Overview

overview

10

Static

static

3

JUFPRUJS.exe

windows10-2004-x64

10

JUFPRUJS.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    30/05/2026, 00:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    JUFPRUJS.exe
  • Size 15.0MB
  • Sample260530-amfmtscs6v
  • SHA256 a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoveryhijackloaderloaderspywarestealer

Malware Config

Extracted

Family

  • hijackloader

Attributes
  • directory

    %APPDATA%\prorunner_32

  • inject_dll

    %windir%\SysWOW64\input.dll

xor.hex

Signatures

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader
  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 44 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 4 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JUFPRUJS.exe
    "C:\Users\Admin\AppData\Local\Temp\JUFPRUJS.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5112
    • C:\Users\Admin\AppData\Local\Temp\DeltaGen32.exe
      "C:\Users\Admin\AppData\Local\Temp\DeltaGen32.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5828
      • C:\ProgramData\prorunner_32\DeltaGen32.exe
        C:\ProgramData\prorunner_32\DeltaGen32.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:5652
        • C:\Users\Admin\AppData\Roaming\prorunner_32\OGEYXWXBGOZKFIQM\Transponder-Sonic.exe
          C:\Users\Admin\AppData\Roaming\prorunner_32\OGEYXWXBGOZKFIQM\Transponder-Sonic.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:4460
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c start /min "" "C:\Users\Admin\AppData\Roaming\core_svc\RNQWJLUHZRK\123.cmd"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2700
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\core_svc\RNQWJLUHZRK\123.cmd"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1392
              • C:\Windows\system32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\core_svc\RNQWJLUHZRK\123.cmd" re1"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:4744
                • C:\Windows\System32\sc.exe
                  sc query Null
                  8⤵
                  • Launches sc.exe
                  PID:5760
                • C:\Windows\System32\find.exe
                  find /i "RUNNING"
                  8⤵
                    PID:2144
                  • C:\Windows\System32\findstr.exe
                    findstr /v "$" "123.cmd"
                    8⤵
                      PID:6084
                    • C:\Windows\System32\cmd.exe
                      C:\Windows\System32\cmd.exe /c ver
                      8⤵
                        PID:5968
                      • C:\Windows\System32\reg.exe
                        reg query "HKCU\Console" /v ForceV2
                        8⤵
                          PID:3680
                        • C:\Windows\System32\find.exe
                          find /i "0x0"
                          8⤵
                            PID:5544
                          • C:\Windows\System32\cmd.exe
                            C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
                            8⤵
                              PID:5752
                            • C:\Windows\System32\find.exe
                              find /i "ARM64"
                              8⤵
                                PID:2300
                              • C:\Windows\System32\cmd.exe
                                C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
                                8⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1096
                                • C:\Windows\System32\cmd.exe
                                  C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
                                  9⤵
                                    PID:3868
                                  • C:\Windows\System32\cmd.exe
                                    cmd
                                    9⤵
                                      PID:5352
                                  • C:\Windows\System32\cmd.exe
                                    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Roaming\core_svc\RNQWJLUHZRK\123.cmd" "
                                    8⤵
                                      PID:5404
                                    • C:\Windows\System32\find.exe
                                      find /i "C:\Users\Admin\AppData\Local\Temp"
                                      8⤵
                                        PID:5732
                                      • C:\Windows\System32\fltMC.exe
                                        fltmc
                                        8⤵
                                          PID:5576
                                        • C:\Windows\System32\cmd.exe
                                          C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Roaming\core_svc\RNQWJLUHZRK\123.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
                                          8⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5660
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Roaming\core_svc\RNQWJLUHZRK\123.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
                                            9⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3884
                                        • C:\Windows\System32\cmd.exe
                                          C:\Windows\System32\cmd.exe /c mode con
                                          8⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2500
                                          • C:\Windows\System32\mode.com
                                            mode con
                                            9⤵
                                              PID:1052
                                          • C:\Windows\System32\reg.exe
                                            reg query HKCU\Console /v QuickEdit
                                            8⤵
                                            • Modifies registry key
                                            PID:3600
                                          • C:\Windows\System32\find.exe
                                            find /i "0x0"
                                            8⤵
                                              PID:5648
                                            • C:\Windows\System32\reg.exe
                                              reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
                                              8⤵
                                              • Modifies registry key
                                              PID:2312
                                            • C:\Windows\System32\cmd.exe
                                              cmd.exe /c ""C:\Users\Admin\AppData\Roaming\core_svc\RNQWJLUHZRK\123.cmd" -qedit"
                                              8⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:5548
                                              • C:\Windows\System32\sc.exe
                                                sc query Null
                                                9⤵
                                                • Launches sc.exe
                                                PID:4108
                                              • C:\Windows\System32\find.exe
                                                find /i "RUNNING"
                                                9⤵
                                                  PID:1632
                                                • C:\Windows\System32\findstr.exe
                                                  findstr /v "$" "123.cmd"
                                                  9⤵
                                                    PID:5324
                                                  • C:\Windows\System32\cmd.exe
                                                    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
                                                    9⤵
                                                      PID:2772
                                                    • C:\Windows\System32\find.exe
                                                      find /i "/"
                                                      9⤵
                                                        PID:6068
                                                      • C:\Windows\System32\cmd.exe
                                                        C:\Windows\System32\cmd.exe /c ver
                                                        9⤵
                                                          PID:4636
                                                        • C:\Windows\System32\reg.exe
                                                          reg query "HKCU\Console" /v ForceV2
                                                          9⤵
                                                            PID:4648
                                                          • C:\Windows\System32\find.exe
                                                            find /i "0x0"
                                                            9⤵
                                                              PID:5224
                                                            • C:\Windows\System32\cmd.exe
                                                              C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
                                                              9⤵
                                                                PID:1428
                                                              • C:\Windows\System32\find.exe
                                                                find /i "ARM64"
                                                                9⤵
                                                                  PID:4936
                                                                • C:\Windows\System32\cmd.exe
                                                                  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
                                                                  9⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1076
                                                                  • C:\Windows\System32\cmd.exe
                                                                    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
                                                                    10⤵
                                                                      PID:5928
                                                                    • C:\Windows\System32\cmd.exe
                                                                      cmd
                                                                      10⤵
                                                                        PID:5524
                                                                    • C:\Windows\System32\cmd.exe
                                                                      C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Roaming\core_svc\RNQWJLUHZRK\123.cmd" "
                                                                      9⤵
                                                                        PID:2888
                                                                      • C:\Windows\System32\find.exe
                                                                        find /i "C:\Users\Admin\AppData\Local\Temp"
                                                                        9⤵
                                                                          PID:860
                                                                        • C:\Windows\System32\fltMC.exe
                                                                          fltmc
                                                                          9⤵
                                                                            PID:2884
                                                                          • C:\Windows\System32\cmd.exe
                                                                            C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Roaming\core_svc\RNQWJLUHZRK\123.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
                                                                            9⤵
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2540
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Users\Admin\AppData\Roaming\core_svc\RNQWJLUHZRK\123.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
                                                                              10⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:6008
                                                                          • C:\Windows\System32\cmd.exe
                                                                            C:\Windows\System32\cmd.exe /c mode con
                                                                            9⤵
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5220
                                                                            • C:\Windows\System32\mode.com
                                                                              mode con
                                                                              10⤵
                                                                                PID:1100
                                                                            • C:\Windows\System32\cmd.exe
                                                                              C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
                                                                              9⤵
                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1472
                                                                              • C:\Windows\System32\PING.EXE
                                                                                ping -n 1 activated.win
                                                                                10⤵
                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                • Runs ping.exe
                                                                                PID:3436
                                                                            • C:\Windows\System32\cmd.exe
                                                                              C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck310.activated.win
                                                                              9⤵
                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5568
                                                                              • C:\Windows\System32\PING.EXE
                                                                                ping -n 1 updatecheck310.activated.win
                                                                                10⤵
                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                • Runs ping.exe
                                                                                PID:4876
                                                                            • C:\Windows\System32\choice.exe
                                                                              choice /C:10 /N
                                                                              9⤵
                                                                                PID:2464
                                                                            • C:\Windows\System32\reg.exe
                                                                              reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
                                                                              8⤵
                                                                              • Modifies registry key
                                                                              PID:904
                                                                      • C:\Users\Admin\AppData\Local\SynthSer.exe
                                                                        C:\Users\Admin\AppData\Local\SynthSer.exe
                                                                        5⤵
                                                                        • Loads dropped DLL
                                                                        • Drops desktop.ini file(s)
                                                                        • Suspicious use of SetThreadContext
                                                                        • Drops file in Program Files directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:5952
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                          6⤵
                                                                            PID:6112
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                            6⤵
                                                                              PID:1252
                                                                          • C:\Users\Admin\AppData\Roaming\core_svc\Crisp.exe
                                                                            C:\Users\Admin\AppData\Roaming\core_svc\Crisp.exe
                                                                            5⤵
                                                                            • Loads dropped DLL
                                                                            • Drops file in Windows directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:5456
                                                                        • C:\Users\Admin\AppData\Local\AtoShard.exe
                                                                          C:\Users\Admin\AppData\Local\AtoShard.exe
                                                                          4⤵
                                                                          • Loads dropped DLL
                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:1140
                                                                        • C:\Users\Admin\AppData\Roaming\prorunner_32\Crisp.exe
                                                                          C:\Users\Admin\AppData\Roaming\prorunner_32\Crisp.exe
                                                                          4⤵
                                                                          • Loads dropped DLL
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:5748
                                                                  • C:\Windows\System32\rundll32.exe
                                                                    C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
                                                                    1⤵
                                                                      PID:4940
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                      1⤵
                                                                      • Drops file in Windows directory
                                                                      • Enumerates system info in registry
                                                                      • Modifies data under HKEY_USERS
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4616
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1c4ac728,0x7ffa1c4ac734,0x7ffa1c4ac740
                                                                        2⤵
                                                                          PID:4624
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,13045906666150211739,528396127901392470,262144 --field-trial-handle=1956,i,8809379674547074944,17804200976784888154,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1952 /prefetch:2
                                                                          2⤵
                                                                            PID:1916
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,4239795415459517321,17941205825912191315,524288 --field-trial-handle=1956,i,8809379674547074944,17804200976784888154,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2236 /prefetch:11
                                                                            2⤵
                                                                            • System Time Discovery
                                                                            PID:2796
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,6284046645360123132,4469522227990677234,524288 --field-trial-handle=1956,i,8809379674547074944,17804200976784888154,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2368 /prefetch:13
                                                                            2⤵
                                                                              PID:5640
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3100,i,10867011285394103532,10213615612406876958,2097152 --field-trial-handle=1956,i,8809379674547074944,17804200976784888154,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3152 /prefetch:1
                                                                              2⤵
                                                                                PID:5444
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3104,i,15714619284777071187,8355119356509550417,2097152 --field-trial-handle=1956,i,8809379674547074944,17804200976784888154,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3192 /prefetch:1
                                                                                2⤵
                                                                                  PID:1176
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,8504998627780837236,13372695111116555874,2097152 --field-trial-handle=1956,i,8809379674547074944,17804200976784888154,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4300 /prefetch:9
                                                                                  2⤵
                                                                                    PID:444
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4592,i,5451881514258079388,11211218304805622669,2097152 --field-trial-handle=1956,i,8809379674547074944,17804200976784888154,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4596 /prefetch:1
                                                                                    2⤵
                                                                                      PID:2240
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,1383763821776836024,17348287290620345602,524288 --field-trial-handle=1956,i,8809379674547074944,17804200976784888154,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5504 /prefetch:14
                                                                                      2⤵
                                                                                        PID:5408
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,15319995324785057085,12126755406673610812,524288 --field-trial-handle=1956,i,8809379674547074944,17804200976784888154,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=212 /prefetch:14
                                                                                        2⤵
                                                                                          PID:6032
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,7610217635761337202,16752373812032347052,524288 --field-trial-handle=1956,i,8809379674547074944,17804200976784888154,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5888 /prefetch:14
                                                                                          2⤵
                                                                                            PID:2884
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,15402618915483611221,8032945248073080237,524288 --field-trial-handle=1956,i,8809379674547074944,17804200976784888154,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5936 /prefetch:14
                                                                                            2⤵
                                                                                              PID:5488
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,13746333864511416825,4467335138873963629,524288 --field-trial-handle=1956,i,8809379674547074944,17804200976784888154,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4440 /prefetch:11
                                                                                              2⤵
                                                                                              • System Time Discovery
                                                                                              PID:4868
                                                                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                            1⤵
                                                                                              PID:2848
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                              1⤵
                                                                                                PID:4248
                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                1⤵
                                                                                                  PID:1212
                                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                  1⤵
                                                                                                    PID:1008
                                                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                    1⤵
                                                                                                      PID:5928
                                                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                      1⤵
                                                                                                        PID:4312
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                        1⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        • Enumerates system info in registry
                                                                                                        • Modifies data under HKEY_USERS
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                        PID:4480
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffa077fc188,0x7ffa077fc194,0x7ffa077fc1a0
                                                                                                          2⤵
                                                                                                            PID:980
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,2524673421627662586,15905346683775226568,524288 --field-trial-handle=2632,i,9591756704243575157,6137413663528649003,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:11
                                                                                                            2⤵
                                                                                                            • System Time Discovery
                                                                                                            PID:4060
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,5544983428159947676,2228789083528250803,262144 --field-trial-handle=2632,i,9591756704243575157,6137413663528649003,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:2
                                                                                                            2⤵
                                                                                                              PID:1692
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,6461724662931526930,17822750961192740719,524288 --field-trial-handle=2632,i,9591756704243575157,6137413663528649003,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:13
                                                                                                              2⤵
                                                                                                                PID:3064
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,2469006670752883293,9209869914891418525,2097152 --field-trial-handle=2632,i,9591756704243575157,6137413663528649003,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:244
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,14230039331840449034,555286198574182801,2097152 --field-trial-handle=2632,i,9591756704243575157,6137413663528649003,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:1952
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,1209407736546485729,5680118554226521609,524288 --field-trial-handle=2632,i,9591756704243575157,6137413663528649003,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
                                                                                                                    2⤵
                                                                                                                      PID:4136
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,13013923080417371523,5877063224922657275,524288 --field-trial-handle=2632,i,9591756704243575157,6137413663528649003,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
                                                                                                                      2⤵
                                                                                                                        PID:3544
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,10184306488175759472,12428980588793930360,524288 --field-trial-handle=2632,i,9591756704243575157,6137413663528649003,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
                                                                                                                        2⤵
                                                                                                                          PID:2576
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                                                                                            cookie_exporter.exe --cookie-json=1128
                                                                                                                            3⤵
                                                                                                                              PID:4608
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,12189295595612513587,16209242784459360134,524288 --field-trial-handle=2632,i,9591756704243575157,6137413663528649003,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
                                                                                                                            2⤵
                                                                                                                              PID:4796
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,12189295595612513587,16209242784459360134,524288 --field-trial-handle=2632,i,9591756704243575157,6137413663528649003,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
                                                                                                                              2⤵
                                                                                                                                PID:4152
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,4763859515516407919,5660867800212821228,524288 --field-trial-handle=2632,i,9591756704243575157,6137413663528649003,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
                                                                                                                                2⤵
                                                                                                                                  PID:2236
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,9303634434719329823,11655802310228578186,524288 --field-trial-handle=2632,i,9591756704243575157,6137413663528649003,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
                                                                                                                                  2⤵
                                                                                                                                    PID:5400
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,8705412270962528904,15964263717464389055,524288 --field-trial-handle=2632,i,9591756704243575157,6137413663528649003,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
                                                                                                                                    2⤵
                                                                                                                                      PID:1256
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                    1⤵
                                                                                                                                      PID:1716
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                      1⤵
                                                                                                                                        PID:5844
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                        1⤵
                                                                                                                                          PID:5616

                                                                                                                                        Network

                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              BookmarkMergedSurfaceOrdering
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                              • Size 6B
                                                                                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                              Submit Download

                                                                                                                                              BrowsingTopicsState
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                              • Size 649B
                                                                                                                                              • SHA256 23a71051faf68946154ecbf29d09f6b28c665ca7181f5d1abfa539130c2402df
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Network Persistent State
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                              • Size 3KB
                                                                                                                                              • SHA256 07ff573e88cdb1d565af3d48ab060a1b7939806a270211a117a25b41e4f9354c
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              SCT Auditing Pending Reports
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                              • Size 2B
                                                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                              Submit Download

                                                                                                                                              Preferences
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                              • Size 12KB
                                                                                                                                              • SHA256 3fb61244ade83cfd1a7bd7d9b716f6c19708713ef72e8a8835bbdf9ba42f5fca
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Preferences
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                              • Size 12KB
                                                                                                                                              • SHA256 af05b79eea8cf97e6fd017cd4dbf2c98e482c8fe295b947bf881f5e090e5d9cf
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Secure Preferences
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                              • Size 17KB
                                                                                                                                              • SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              the-real-index
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                              • Size 120B
                                                                                                                                              • SHA256 f5e1ed078b784aa3c39fd82692ebfbc35541138f40c7decaeb564ee4b064ffbb
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              the-real-index~RFe590814.TMP
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590814.TMP
                                                                                                                                              • Size 96B
                                                                                                                                              • SHA256 1a29846c28bbcfa95cdf257e328743816ee4b87570b62124e504ee28c1d98342
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Local State
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                              • Size 233KB
                                                                                                                                              • SHA256 e129ba5d4bbc40e43b1007d90c36fc7b3eee16a9eaebeba7d40fee9470e5df29
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Local State
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                              • Size 115KB
                                                                                                                                              • SHA256 aaf9126a4beee25d1d1a692b5fd06aba77fed81a354331208d2dee9343cd55f0
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Local State
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                              • Size 232KB
                                                                                                                                              • SHA256 4cde59cd626fe64b2e376bbade81785dc872ace9d2d1292aa7f988f42d08de19
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Local State
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                              • Size 232KB
                                                                                                                                              • SHA256 a6d160ecd08d2caf679f2cd2001371b131fd8c500bb8022aa4029940efbc8ed0
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              78eebe0d-d66a-4171-b63d-0bc7c8e93b87.tmp
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\78eebe0d-d66a-4171-b63d-0bc7c8e93b87.tmp
                                                                                                                                              • Size 25KB
                                                                                                                                              • SHA256 5f92ed6829bfe4400edbe157977d696d5712568543afa42ab45c4525ccbd5cee
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              settings.dat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                              • Size 280B
                                                                                                                                              • SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              settings.dat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                              • Size 280B
                                                                                                                                              • SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              BrowsingTopicsState
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                                              • Size 649B
                                                                                                                                              • SHA256 563b990c4de2029ce8bc738c66469961873e86e441aa952c60d6617e0ffb4e21
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              the-real-index
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                              • Size 4KB
                                                                                                                                              • SHA256 98993b240b9308d05f7b4b500aeb1096362f0413f4d6976b6760e0d05b7e5200
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              the-real-index~RFe59e054.TMP
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e054.TMP
                                                                                                                                              • Size 2KB
                                                                                                                                              • SHA256 6f4e3f34d3ea770e079d1b7bdf54a61968f26e0f9cb42653553a989a3aa1cfe6
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              SiteList-Enterprise.json
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                              • Size 2B
                                                                                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                              Submit Download

                                                                                                                                              HubApps
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                              • Size 106KB
                                                                                                                                              • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Sdch Dictionaries
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                              • Size 40B
                                                                                                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                              Submit Download

                                                                                                                                              Preferences
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                              • Size 17KB
                                                                                                                                              • SHA256 13f96c8c0768ff90dde2eb48475eccd5374f112fc351883591dd84ecc976f7f2
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Secure Preferences
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                              • Size 36KB
                                                                                                                                              • SHA256 f86e544077b6d032e0394770573a23d1db0d1bccdc6e7bb6eb0578c717c54467
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              the-real-index
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c60ff2a-c337-4df0-aaba-fe27b78528c8\index-dir\the-real-index
                                                                                                                                              • Size 72B
                                                                                                                                              • SHA256 f188ad01b2d256cca954876a0f64f06755be5a35dfe6a2962af680238fced4b1
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              the-real-index~RFe59c6c1.TMP
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c60ff2a-c337-4df0-aaba-fe27b78528c8\index-dir\the-real-index~RFe59c6c1.TMP
                                                                                                                                              • Size 72B
                                                                                                                                              • SHA256 d58549bfe6d64be92b4457e6d488aa603829efa7e6d2a357072cd34e04911f73
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              the-real-index
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\637e672d-35a0-487f-ada4-edb394e38f02\index-dir\the-real-index
                                                                                                                                              • Size 72B
                                                                                                                                              • SHA256 83a191f05dbdf1aa71401523543e302148b522e242cb918f3d75b55bd82c2c00
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              the-real-index~RFe59c402.TMP
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\637e672d-35a0-487f-ada4-edb394e38f02\index-dir\the-real-index~RFe59c402.TMP
                                                                                                                                              • Size 72B
                                                                                                                                              • SHA256 478c99b7eae4c57825e6660b5d3b13e1c75345c0b225a2d48f28804f45a15688
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              the-real-index
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\673ba0b2-ba38-4e02-b05c-f1c84ab818bc\index-dir\the-real-index
                                                                                                                                              • Size 72B
                                                                                                                                              • SHA256 8f607004faa62bdc5ec26a8982a91ea72bb1b3ccdbba76e633e30c448a6700f6
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              the-real-index~RFe59bcbe.TMP
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\673ba0b2-ba38-4e02-b05c-f1c84ab818bc\index-dir\the-real-index~RFe59bcbe.TMP
                                                                                                                                              • Size 72B
                                                                                                                                              • SHA256 761e2c5d15685acc2b9bfb0eab9503a9387f3986c18648fec1ad66dcabc23dcd
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              the-real-index
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index
                                                                                                                                              • Size 3KB
                                                                                                                                              • SHA256 1e9b4f925cfc45cf6486f3b2834d440abd50b66665da74fe20cf2730e8c43d33
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              index.txt
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                              • Size 476B
                                                                                                                                              • SHA256 18aaf9a90c343da73193490e3fe224670fd1c5420bfa7ec4958eaf8f41a0a398
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              the-real-index
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                              • Size 72B
                                                                                                                                              • SHA256 40a7aa427808b6be2e49371d0bdca2f0fecd0cb3f5465922db835bcedba48c0f
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              sync_diagnostic.log
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                              • Size 23KB
                                                                                                                                              • SHA256 9d0fbf651046a80cc25d60fa43029622c5d860b0e5b21c64a8c20958aec0abec
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Local State
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                              • Size 28KB
                                                                                                                                              • SHA256 0c08c517cc8ca927a8a0a1c8f12f120e76ec3a1f4efcaa02f21d73f878fea2d4
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Local State
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                              • Size 28KB
                                                                                                                                              • SHA256 87843bd365ecc0c529620c7deb110c5f838f750a6bf83a0f64428e9e55359639
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Local State
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                              • Size 25KB
                                                                                                                                              • SHA256 f23863f6cdfbf09d7e2aea8270bf5d61613adf4aaa73167503619ad32bbd3d28
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              0aca-1528-5f2a-4794.tmp
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\0aca-1528-5f2a-4794.tmp
                                                                                                                                              • Size 18KB
                                                                                                                                              • SHA256 6acb7e7290c5dfd5702918e33f68b73ec03ef44f7a8a20cb0004db2ce108aebd
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              DeltaGen32.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\DeltaGen32.exe
                                                                                                                                              • Size 831KB
                                                                                                                                              • SHA256 5ae7e664fbf3f02012f93df4d3adf79196168ff09b33bbbfee0226214e6395ea
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Zip.dll
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Zip.dll
                                                                                                                                              • Size 1.2MB
                                                                                                                                              • SHA256 ba42d1181e7c9651af50abedf9737d4aefa4afcb4928eb4b131ed1cecda366a5
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              __PSScriptPolicyTest_1pgcxx0n.yk1.ps1
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1pgcxx0n.yk1.ps1
                                                                                                                                              • Size 60B
                                                                                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              driver-reg.so
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\driver-reg.so
                                                                                                                                              • Size 14KB
                                                                                                                                              • SHA256 0c2e5ad2bbaaa78b286744ca62e75ecf4cfc31c7fb6c74abeb96860ab790932a
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              madBasic_.bpl
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\madBasic_.bpl
                                                                                                                                              • Size 212KB
                                                                                                                                              • SHA256 a75c8065e0fde6e211c5efb5695089d284ac26f802e6441c19bb0e663ee3efa5
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              madDisAsm_.bpl
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\madDisAsm_.bpl
                                                                                                                                              • Size 64KB
                                                                                                                                              • SHA256 20ddd0bdf076a91d9d82c8e447e1dbf6dba52fe6613cfe1e5373aeac7f889b62
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              madExcept_.bpl
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\madExcept_.bpl
                                                                                                                                              • Size 438KB
                                                                                                                                              • SHA256 655c2a4b484ce587c8c99cbc17f7cada640e79fc8f92b4de2d68882d79c0c815
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              msvcp_win.dll
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
                                                                                                                                              • Size 493KB
                                                                                                                                              • SHA256 9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              parserlib.dump
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\parserlib.dump
                                                                                                                                              • Size 14.1MB
                                                                                                                                              • SHA256 e38be4c0827fc0cc70840111571d34e9998d1c579c3c67a4bc7eb9d4c306109c
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              rtl120.bpl
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\rtl120.bpl
                                                                                                                                              • Size 1.1MB
                                                                                                                                              • SHA256 b3dee68af7b2805f6cf74976b60564dcc7d6d38444078d32cdca99ee1bb5bb22
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              ucrtbase.dll
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
                                                                                                                                              • Size 1.1MB
                                                                                                                                              • SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              vcl120.bpl
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\vcl120.bpl
                                                                                                                                              • Size 1.9MB
                                                                                                                                              • SHA256 52b78e79ae9b9cccd8f85dea12dd8f5dbc8ffb62f9bc537efb1ced7a4b21c244
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Transponder-Sonic.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\prorunner_32\OGEYXWXBGOZKFIQM\Transponder-Sonic.exe
                                                                                                                                              • Size 111KB
                                                                                                                                              • SHA256 78f20fb763f46a5f91eb7dfdb18aa0c67f068dcd43a2f736ff39deda3621564c
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              glib-2.0.dll
                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\prorunner_32\OGEYXWXBGOZKFIQM\glib-2.0.dll
                                                                                                                                              • Size 1.1MB
                                                                                                                                              • SHA256 a9a8b1859525c8c145994512e8dc399613a95c4142e472008be3dbe04c62d42b
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              glibmm-2.4.dll
                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\prorunner_32\OGEYXWXBGOZKFIQM\glibmm-2.4.dll
                                                                                                                                              • Size 407KB
                                                                                                                                              • SHA256 93ec1200ae17c5b357d4b8b463ce91bc8a108f7add309bee2cd34cbb22720a54
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              gmodule-2.0.dll
                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\prorunner_32\OGEYXWXBGOZKFIQM\gmodule-2.0.dll
                                                                                                                                              • Size 25KB
                                                                                                                                              • SHA256 e308a5b66ecbaf23598847e7b8b945a8a568c194145761ce92508daf6a3c20c9
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              gobject-2.0.dll
                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\prorunner_32\OGEYXWXBGOZKFIQM\gobject-2.0.dll
                                                                                                                                              • Size 301KB
                                                                                                                                              • SHA256 0aade8ac07b5c874f374e8c5d0643c72b5bd930d3c04829a64572e7c86df380e
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              msvcp140.dll
                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\prorunner_32\OGEYXWXBGOZKFIQM\msvcp140.dll
                                                                                                                                              • Size 437KB
                                                                                                                                              • SHA256 74e9268a68118bb1ac5154f8f327887715960ccc37ba9dabbe31ecd82dcbaa55
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              pcre.dll
                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\prorunner_32\OGEYXWXBGOZKFIQM\pcre.dll
                                                                                                                                              • Size 378KB
                                                                                                                                              • SHA256 4f9bd06ed3a3fce8b7fbfd830e87593d7a28c89e0066715a9220fa17e53cd741
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              sigc-2.0.dll
                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\prorunner_32\OGEYXWXBGOZKFIQM\sigc-2.0.dll
                                                                                                                                              • Size 39KB
                                                                                                                                              • SHA256 9d44f6f17a30e86323a06a3f47b437ec766e3e54d1cd54a97a4cd8bd4195ed7a
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              vcruntime140.dll
                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\prorunner_32\OGEYXWXBGOZKFIQM\vcruntime140.dll
                                                                                                                                              • Size 88KB
                                                                                                                                              • SHA256 65f620bc588d95fe2ed236d1602e49f89077b434c83102549eed137c7fdc7220
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              vmwarebase.DLL
                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\prorunner_32\OGEYXWXBGOZKFIQM\vmwarebase.DLL
                                                                                                                                              • Size 6.7MB
                                                                                                                                              • SHA256 72ff278ebc8ed26ddd6a2a0d8428637aee26d6c05482fa8f6762053507415b63
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              vmwarestring.dll
                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\prorunner_32\OGEYXWXBGOZKFIQM\vmwarestring.dll
                                                                                                                                              • Size 57KB
                                                                                                                                              • SHA256 1b13f67dfe0482cfb6073c91d718d2a6916126d8ce295dd97008e813d000e9f4
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              memory/1140-215-0x00007FF77FAE0000-0x00007FF77FBFF000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1140-249-0x00007FF77FAE0000-0x00007FF77FBFF000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1140-228-0x00007FF77FAE0000-0x00007FF77FBFF000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1140-274-0x00007FF77FAE0000-0x00007FF77FBFF000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3884-181-0x000002336CBA0000-0x000002336D662000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3884-172-0x000002336DA30000-0x000002336DA52000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4460-232-0x00000000009F0000-0x0000000000A0D000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4460-199-0x0000000075250000-0x000000007529F000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4460-169-0x0000000075250000-0x000000007529F000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4460-167-0x00007FFA3D9C0000-0x00007FFA3DBC9000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4460-166-0x0000000075250000-0x000000007529F000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5456-251-0x00007FFA3D9C0000-0x00007FFA3DBC9000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5456-294-0x0000000075250000-0x000000007529F000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5652-134-0x0000000075250000-0x000000007529F000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5652-101-0x0000000075250000-0x000000007529F000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5652-89-0x0000000000BA0000-0x0000000000CDA000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5652-98-0x0000000075250000-0x000000007529F000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5652-99-0x00007FFA3D9C0000-0x00007FFA3DBC9000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5652-194-0x0000000050000000-0x0000000050117000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5652-100-0x0000000075267000-0x0000000075268000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5652-197-0x0000000050120000-0x000000005030E000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5652-103-0x0000000075250000-0x000000007529F000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5652-145-0x0000000075250000-0x000000007529F000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5652-190-0x0000000075250000-0x000000007529F000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5652-201-0x0000000075267000-0x0000000075268000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5652-192-0x0000000000400000-0x00000000004D1000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5652-198-0x0000000000BA0000-0x0000000000CDA000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5748-250-0x00007FFA3D9C0000-0x00007FFA3DBC9000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5828-90-0x0000000059800000-0x000000005986E000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5828-93-0x0000000057800000-0x0000000057812000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5828-50-0x0000000000BB0000-0x0000000000CEA000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5828-53-0x00000000739A0000-0x00000000739EF000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5828-54-0x00007FFA3D9C0000-0x00007FFA3DBC9000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5828-95-0x0000000000BB0000-0x0000000000CEA000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5828-94-0x0000000050120000-0x000000005030E000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5828-92-0x0000000050000000-0x0000000050117000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5828-91-0x0000000057000000-0x000000005703F000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5828-76-0x0000000000400000-0x00000000004D1000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5952-878-0x0000000001310000-0x00000000016DA000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5952-352-0x0000000001310000-0x00000000016DA000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5952-308-0x0000000001310000-0x00000000016DA000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5952-330-0x0000000001310000-0x00000000016DA000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5952-245-0x0000000001310000-0x00000000016DA000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5952-220-0x00007FFA3D9C0000-0x00007FFA3DBC9000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5952-255-0x0000000001310000-0x00000000016DA000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5952-1205-0x0000000001310000-0x00000000016DA000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5952-219-0x0000000001310000-0x00000000016DA000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5952-411-0x0000000001310000-0x00000000016DA000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5952-218-0x0000000001310000-0x00000000016DA000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5952-1314-0x0000000001310000-0x00000000016DA000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6008-189-0x000001CA96660000-0x000001CA97122000-memory.dmp
                                                                                                                                              Download