017,2097152 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6356 /prefetch:1
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:8032
                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6872,i,6900612214994843687,13617296845225048701,2097152 --field-trial-handle=2008,i,9278548357736984242,17558076360723018173,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3592 /prefetch:1
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:5364
                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:5652
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:4952
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:3736
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Downloads\DiscordSetup.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Downloads\DiscordSetup.exe"
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                        PID:5356
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                          PID:2036
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --squirrel-install 1.0.9236
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                            PID:4144
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9236 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x514,0x518,0x51c,0x50c,0x520,0x7ff6d531c074,0x7ff6d531c080,0x7ff6d531c090
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:1272
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Discord\Update.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:1416
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2288,i,1175689563581197338,12921131622709790109,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:6020
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2288,i,1175689563581197338,12921131622709790109,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                              PID:1500
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                              C:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                              PID:3892
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                              C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                              PID:5760
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                              C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                              PID:3428
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                              C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                              PID:1708
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                              C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe\",-1" /f
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                              PID:3824
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                              C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe\" --url -- \"%1\"" /f
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                              PID:5784
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\Update.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:4324
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                          PID:3872
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9236 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x50c,0x510,0x514,0x508,0x518,0x7ff6d531c074,0x7ff6d531c080,0x7ff6d531c090
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:5784
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1896,i,15789521565790640277,12524046198119811669,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                            PID:5148
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1896,i,15789521565790640277,12524046198119811669,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:5852
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                            C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                            PID:1240
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1896,i,15789521565790640277,12524046198119811669,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                            PID:4608
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                            C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                            PID:3428
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                            C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe\",-1" /f
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                            PID:5676
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                            C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe\" --url -- \"%1\"" /f
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                            PID:5744
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\Update.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:2580
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                          PID:6404
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9236 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x504,0x508,0x50c,0x4fc,0x510,0x7ff6d531c074,0x7ff6d531c080,0x7ff6d531c090
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:6432
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1896,i,14294033276232103876,1178951374483206767,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                            PID:752
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1896,i,14294033276232103876,1178951374483206767,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:11
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:6676
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1896,i,14294033276232103876,1178951374483206767,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:1
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                            PID:2096
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\Update.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:5200
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                          PID:6204
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9236 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x4fc,0x500,0x504,0x4f4,0x508,0x7ff6d531c074,0x7ff6d531c080,0x7ff6d531c090
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:1212
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1876,i,7039531299018336173,15850499826309456689,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                            PID:5092
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1876,i,7039531299018336173,15850499826309456689,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:5064
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1876,i,7039531299018336173,15850499826309456689,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:1
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                            PID:4920
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\Update.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:3256
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                          PID:4532
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9236 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x514,0x518,0x51c,0x50c,0x520,0x7ff6d531c074,0x7ff6d531c080,0x7ff6d531c090
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:6648
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1880,i,10171122603259348536,9838267072923523673,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:2
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                            PID:7092
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1880,i,10171122603259348536,9838267072923523673,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:6692
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1778458246812621 --launch-time-ticks=631937067 --field-trial-handle=1880,i,10171122603259348536,9838267072923523673,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:1
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:6460
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Downloads\DiscordSetup.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Downloads\DiscordSetup.exe"
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                        PID:5428
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                          PID:3160
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                        PID:668
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Downloads\DiscordSetup.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Downloads\DiscordSetup.exe"
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:2044
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                          PID:5968
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:6876
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:7640
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:8032
                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:6392
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:7564
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:8052
                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                    PID:7692
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Discord\Update.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:6444
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      PID:5268
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9236 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x518,0x51c,0x520,0x510,0x524,0x7ff6d531c074,0x7ff6d531c080,0x7ff6d531c090
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        PID:6624
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1868,i,14372818501561936547,15448662947822628369,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:2
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        PID:4660
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1868,i,14372818501561936547,15448662947822628369,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        PID:5600
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9236\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1778458246812606 --launch-time-ticks=1178272303 --field-trial-handle=1868,i,14372818501561936547,15448662947822628369,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:1
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        PID:4588
                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:6108
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:1972
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\GearUP\launcher.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\GearUP\launcher.exe"
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:4048
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\GearUP\9254\gearup_booster.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\GearUP\9254\gearup_booster.exe"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                          • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                          PID:6464
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\GearUP\9254\crashpad_handler.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\GearUP\9254\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry --url=https://sentry.guinfra.com:443/api/30/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=e59bef2d0cf245eaa0d97f08c5eab5fe --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_proxy.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_tun.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu_lsp.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\70bffefc-356c-4c11-4e3c-257ca6326659.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\70bffefc-356c-4c11-4e3c-257ca6326659.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\70bffefc-356c-4c11-4e3c-257ca6326659.run\__sentry-breadcrumb2 --initial-client-data=0x47c,0x480,0x484,0x458,0x488,0x749c5160,0x749c5174,0x749c5184
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:5644
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            cmd.exe /c wmic csproduct get uuid
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:6336
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                                                                              wmic csproduct get uuid
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:3080
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=gearup_booster.exe --webview-exe-version=2.67.0.19 --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --lang=en --mojo-named-platform-channel-pipe=6464.3184.11677488385036080909
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                                                                                                                            PID:7996
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x19c,0x7ffb70c7b078,0x7ffb70c7b084,0x7ffb70c7b090
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                PID:796
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.67.0.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1748,i,14111612595531550864,15638008293725560800,262144 --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:8140
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.67.0.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1768,i,14111612595531550864,15638008293725560800,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                    PID:4632
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.67.0.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2224,i,14111612595531550864,15638008293725560800,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:13
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:7144
                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.67.0.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3404,i,14111612595531550864,15638008293725560800,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                        PID:3176
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.67.0.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3772,i,14111612595531550864,15638008293725560800,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:7628
                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.67.0.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3940,i,14111612595531550864,15638008293725560800,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:1
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                            PID:3332
                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.67.0.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4088,i,14111612595531550864,15638008293725560800,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:1
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:1652
                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.67.0.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5048,i,14111612595531550864,15638008293725560800,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                PID:7632
                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.67.0.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5408,i,14111612595531550864,15638008293725560800,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:1156
                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView" --webview-exe-name=gearup_booster.exe --webview-exe-version=2.67.0.19 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5528,i,14111612595531550864,15638008293725560800,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                    PID:1336
                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\GearUP\9254\gearup_ball.exe
                                                                                                                                                                                                                                                                                                                                  C:\Program Files (x86)\GearUP\9254\gearup_ball.exe /main_form_wnd 590186 /show_flag 0 /pos_x -1 /pos_y -1 /version 9254 /client_id 6a012453856e9d0628d091ff /gray 0
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                  PID:348
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\GearUP\9254\crashpad_handler.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\GearUP\9254\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball --metrics-dir=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball --url=https://sentry.guinfra.com:443/api/133/minidump/?sentry_client=sentry.native/0.5.3&sentry_key=617dd3108af34ecb8ee616e78b9e2adf --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\007e7395-6f3a-45c7-eab3-518d94539893.run\__sentry-event --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\007e7395-6f3a-45c7-eab3-518d94539893.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\007e7395-6f3a-45c7-eab3-518d94539893.run\__sentry-breadcrumb2 --initial-client-data=0x470,0x474,0x478,0x448,0x488,0x749c5160,0x749c5174,0x749c5184
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:708
                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://activity.booster.gearupportal.com/discord/login/2Vhr7ZdGbffmtz8dCufw5UTkIzfke6QnUEc3rdntLqMN8kG58DFlMj4DApdoH96Z
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                  PID:1080
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9200c728,0x7ffb9200c734,0x7ffb9200c740
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:4756
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1812,i,13447438999079344014,14175984424293326290,524288 --field-trial-handle=2012,i,1087594887876654966,5660111193522775702,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=2040 /prefetch:11
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                      • System Time Discovery
                                                                                                                                                                                                                                                                                                                                      PID:2284
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1564,i,3740352046503046637,5357320857272335760,262144 --field-trial-handle=2012,i,1087594887876654966,5660111193522775702,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=2008 /prefetch:2
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                        PID:7732
                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,2452614583704922336,3461876454986548385,524288 --field-trial-handle=2012,i,1087594887876654966,5660111193522775702,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=2544 /prefetch:13
                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                          PID:1204
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,15885878870477360872,7122259381105225190,2097152 --field-trial-handle=2012,i,1087594887876654966,5660111193522775702,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=3340 /prefetch:1
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                            PID:1012
                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,6368343369255757466,10626456438059861097,2097152 --field-trial-handle=2012,i,1087594887876654966,5660111193522775702,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=3360 /prefetch:1
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                              PID:5060
                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,17227953278475758847,2731284783348893310,2097152 --field-trial-handle=2012,i,1087594887876654966,5660111193522775702,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=4484 /prefetch:1
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                PID:2252
                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3816,i,16236888521478178651,5039986768184525246,524288 --field-trial-handle=2012,i,1087594887876654966,5660111193522775702,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=4632 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                PID:3064
                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3404,i,5318831823585539760,1683584422866718894,524288 --field-trial-handle=2012,i,1087594887876654966,5660111193522775702,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=4496 /prefetch:12
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:8032
                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,2831888060198926564,7130279290507433535,524288 --field-trial-handle=2012,i,1087594887876654966,5660111193522775702,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=5348 /prefetch:14
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                    PID:6812
                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4948,i,1010401782905225595,11992598580911833476,2097152 --field-trial-handle=2012,i,1087594887876654966,5660111193522775702,262144 --variations-seed-version=20260510-030040.467000-production --mojo-platform-channel-handle=5668 /prefetch:1
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5752
                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:6268
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3564

                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                                                        Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1546

                                                                                                                                                                                                                                                                                                                                                        Netsh Helper DLL

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1546.007

                                                                                                                                                                                                                                                                                                                                                        Pre-OS Boot

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1542

                                                                                                                                                                                                                                                                                                                                                        Bootkit

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1542.003

                                                                                                                                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                                                                                                                                        Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1546

                                                                                                                                                                                                                                                                                                                                                        Netsh Helper DLL

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1546.007

                                                                                                                                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                                                                                                                                        Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1562.004

                                                                                                                                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                                                                                                                                        Pre-OS Boot

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1542

                                                                                                                                                                                                                                                                                                                                                        Bootkit

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1542.003

                                                                                                                                                                                                                                                                                                                                                        Subvert Trust Controls

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1553

                                                                                                                                                                                                                                                                                                                                                        SIP and Trust Provider Hijacking

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1553.003

                                                                                                                                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                                                                                                                                        Browser Information Discovery

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1217

                                                                                                                                                                                                                                                                                                                                                        Network Share Discovery

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1135

                                                                                                                                                                                                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1120

                                                                                                                                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                                                                                                                                        System Time Discovery

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1124

                                                                                                                                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                                                                                                                                        Web Service

                                                                                                                                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                                                                                                                                        T1102

                                                                                                                                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                        WebView2Loader.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\WebView2Loader.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 113KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4c24ade2c2a4cf652529fdf4259743fec824c628bdc056fc5c76c29e30e7c06c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        browser.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\browser.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 38KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 9c25f4fa25116542a9c16d94ababec450c6184c6e8bc3cd90f3d9dc4ed5bcc39
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        cache.data
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\cache.data
                                                                                                                                                                                                                                                                                                                                                        • Size 596KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4552c987098a9cd855f87213104e6cb742621a989b850474f10ae9625b8d2bec
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        crashpad_handler.exe
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\crashpad_handler.exe
                                                                                                                                                                                                                                                                                                                                                        • Size 853KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 80d4effa417d43821a0a0ee967a290836501edd4b6057f033c7ebc449badd150
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        crashpad_wer.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\crashpad_wer.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 36KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e4a2295cff0949d9f0a646f36d7fbaa40fefdbf5958d21b091f95d9c96c345d5
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        fcount_wapper.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\fcount_wapper.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 542KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 3345be5535b02b1628c9f1714ca8674d2ab219583509a3caf1f84a45f7ca770f
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        gearup_ball.exe
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\gearup_ball.exe
                                                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c209e25f434303d53c3128f6b4565d1b4c98e361331cbed62a14a8fd269fef14
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        gearup_booster.exe
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\gearup_booster.exe
                                                                                                                                                                                                                                                                                                                                                        • Size 9.6MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ed46a15fd0264b571aaac7a54745c0a1e7097adddf272fb8e8b6bc0f04743d53
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        libcurl.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\libcurl.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 028dfda38f9aa9bbed5ca3ef6a67cd66ea5e44d68b7781d9717b35b138115fe8
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        lunasvg.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\lunasvg.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 484KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 6a6991d8d36530b566c98324db4fce30fdf834f9db6291bc1f27443d4d280c56
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        msvcp100.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\msvcp100.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 411KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        msvcp140.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\msvcp140.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 437KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        msvcr100.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\msvcr100.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 755KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        ngpush.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\ngpush.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 6.7MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 bd3a87dbb6199c0a8b486e779454743b7cfa845e96069ceeca002d4d1f0cdc27
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        ping.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\ping.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 1.5MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 007be5267c0539e5fc3c59f22f40e0b9258dd445ae582f249a323e975cba97fa
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        sentry.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\sentry.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 426KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4d9af7c5442387ed91671d2f0360eb6cba3baa3c706b8f6b898d3018b8c7fb05
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        skin.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\skin.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 13.2MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 70320c5639fc40bc37ac73aa8bbe71e8d5396dd8efd82a56806bb881a06f904a
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        ui.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\ui.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 a7aa372b0c614d8d2febe8c90fccf5c924980999324432db3d301cfd4373af88
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        ui_webview2.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\ui_webview2.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 229KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 aa2de319f135a8b8e79574b4a1b67b0be1f56da253320940cd8cd467b93758d5
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        uninstall.exe
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\uninstall.exe
                                                                                                                                                                                                                                                                                                                                                        • Size 2.9MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ebbc2f5c1c75aab8b606cca405f1a0aa73a0758009da4c7076124456afa1f0d2
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        update.exe
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\update.exe
                                                                                                                                                                                                                                                                                                                                                        • Size 3.0MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 2c1cd67aa04f5fea43b5ddb31b811f4abea9590d7290eb1ef3fe0fb3af5fa5d6
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        vcruntime140.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\vcruntime140.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 88KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 eb6a3a491efcc911f9dff457d42fed85c4c170139414470ea951b0dafe352829
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        zlib1.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9253\zlib1.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 77KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b9cbdf114c7c403d844550c12d7dd8c755cd58b5b4f99135d812bafd444364ac
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        7za.exe
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\9254\7za.exe
                                                                                                                                                                                                                                                                                                                                                        • Size 595KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b4e2f3b6b68a8d464d18040960b806ac70f8a6fca1cc5f2961bb66660dba81f2
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        7za.exe
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\gearup_booster_temp\7za.exe
                                                                                                                                                                                                                                                                                                                                                        • Size 589KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 0cc0de83b51dae55a4fcae559defc87bea8448010d064c316abcfe9459ece035
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        gearup_booster.zip
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\gearup_booster_temp\gearup_booster.zip
                                                                                                                                                                                                                                                                                                                                                        • Size 26.9MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 91009ffa6622f1b03762ba659a275d144f0a434429d6a0dad44021a1186e8ce9
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        launcher.exe
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\GearUP\launcher.exe
                                                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f3f0d418307eca8d54403edc1873e165e0f245f8f001f4761b1c4335f920c87f
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        GearUP.lnk
                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GearUP.lnk
                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 3835dab40af3ec2352ec89aeb9ae0ea94d58ea0dfcf17a98433db7c298fbb24d
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        app.ico
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Discord\app.ico
                                                                                                                                                                                                                                                                                                                                                        • Size 278KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Size 40B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 a8bc034012647e5adc9311e88dcf79c735cb4b9d6621f61685141bd2a0f5cc22
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                                                                                                        • Size 6B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        BrowsingTopicsState
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                                                                                                                                                                        • Size 414B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 9c8a93f602fc68b790a4914a0da5be3a588d71af45bcab8228c22daa31632cf8
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        f_000054
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000054
                                                                                                                                                                                                                                                                                                                                                        • Size 38KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 13da02ce62b1a388a7c8d6f3bd286fe774ee2b91ac63d281523e80b2a8a063bc
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        f_000064
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000064
                                                                                                                                                                                                                                                                                                                                                        • Size 78KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 2ac06f744a49c28b93082c13136581ffbd3d910824480e41a78d436b35587e02
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 648B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 90a13b3c0c62aa5a68a51fb936e0d6566f3847ea6dad6c4a3bf00afbbcde3570
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 de190bb6510ed5d84e99e9b2cadb862d015588ac0c195ddd1a7628856c7f060c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 d1e141362afd49100f13078daaf8f6c0839b85349989da76c12233643e68b7ea
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 92dc23e84ff6d637e523db7493c10a390949c715055372b9c541b981d9ff8667
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 2d33efd5a68f66760fecd6f9ab79dd08df8a132e517f469ac121d20f936638b8
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c69f14b62dafe134ed2c0181eafbcc3b31d6a5154f29f5336a8caa9f2707307a
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 a52d22edadaa131e27f8907e01805b3d540cb474903425b6f72f1c5532ada149
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 120B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c5fe0a46d09be55be40412bca5007e5c0a8fc57759a66c761813524e6efebb0c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 96B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1053d386dcea022bae3d12bbaec690bf128434c0869509acbfaf4ccda88c9ac7
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 120B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 989acf3dc8404f974c974aaa1fea61049c5043ba8c6ad2bb1808261badee23fc
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        data_0
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0
                                                                                                                                                                                                                                                                                                                                                        • Size 44KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 8c4b7ccdbaa3b58ff961c4cfcd6a946211e843f204169a6818904a84a3df77ca
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        data_1
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
                                                                                                                                                                                                                                                                                                                                                        • Size 264KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 00fdbdbb3c61bb43b190ce87fde1ab2032e3df9de82f3471aaff6fb33d6cfe52
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 358c2e204657e884fe610dc275460e164287373c40aee54198db90a33a017769
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c094f26967ba46c18c2a29863af08c11757a6da449e49a15d3702284742249be
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 bec30addf4a3c6bcab4b38406fddc732371c800c229d94da08769f3003573740
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b8749eaa43b8e5221f779b534ae9c4a772aa827089cfcd36fa702d4b3377953e
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 db33ea0e3c8f34f4519af2583a5c70d91631b5de8c7160d59df5182835a60724
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1a048c68bf1d04bb42c172637eebdcfaa846addac2904b667e823a19949c64f1
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 34874c640ef2ed48f9cb3d174e203f4fd30768d2d16ca2ddd742a05764ae2082
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 d5dd0f6fb845f981007fd482e4bf199acc11e1dd77ecb27beef9995d523c0bf7
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f81927f1b846f548b3485c69a31086e0fc4cee7d80c34001f26a8b5a0d4a6477
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 cae0e629e120976d4fd5d9ae2d2698291fdb1d7209c7c85ea01c4fb47cc7eadd
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c56feee65830f4529dac2a9c83a63aa4f2a30d13746cda5f2a0692ab90319154
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                                        • Size 2B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 fff457a70edf8ba9f5110e632a59f5f8b3e61d8724aacf62f1252341274b37db
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 cfaa9f241c5dfa329aa5660ed1bc83a04ab8e8bd368288902997c66355d7d05c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 609bf54ea9a43634626aee29a20a208db28f7ab9860223b723eb9b0dd14a8445
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 13KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e3b1327e8664b4a6226469910cdf37a3e21c2869e751417981bb07a756169487
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 801e45d602f4f6b91c23cf48b3344d5ef8711bfd7e02ae85d27547e6e0369cf6
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 14387f41b40f576d378d80d069f2297d0a74b736ec3fbc0e9019c2ed06e32084
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 566e84eb417704eedac80eecd00927d656b4d78cf30835bd3b17fdeda70171d1
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 13KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ea1aaac5603b501cd20bdb3307233f2b667e6705163e7454135646fed1ea6097
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 850d6aa1994623df0697ccf9d897f81b7e3d9cb8ab3e7d7046a1e1b718fc387a
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f69af9300673bc284dd9dff8800a437c99ef128693f9bbbc67b5571c045618b5
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 99e6d79dc262ea73d760149070d60a03207fc4b6247227e6366767104fe9e67e
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 225433419d686f37f9b96b71fc1b9648abffa08f0fa9a31833c831a669eade89
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 23bfe82916804b4998600a4909625ee42014aacb901d6108e4fb3efc0acea46a
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 13KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 5c882f81e6c7a32b729cc0b1f6fbedda12ac030b494ee0b130488bad03381c61
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 68d17bbd899fea125d97cf2409b0afc41bd2abb737b6a0cafadefed31a15c1c7
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 37b0c56dd3d1cf31659f546ca43d20dba8680c64a4276db1edc97cbe198299bb
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 3542b98701dd069db175a5238adb1906d06d6ad66df1b7878f58bb13b3cac80f
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 d8fd7b2ff127bb383d002ebcc6c115e4404fbc7609bc0a0fdec0d95998a78bf5
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 934454b5fb3790f14f89e5cb89224265cc46f2cb1b5ec6f126df1d99e14b4ce2
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 13KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e38fd5563a6ea47e76f7e2fc81fdc8a23238ca8864f89a715808421c1fd64c0d
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 13KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 cbb698f3a48a6580f41e293c1ffeef9bd4030c0fd8655adc1acb86dfa6eab67e
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 13KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 00e3443e41894c3543287c11202d3560434db511fcbcd31f6920746a039539a7
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b169d3d3cfa8d94c749dba802d7b8517cfa94e05b9714ec07db327b61fe2e630
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 5a3011bf31ae824d8fb9b9a498a508858a03eb52b142a8b3ab2b3e51e5c73eec
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ade998ee441bf27d21c8a6ba05fa36346b9833744b3bea29975d0d7c0e3780e0
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 576b5acaea011ea1c7b03ff06b8cabe73eca8ac37075276b04ea1936f8b11049
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Secure Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 82085f58435b7b7a260780dca3ee69a48427de11b3ece82d53af0d56f36fd555
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\c6505922-a322-41d6-8300-139dc8a052d4\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 48B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 2e8f33e3ba282501beae32ac8f3728706eeb615ceb4493cf269f2ad0d9f6b4c2
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\c6505922-a322-41d6-8300-139dc8a052d4\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 72B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 db5b9b68b9fd387314579935f019ef22b58386be2643e573f2164e05b8a15541
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\d98f0ccd-2891-4422-97b7-69faa9d194b7\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 72B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 3819c515d3c2fc415e8bc023e6687063b45250efb6cdc66171cc0272d4b35605
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        index.txt
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                                                                                                                                                                                                                        • Size 233B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 cef6ae77ee08fd2434d27fc7d5f1ffc4a05ae8643d2aa5af37015672e9aca93d
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        index.txt
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                                                                                                                                                                                                                        • Size 229B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e4f9e95f9e2940aa85d7344e94893d1952d77fcef725b8150213b63aeb2288ae
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        index.txt
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                                                                                                                                                                                                                        • Size 226B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 5dcd3f6f38634279f53f03699084b4c036b2178e2e66882962bfcfd978580f4b
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        index.txt~RFe5c8d53.TMP
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5c8d53.TMP
                                                                                                                                                                                                                                                                                                                                                        • Size 138B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 748d97d8e1b7e248747bdd6b2cc108169dead359d381013be3bfcf2074b82efb
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 120B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 48a1dffaaa2d65fad386e4cba9402d364f79291394fcbe3f917b39c01b0ec7cb
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index~RFe58b159.TMP
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b159.TMP
                                                                                                                                                                                                                                                                                                                                                        • Size 96B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e0ec82771e126f4e39e9869835318cdbb39ca6905220ba521085421a21246a90
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 201KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 9a5bfdcf434f5b5e47aacb79845a2f643e7f07a6f077efcc598742f31ae9a836
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 117KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1881eaa4afbd40175c75c9ed9a9ff8791647d2bc75030196c32f24499633f85e
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 122KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 5d51c7de37b69bece017b5d1539f4b783ffb21126ce979249a5e4c41bae2c083
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 117KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 a4b482f9f433ba716499c07ecc1b83148b7126788f9e547dd364c841aec0eb72
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 117KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 9c7ab93e4822779238e01fb0d3870dce07394604a1952841a4e2dce96bc5cac6
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 202KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1bddd27a4e0c3cb486e45f0d4bdb139268b91eddc411a3ae38b0c186f806503c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 202KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 6c20c9ecdde628adc438bf7e9aa8b31cd95cf4b0034de68d3f29604859953b6b
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 202KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 339f0d390aa22e7ec97be0922b29558d914d9dfbfddeba53930e1721a5ea08a2
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 90KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1f3c8d246ccb4b74f7c3ebf1ba1503b8d5156f835bb2dc0596c600063bf76c4b
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 201KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 7c65bd66c434205245a286da8779038d2eeded66d5096919b25301aa3230023d
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 202KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b6a732a39ccd247009282064f284ad680a6db455924ccc6e938c2b232547cd26
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 165KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 795edf39608f0d4f7f553d3cde5d31985082ee5711699af5d82ee609b83f3534
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 202KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 8594a1dc54462ef91df63abee1e6084ff2acd8d1f04cf1e362be39cf0f1cdc81
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 149KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 55668403b6bc5ef8db5847f44a879bcf114ac66e299c97f28cd48bb82273be32
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 122KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1a0d8e3cbf1565686923fdb0fd44c76d3a7015ab9c414ad2bfabca801aa87dbf
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        autofill_bypass_cache_forms.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
                                                                                                                                                                                                                                                                                                                                                        • Size 161B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        edge_autofill_global_block_list.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
                                                                                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        v1FieldTypes.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
                                                                                                                                                                                                                                                                                                                                                        • Size 509KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 09d43745b7beb0d2574056dfdacdb3449b786708a0b1a5f978e5c9d69f81a1ce
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 fdcfd05df75c897a6ae400b90c5e56a6067d9d9a631ff864d75351172596e11c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 0bd496229577750dc53053016b6bdd267124938988db34b5e71bf0c648f2532e
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        7fc7bad4-0d17-4076-b0ed-62bd64ff54fc.tmp
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7fc7bad4-0d17-4076-b0ed-62bd64ff54fc.tmp
                                                                                                                                                                                                                                                                                                                                                        • Size 1B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        LOG.old
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                                                                                                                                                                        • Size 357B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 aade50bb9ac65790d8bb9df3bf9707e667711a3d66da5e80aad47ae139ade6f6
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                                        • Size 384B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1307e40f9fb32d2f205d046f702f5942bf043b8016852884f4a9c3d8d4333a6f
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        BrowsingTopicsState
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                                                                                                                                                                        • Size 414B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ff20113768a3fd0cbfb1b33b552b5d71dd580fb7ec65ca4a97afb61360f7eee2
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        temp-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4386092f35db434f79c4afb928d698b84e2abb931771d58f2cfae083cf5a9233
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 3049d4d600b1dc2ec891af1d9fc42dc85f29b99d0d4d5ba5df85ef9962852bc5
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                                                                                        • Size 2B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        HubApps
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                                                                                                                                                                                                                                        • Size 106KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 af7f2a8360442955475d4c83bbf0717d271e01ad733854d10ce63a1666031f44
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        bdb72c1d-6d54-479a-af73-b47aef1d312a.tmp
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bdb72c1d-6d54-479a-af73-b47aef1d312a.tmp
                                                                                                                                                                                                                                                                                                                                                        • Size 40B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 27a77fe53ea9aa9143f6107417e897c59b2847a49666a26a056027453e4e306f
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 18KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ed82cf11965ec6cfcff330e5a5eb65d657301b55480fb3e00efe264aa6164b95
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 56c1ffbdd55b7fe26e280d8aca99bd359a2b0de5140cc1f3979945563d574a1d
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Secure Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 36KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4e1b6bb5155c6cb2be30aa9f8124fe47dcc700ded7c860b11e80779fd53e9196
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        sync_diagnostic.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                                                                                                                                                        • Size 23KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 7599d9ed1c82190642d1d83e2072c717fa2a3cebf499b3cebc10cbb22366dd74
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        domain_actions.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 83KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        data.txt
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.6\data.txt
                                                                                                                                                                                                                                                                                                                                                        • Size 145KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 44dda6faa8220666a11a09301932b82c5d89ba5cf60227ae3b5c3a0a7518bbac
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        wallet-checkout-eligible-sites.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
                                                                                                                                                                                                                                                                                                                                                        • Size 23KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        wallet-notification-config.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
                                                                                                                                                                                                                                                                                                                                                        • Size 804B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        wallet-stable.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
                                                                                                                                                                                                                                                                                                                                                        • Size 81KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        wallet-tokenization-config.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
                                                                                                                                                                                                                                                                                                                                                        • Size 34KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 27KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 2cab0461cb2c154059e1a144d913444ceadc6a3ea2c55d0483d7c476e5e75bcf
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 27KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 aaee4d9beb9a900e9a6026328af9f2984277c6519b095573ae4d92e9ce01fbf7
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 26KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e0cf19957bba2337eb24a4aa46fb55cbb33ea6e624a2ad6809431340cb46b132
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 27KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 69144dcb508cb0acc73af53d20d9247adb762d3fbfa176467ec6bd3717a426b2
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 29KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4f8ee9212952a6cf03dbc1a949fdf9c9f86064c817b51e338ae19514b5e622af
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 34KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4330b74da296a06c3a36cb5ad8f8a196796ac03b43058481d3133a7cddaa4d8f
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 27KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 255ce71e2d10dc1ab563be5abce8b87a0f2b2e0ac6803de514a5fc5c98617cc3
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        crs.pb
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\crs.pb
                                                                                                                                                                                                                                                                                                                                                        • Size 233KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        ct_config.pb
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\ct_config.pb
                                                                                                                                                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        kp_pinslist.pb
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\kp_pinslist.pb
                                                                                                                                                                                                                                                                                                                                                        • Size 10KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        RevisitationBloomfilter
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                                                                                                                                                        • Size 392B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ad2fdc9407fb8dce91864e6f027fbb29a18af48f8035de60209a70af31902be7
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        RevisitationBloomfilter
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                                                                                                                                                        • Size 392B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 dadfe4182722ebcb865aa305b26bac389389e82a9ef90a22c805bbaa85581d73
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        RevisitationBloomfilter
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                                                                                                                                                        • Size 392B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 7341e851bb9c3ca4ae3c0003c230857144291e007fb83152590608a72df9ffc4
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        RevisitationBloomfilter~RFe5b6936.TMP
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b6936.TMP
                                                                                                                                                                                                                                                                                                                                                        • Size 392B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ad45f994c088c3526d2dbf3565ef67ae9de1233c7270350e2cd0786fc8477ccc
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        typosquatting_list.pb
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.4.17.1\typosquatting_list.pb
                                                                                                                                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 805d8d74e6a3b6b2fe689e200868d7fa4781089d5f6fc830487ed1b5a9017049
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 6674a7f7112dd300a1bad16e6b9de1ba969ec37e511e5baea89283ec0f450baa
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e50086c75fc2f0eb5830683fe7d4524fc7fb80c524e7c6600aab06adf7e67737
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 64d8672bfc6a27b2093bec6d02368137bb4b6cc9e0b8c1c85a1aa274c0f48dc1
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 d8cd7cdda369bfb2796ca2b07fbfc0bfab863bc67207506143442856dac9773f
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 842cc501664a0638967e1be5dbf11a335499cc227699b72be37044d088c53f70
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 5452760fbba67ee15ce67c95f83fa30960121a816745604f45a72f7bbefa3968
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f04cbbcbfe174d13be0bdd30db1e1241d191b7074a2cd7e9ab1a0a184b826bfc
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 745ae577f53ceac9221ed2fd3c90aae8621a173bb400abba575d538463e9a7aa
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 10ecb8dca156e78502da881c0977939e7d98f81640609b306d8c9123efe595d9
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 d894f777a25b2e1e2f28085c2acbccb638b424facb733508a00b4d8496b0b278
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                                                                                                                                                                                                                                        • Size 147KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                        • Size 132B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        SearchHoverUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                                                                                                        • Size 21KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c6d226ed37fe2a11ac4435483a900f699cebdd3df32ea86b5634959f8fff1115
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        SearchHoverUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                                                                                                        • Size 21KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 9bf3c7d82d1f94ac4ff52af30aadb07c024bd23f29742cd456f35dd415064ad4
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        RELEASES
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
                                                                                                                                                                                                                                                                                                                                                        • Size 81B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 3f4bb9270306cd3493e9b874ac7478d8b9808d88fa465ff9d8aa5d2b8eabaeb4
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        gu.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log
                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 7097e57138f072325c73f627c8fa8242230097639bb910b520c7e805ed5c2897
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        gu.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log
                                                                                                                                                                                                                                                                                                                                                        • Size 28KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 7c23b409a75088f15d3e969229435c08179cacf58ff6470800b97f4d86a0af5e
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        gu.log
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\gu.log
                                                                                                                                                                                                                                                                                                                                                        • Size 56KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 3bb30f430e3df7ccd403d2dcac3910791ab00c42a8298d3b525c1741abfac3ae
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        ping.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\ping.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 1.5MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ea26eb5cf3e0d3553c7a5d54dd4390ac3ef28dc8c79e3eb53c2747b4263032f3
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry\settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Size 40B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4d482001744647397167e153d411857b76cc0ef859fb774c7cdb9df966d54679
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\sentry_ball\settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Size 40B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 0b0bc3dfbe9da2636e7744038e96209db1b61bc25cfbc03e3ea581d339cdf59b
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        protocols.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        crl-set
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
                                                                                                                                                                                                                                                                                                                                                        • Size 22KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 007beff6dbcd709f64e1cbe01aa0c50563ff5987a54a222041264b1ad43005ae
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b62ea68a8f7457e6815f95b9e5f9e48b96361530424dc0a1a27de4657d91fec3
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4f2ab046f2bf08a8a3f1816fffa016bdea0d1ea41c2cab2fc62d556bc7498c87
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 605d9bf85b7f42a7563149f24aef8779d5a87b0eae13ca7a2722bb9734556fc5
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        f_000001
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Cache\Cache_Data\f_000001
                                                                                                                                                                                                                                                                                                                                                        • Size 16KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c603744225c4276bce750a23ceb8621a0ade47fecf8689b9453a5d4fb8b40a58
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        f_000002
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Cache\Cache_Data\f_000002
                                                                                                                                                                                                                                                                                                                                                        • Size 59KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1f1ef835eceefdd4910051db6e922af45f44f6d4275142f13897ab20d8e5882b
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        f_00000a
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Cache\Cache_Data\f_00000a
                                                                                                                                                                                                                                                                                                                                                        • Size 51KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c3e892134bfa7b72268c775fb354051d9c38ba5ed510a1b04040333cf8503708
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 576B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 fef365d5d62fd632a522d1e463a72d1fd6bb048c28edfa290e7706a20618f918
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 816B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 38c9a58940da32ca1188ac45f288e2264d39c83c1e58cd919f6118ffa251127b
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 120B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 695caed2bad2dd00ac18abffc46b0a004f27c4b36c7a214409be6cadad55c143
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 744B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 3a457fddb5caf134eefa3eaa34a489753abd280890e4bc11f8b9678dbc976bec
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                        • Size 192B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 16fa6160a5c3651b2e908d3f361f1daf9217641e6c2ee391e47531c0720241bb
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        the-real-index~RFe58f836.TMP
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe58f836.TMP
                                                                                                                                                                                                                                                                                                                                                        • Size 48B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 be7b3dc9dffc169492e6544720a6cdf2dca3d8a50f1d74587c98c272d3bb93f0
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Extension Rules\MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                                        • Size 41B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 5a6ecc0a8d9aa3fd2110ad6597f3f5570380a34dc0d48191203fcb90d9718fb1
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 fb1c64997d36acdd8e2e5f13883801c878a11e257629a139fa4bc787f0ae9a33
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 eef54cc33b07bf83ece372ad4748e913f7176a0667c998fe2f71d12ff8c19bc8
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b77eb751f310bc5e89ca2cf4cad7babd589be6402e59de7952f5b8807a9b90a8
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 0c8451b78e20b1b355537087af266feb5b363e2d4e6980e213cc81f21bee70a1
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 48336eb1b931e293745de5fa2629d1213793bb12de854585a6d48da9e4e2d10e
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Network Persistent State~RFe599929.TMP
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\Network Persistent State~RFe599929.TMP
                                                                                                                                                                                                                                                                                                                                                        • Size 59B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 188B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 d71c9e836dc6ebd5a12ac666fd52b4df4f5034bfdcd856d235e7581005937b20
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 188B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 5d8b5e9b1674f58f3a09679e38336ee34414e77c4406d4406f5d711f2a18662a
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 188B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1949ebcb5eaac700f9af91dcc7112d8af5fb5a310128959bd407f78001293f69
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 186B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 cb09edacd9d428c966e6500e5409b58b408a1408e01f63755d38a93d55d13a6f
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 188B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 3ce2a971d0769fa139987a1f3549585bae4b09d056427eae5262a1d1077b97b7
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 186B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 fdd90151fb862ae0fc2d6142227c7eee1b69bfbee4c5b2f35739b461014c9026
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 186B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 09fe8b27b105f5d9ded08420bebc3c10e2659a56cb1b8f33bdf73cc96f029d88
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 186B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 fcf97b1375713b0da61e45c7fa628c5031e4ce1dc373433ee031d73985254bb2
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 188B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c1c6a21fe623fc23a6a16f2d3e4534e7e776aba3208e0fc0af0789c844c0689a
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 188B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 66cd944f2d31a07c08f70a849ac314910d9f1101b4aff0b202b358b19d64d61c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 188B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 6733f6aeaaa0a0568fac2da4c035b6026546fb908de646e69731a400381f7472
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 186B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 6c3d97d0dcab410249a03b0536056bd5da4201c92ab16042244840c4eca7063f
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 188B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 186c1018644210404d2bdc7350e079e97a2556dd82876fece81830baaa2bd8c0
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                                        • Size 188B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4dadc34b1cb9214daa82efb1b1a4f1cc78a674c3b62725be206f8ed939830e04
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransportSecurity~RFe5b2121.TMP
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Network\TransportSecurity~RFe5b2121.TMP
                                                                                                                                                                                                                                                                                                                                                        • Size 188B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 161c6518fa46da76894fc1f9a06ba9fa398bcc77ed15623caba3b6676a9ae5e1
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e38a556ee9a32b582bbc3143ea14ec037feadb099f9aac8ce2485847174be42b
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 3ffb47e4576fd79e3f6717fbe5511af1ec56b85457502e246179480c8590e27e
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f2ee184b757372ed4efd4f4dbd7a985085cfb6087364696fff0f1d27f227d5d8
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 10f200377e6875434f8817980c870bf143da038601e12706adb6fa4f97ee0380
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 424c7c8f84effe3dae9ed7b7edeb2a708394e54a12c93c0c97d206c53cdeb420
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 976e246dd2ee29945a75985286bec3959aef06290475dd38e93e04e9b1d3ff1d
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e92a353bd9ab201986fbcdf1501e5e79ab4c2171f6748ecb1a86ab11ae79fe1b
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c57ab27b44460e89392277c729db78494d4e12b2ffa4b900ab419388930285c2
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        CURRENT
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Default\Site Characteristics Database\CURRENT
                                                                                                                                                                                                                                                                                                                                                        • Size 16B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        data_0
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GrShaderCache\data_0
                                                                                                                                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        data_1
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GrShaderCache\data_1
                                                                                                                                                                                                                                                                                                                                                        • Size 264KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        data_2
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GrShaderCache\data_2
                                                                                                                                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        data_3
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\GrShaderCache\data_3
                                                                                                                                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 18KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 048d9506db8f9961df9a540809376bacfe2ef5adbc998067388e6fee7e6b73b7
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b7f2245470e643858c0882563caa298529dd7983e00a16cb55dbe525808c0fde
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 18KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c995f92148d0db40b16f439a76c1f9c94b184d7a69c59fcb64a1116a9bfe2c49
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 18KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b1f63cdea6c7fc972db7fe810cedc03d6b01d82b2ecf55bc6d2e117fd73e3277
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 958228d931e2fdf766dc38b624eb17574921e60fac237420b35291259b9aa102
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 15KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 d8fefd5edd8b7691f22fc795ea5c192766240797fc327400abe73e2f213a4712
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 18KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 34c483269c19720f988e0575185b5601f32afc273b13858e02ab0a7d891e925e
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 18KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 a3d12170e29ccaf8c35bf164356f5e39b79502e396ff647edd5ad7489f5d20fd
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 0533731842807e3780fc3d48b39f7389e8d07b2e07beffdecc0f241ce436a351
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e129c98b170fd25837badb499d74db2df4951ddb4f0baa0daf790a5762673929
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 7a0b757954694e14841354802cabf3a50f9a70787f2182a85d8ba9f02db35a3d
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 19KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 0e9b7670467213a70546659e8a986f52aa7a23d4f0744e6c3eadc95941e1055c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 18KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 42e305cce520bbb1f4b5afcfb9eac0d1e68014223ffc9dc3c7bcc0c78b683fed
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 19KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 0de8ecfcab4296ab537e773b6fb5e2f508e58aa3c88d4d947028639cf2b4994c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 18KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 946666be784e19acdc643a5f1938dbe9cc36630519d39ebe53749ca6127e9548
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 18KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b6fdfdf095bd14eeb75f515d14607c1826f2ef0761f817709a51a256c1992311
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State
                                                                                                                                                                                                                                                                                                                                                        • Size 18KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1da2daff405ecbdbd19887f38d9e4b8ebfd3bba986d6fd4bb6f70ab5a193c97a
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Local State~RFe588150.TMP
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Local State~RFe588150.TMP
                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b14a1b142ed24fcf01273ed5aaf5d3e18225198607edeaa4b775d747f4694308
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        RevisitationBloomfilter
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\RevisitationBloomfilter
                                                                                                                                                                                                                                                                                                                                                        • Size 392B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 13d8264601d6282f5aaff8c3b16974b6aaf6843bf9639e08e1342975c13a59a0
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        RevisitationBloomfilter
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\RevisitationBloomfilter
                                                                                                                                                                                                                                                                                                                                                        • Size 392B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 a2f9090471a3164f7251443fe5fc62c39ed555b6129ef1122b016ef0aeaf3aab
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        RevisitationBloomfilter~RFe5c3ba9.TMP
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\RevisitationBloomfilter~RFe5c3ba9.TMP
                                                                                                                                                                                                                                                                                                                                                        • Size 392B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1a8d040f83cbfab825681731380ccf4bb3ff4c6b8339111e4aa3a4236644ad78
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Ruleset Data
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Subresource Filter\Indexed Rules\36\10.34.0.84\Ruleset Data
                                                                                                                                                                                                                                                                                                                                                        • Size 3.5MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ad506d85462accaac35068e71641814a593595cfe60657309ded18ebc2874e9d
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Filtering Rules
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
                                                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        LICENSE
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
                                                                                                                                                                                                                                                                                                                                                        • Size 24KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Advertising
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Advertising
                                                                                                                                                                                                                                                                                                                                                        • Size 19KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 5989ccf9a58e4ffd47c2422bd8dfcb3ea4e1d412fbdec2291385a9955af9eace
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Analytics
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Analytics
                                                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 163a5318312b814104d244a4b37b676a02f827068820aa60fc069e6346cb2b75
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        CompatExceptions
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\CompatExceptions
                                                                                                                                                                                                                                                                                                                                                        • Size 689B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Content
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Content
                                                                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 7869993fcb93b302598643be96c6ab94c4f3be47c9fc344959773c754291376e
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Cryptomining
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Cryptomining
                                                                                                                                                                                                                                                                                                                                                        • Size 668B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1e92781e88ee786bf6d1d5cb71d467a92fe7f281f2d1e548524bf119d7ddc700
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Entities
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Entities
                                                                                                                                                                                                                                                                                                                                                        • Size 68KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Fingerprinting
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Fingerprinting
                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c7d2b05ff6e790af78b0f1f341219fdb554dc5e14fbf3e3981819fccdd1ddfed
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        LICENSE
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\LICENSE
                                                                                                                                                                                                                                                                                                                                                        • Size 34KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Other
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Other
                                                                                                                                                                                                                                                                                                                                                        • Size 34B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Social
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Social
                                                                                                                                                                                                                                                                                                                                                        • Size 754B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        TransparentAdvertisers
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Mu\TransparentAdvertisers
                                                                                                                                                                                                                                                                                                                                                        • Size 105B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Advertising
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Advertising
                                                                                                                                                                                                                                                                                                                                                        • Size 20KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 868f3ed3f86f1e82a5041f0a7b382bdd720e411531df2dc680da34eb60580b75
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Analytics
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Analytics
                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 33d2b069ea874c12ec96242ca7eb539c1086d38ac6c2e4858c0efcd74fc632e5
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Content
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Content
                                                                                                                                                                                                                                                                                                                                                        • Size 5KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 d99df5936c57a50aebb7f0a3ca65fcc682f523ace93641fbcfb9b09cfb71c739
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Cryptomining
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Cryptomining
                                                                                                                                                                                                                                                                                                                                                        • Size 32B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Entities
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Entities
                                                                                                                                                                                                                                                                                                                                                        • Size 106KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 0f305323c627cf0c790831c7e0bc38455b7a99983c4ab5bd9d2d9567766c3499
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Fingerprinting
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Fingerprinting
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ec0fcbf71d58e707aaf6ba8d3c0719972f26727febe03f8efbf570b9635faddf
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        LICENSE
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\LICENSE
                                                                                                                                                                                                                                                                                                                                                        • Size 66B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Other
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Other
                                                                                                                                                                                                                                                                                                                                                        • Size 198B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c9ab8dbc87043c71dd649fc06bb006e7f62e81c973c37b125afb88e654e436f8
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Social
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Social
                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e520603e6fb543cd078b2a7dbd8ccfc175e9aecf71654fc19785927a014d3435
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.fingerprint
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Trust Protection Lists\1.0.0.34\manifest.fingerprint
                                                                                                                                                                                                                                                                                                                                                        • Size 66B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f96cf59ef5cdf10cdebb367e16c6736d188af934062a8721eb9d60539556a2a9
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Variations
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Variations
                                                                                                                                                                                                                                                                                                                                                        • Size 85B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Variations
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\Variations
                                                                                                                                                                                                                                                                                                                                                        • Size 86B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        cff7f997-fa7f-4aca-9f49-62d91ca384c0.tmp
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\GearUPBooster\webview2cache\EBWebView\cff7f997-fa7f-4aca-9f49-62d91ca384c0.tmp
                                                                                                                                                                                                                                                                                                                                                        • Size 17KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf60c6e2b955bdef04bc030ce29f9d5878f133c43dd2d65921a144a7653490ee
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        default.dic
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                                                                                                                                                                                                                        • Size 2B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        8c4a470c-edc7-4d33-a39a-fae9d21fd34b.tmp
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\discord\8c4a470c-edc7-4d33-a39a-fae9d21fd34b.tmp
                                                                                                                                                                                                                                                                                                                                                        • Size 93B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        index
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\discord\Code Cache\wasm\index
                                                                                                                                                                                                                                                                                                                                                        • Size 24B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\discord\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                        • Size 40B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 9614ff34948cabc157ad18892b70b4d71770fc39462041f0d7fab3c6eb39279d
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\discord\Preferences
                                                                                                                                                                                                                                                                                                                                                        • Size 122B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 3489a9fcea842f7bd4152b6ac5a20d493dfba1fdadaec75b503c8e5ffa0d9042
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_1339184808\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 135B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_1348808554\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 116B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        hyph-af.hyb
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_139312058\hyph-af.hyb
                                                                                                                                                                                                                                                                                                                                                        • Size 70KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        hyph-as.hyb
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_139312058\hyph-as.hyb
                                                                                                                                                                                                                                                                                                                                                        • Size 703B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        hyph-hi.hyb
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_139312058\hyph-hi.hyb
                                                                                                                                                                                                                                                                                                                                                        • Size 687B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        hyph-nb.hyb
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_139312058\hyph-nb.hyb
                                                                                                                                                                                                                                                                                                                                                        • Size 141KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_139312058\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 82B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        LICENSE
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_1448852395\LICENSE
                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        verified_contents.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_1448852395\_metadata\verified_contents.json
                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c50e8b66b9c681cbc2fa16cb2d8fd7cc934df1a7863dcf4f0ebedf6a5b78638d
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_1519270014\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 113B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_1983470254\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 76B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_2140172823\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 69B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Staging
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_251578234\Sigma\Staging
                                                                                                                                                                                                                                                                                                                                                        • Size 36B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_251578234\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 132B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 68683970ce6d7de9a2043c34129106ae68af21a3b0a3c53cb59695640a7c1cbc
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        LICENSE
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_625115751\LICENSE
                                                                                                                                                                                                                                                                                                                                                        • Size 499B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 55064d7d8fecdd90ba36cebaff34f05583c183b34686b17b40b974442fc07523
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        verified_contents.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_625115751\_metadata\verified_contents.json
                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 823f4c1b200082df810d789bef9f02f04dcea5019b5595139d2fe8c02bc9556e
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        widevinecdm.dll
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_625115751\_platform_specific\win_x64\widevinecdm.dll
                                                                                                                                                                                                                                                                                                                                                        • Size 18.9MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 bf7d46b38690e50462fecbc14530cd903d1486fa493b49d9e71d6cc44ac25a4b
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        widevinecdm.dll.sig
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_625115751\_platform_specific\win_x64\widevinecdm.dll.sig
                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 3d01ea299dbfa7dd3dcd5959aa70234e18e825136c33c9079b1e50db4c8a89fb
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_671562184\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 43B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        keys.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4428_465363682\keys.json
                                                                                                                                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4428_465363682\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 79B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_1159317822\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 118B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 69e4e1c13d13f15e8066d6d7e984a96a08d3b2a2ae33fbb218b1e0de5b8d1aed
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        edge_checkout_page_validator.js
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_1248889920\edge_checkout_page_validator.js
                                                                                                                                                                                                                                                                                                                                                        • Size 1009KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_1248889920\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 146B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_1555314584\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 119B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Filtering Rules-AA
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_358977053\Filtering Rules-AA
                                                                                                                                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 95beb1f39b4cd5b29f5ebaced4a33753fb0bb876f078ed3de041f12be16cec5c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Filtering Rules-CA
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_358977053\Filtering Rules-CA
                                                                                                                                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 65aa171487dca70aad69973d0459c6a4b0882fcc6223bdfb53cd9ab711c5b125
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Part-DE
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_358977053\Part-DE
                                                                                                                                                                                                                                                                                                                                                        • Size 305KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 367ad4a5699a69499d13e8bf9ed5e8bab3573e3731ff8127178e539735ba46a8
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Part-ES
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_358977053\Part-ES
                                                                                                                                                                                                                                                                                                                                                        • Size 137KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 55e005c8aea4180093fcb56f4ddeb9fc763892d8cf1fcc840f612a7531b7ed18
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Part-FR
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_358977053\Part-FR
                                                                                                                                                                                                                                                                                                                                                        • Size 528KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 56e80041432156be4f08bac11e3494f2f06f65b61a60b7dcb61d15debb7b318c
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Part-IT
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_358977053\Part-IT
                                                                                                                                                                                                                                                                                                                                                        • Size 216KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 e1552312fc16e0f279e72f7eb4189a47e0beb36733220b0ef605f66defcc5fa7
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Part-NL
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_358977053\Part-NL
                                                                                                                                                                                                                                                                                                                                                        • Size 79KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 935465fc40adbb4ae89ba37542ed37609014666c67fdf5115927809d69144b41
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Part-RU
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_358977053\Part-RU
                                                                                                                                                                                                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f8abf856660805e271d9d2033accf4f8cc43b19b7662fc2b96f56739229a90fe
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        Part-ZH
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_358977053\Part-ZH
                                                                                                                                                                                                                                                                                                                                                        • Size 686KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 9645edd48b978354345b657bacb3f30be1f450300856a82ba4d5dbf1236c7c9e
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        adblock_snippet.js
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_358977053\adblock_snippet.js
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        notification_fast.bundle.js.LICENSE.txt
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_418960323\Notification\notification_fast.bundle.js.LICENSE.txt
                                                                                                                                                                                                                                                                                                                                                        • Size 551B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        tokenized-card.bundle.js.LICENSE.txt
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_418960323\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        strings.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_418960323\json\i18n-tokenized-card\fr-CA\strings.json
                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                        • SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_418960323\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 121B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        deny_domains.list
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_708716545\deny_domains.list
                                                                                                                                                                                                                                                                                                                                                        • Size 12B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_708716545\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 177B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_718876927\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 102B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_734620093\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 52B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 38bee4120e8eb37975dd2f6a2a3b23f9cea6e6c4f0335ad80270dc22b9990fc9
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_766879338\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 1001B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8108_990601244\manifest.json
                                                                                                                                                                                                                                                                                                                                                        • Size 165B
                                                                                                                                                                                                                                                                                                                                                        • SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                        memory/1244-383-0x0000000000730000-0x000000000077A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1416-1358-0x0000000005970000-0x0000000005990000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1416-1397-0x00000000019A0000-0x0000000001A7F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/1416-1398-0x0000000003380000-0x000000000338B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2036-1336-0x0000000007F40000-0x0000000007F48000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2036-2008-0x0000000001180000-0x000000000125F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2036-1338-0x0000000007FA0000-0x0000000007FAE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2036-1337-0x0000000007FC0000-0x0000000007FF8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2036-1136-0x00000000006D0000-0x000000000085A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2036-1525-0x0000000001180000-0x000000000125F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2044-2077-0x0000000009990000-0x00000000099DA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2328-813-0x0000000001460000-0x00000000014AA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2580-1834-0x0000000000FA0000-0x000000000107F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2580-1835-0x0000000005120000-0x000000000512B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2804-343-0x0000000003900000-0x000000000394A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2804-0-0x0000000010000000-0x000000001001F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/2976-348-0x0000000000750000-0x000000000079A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3160-2015-0x0000000001340000-0x000000000141F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3256-1944-0x0000000005DC0000-0x0000000005DCB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3256-1943-0x0000000001C00000-0x0000000001CDF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-3267-0x0000016772B40000-0x0000016772B43000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-5786-0x0000016772070000-0x0000016772075000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-5791-0x0000016772350000-0x0000016772356000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-6353-0x0000016772380000-0x0000016772382000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-6352-0x0000016772370000-0x0000016772371000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-6356-0x0000016772370000-0x0000016772375000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-6355-0x0000016772390000-0x0000016772393000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-6358-0x00000167723A0000-0x00000167723A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-6357-0x0000016772390000-0x0000016772391000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-5790-0x0000016772370000-0x0000016772373000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-5787-0x0000016772350000-0x0000016772351000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-5783-0x0000016772340000-0x0000016772342000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-5782-0x0000016772070000-0x0000016772071000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-3268-0x0000016772B20000-0x0000016772B26000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-5785-0x0000016772350000-0x0000016772353000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-480-0x00007FFB9FD30000-0x00007FFB9FD31000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-3257-0x00000167727F0000-0x00000167727F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-3258-0x0000016772B00000-0x0000016772B02000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-3259-0x00000167727F0000-0x00000167727F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-3260-0x0000016772B10000-0x0000016772B12000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-3262-0x0000016772B20000-0x0000016772B23000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-3263-0x00000167727F0000-0x00000167727F5000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-3265-0x0000016772B30000-0x0000016772B32000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-5788-0x0000016772360000-0x0000016772362000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3308-3264-0x0000016772B20000-0x0000016772B21000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3340-928-0x00000000005C0000-0x000000000060A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3684-2025-0x00000214025C0000-0x00000214025C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3684-2027-0x00000214025C0000-0x00000214025C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3684-2024-0x00000214025C0000-0x00000214025C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3684-2026-0x00000214025C0000-0x00000214025C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3684-2029-0x00000214025C0000-0x00000214025C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3684-2030-0x00000214025C0000-0x00000214025C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3684-2020-0x00000214025C0000-0x00000214025C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3684-2019-0x00000214025C0000-0x00000214025C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3684-2018-0x00000214025C0000-0x00000214025C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/3684-2028-0x00000214025C0000-0x00000214025C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/4324-1416-0x0000000000E20000-0x0000000000EFF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/4324-1417-0x0000000005090000-0x000000000509B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5048-571-0x00007FFB9FD30000-0x00007FFB9FD31000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5200-1889-0x0000000004E10000-0x0000000004E1B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5200-1888-0x0000000000CB0000-0x0000000000D8F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5356-1524-0x0000000000880000-0x00000000008CA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5428-2041-0x0000000008340000-0x000000000838A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5632-3832-0x00000000011D0000-0x000000000121A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5632-812-0x00000000011D0000-0x000000000121A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5632-2221-0x00000000011D0000-0x000000000121A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/5968-2056-0x00000000011C0000-0x000000000129F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6016-970-0x0000000001460000-0x00000000014AA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                        memory/6080-966-0x00000000010D0000-0x000000000111A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                        Download