Overview

overview

8

Static

static

1

HotspotShi...in.exe

windows10-2004-x64

8

HotspotShi...in.exe

windows11-ltsc_2024-x64

4

Analysis

  • user interaction
    yes
  • max time kernel
    115s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/08/2026, 00:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    HotspotShield-12.14.1-plain-773-plain.exe
  • Size 28.1MB
  • Sample260807-a3721sdn21
  • SHA256 7a04a9886ec1d530872b2a6ce62689fcc312772bb88c2f506a0e4e50a341a3ae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Drops file in Drivers directory 5 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 26 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 14 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HotspotShield-12.14.1-plain-773-plain.exe
    "C:\Users\Admin\AppData\Local\Temp\HotspotShield-12.14.1-plain-773-plain.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Windows\Temp\{9DADA2F4-3A9D-4206-99A5-4186D614C524}\.cr\HotspotShield-12.14.1-plain-773-plain.exe
      "C:\Windows\Temp\{9DADA2F4-3A9D-4206-99A5-4186D614C524}\.cr\HotspotShield-12.14.1-plain-773-plain.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\HotspotShield-12.14.1-plain-773-plain.exe" -burn.filehandle.attached=536 -burn.filehandle.self=532
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1396
      • C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.be\HSS-12.9.7-install-plain-773-plain.exe
        "C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.be\HSS-12.9.7-install-plain-773-plain.exe" -q -burn.elevated BurnPipe.{A12DFE4D-F714-4E6E-B8F5-2C32B83F373D} {0324B947-2AB5-4E2D-BD44-8CC2AA632E0F} 1396
        3⤵
        • Adds Run key to start application
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4456
      • C:\Program Files (x86)\Hotspot Shield\12.9.7\bin\hsscp.exe
        "C:\Program Files (x86)\Hotspot Shield\12.9.7\bin\hsscp.exe" -noconnect
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3112
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4F492881C9735C00A39902DBA3AA42F8
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1244
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIFD77.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240713078 4 Hss.Setup.Actions!Hss.Setup.Actions.CustomActions.Disconnect
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:628
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI66.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240713859 8 Hss.Setup.Actions!Hss.Setup.Actions.CustomActions.ServiceExecuteCommand
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4636
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI180.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240714125 12 Foundation.Installer.CustomActions!Foundation.Installer.CustomActions.Maintenance.MaintenanceActions.Sleep
        3⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4500
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI17A9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240719781 17 Foundation.Installer.CustomActions!Foundation.Installer.CustomActions.Maintenance.MaintenanceActions.SetEpochTime
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:3756
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI1911.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240720156 22 Hss.Setup.Actions!Hss.Setup.Actions.CustomActions.SetDeleteServicesOnUpgrade
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:5080
      • C:\Windows\SysWOW64\icacls.exe
        "C:\Windows\SysWOW64\icacls.exe" "C:\ProgramData\Hotspot Shield\system" /inheritance:r /grant *S-1-5-32-544:(OI)(CI)(F) /grant *S-1-5-18:(OI)(CI)(F)
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:2964
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 3C7275D515EC1E50FC059308F0B132E0 E Global\MSI0000
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI21F2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240722578 75 Foundation.Installer.CustomActions!Foundation.Installer.CustomActions.Maintenance.MaintenanceActions.StopWinService
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:4528
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI2406.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240722953 81 Foundation.Installer.CustomActions!Foundation.Installer.CustomActions.Maintenance.MaintenanceActions.StopWinService
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:4176
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI2C96.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240725156 102 Hss.Setup.Actions!Hss.Setup.Actions.NetFilterCustomActions.InstallNetFilterDriver
        3⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3492
        • C:\Program Files (x86)\Hotspot Shield\12.9.7\driver\pango_netfilter2\nfregdrv.exe
          "C:\Program Files (x86)\Hotspot Shield\12.9.7\driver\pango_netfilter2\nfregdrv.exe" pango_netfilter2
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2252
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI43F7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240731109 130 Foundation.Installer.CustomActions!Foundation.Installer.CustomActions.Networking.NetworkAdapterActions.InstallTapDrivers
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1748
        • C:\Program Files (x86)\Hotspot Shield\12.9.7\driver\hsstap-windows-9.24.4-I601-Win10.exe
          "C:\Program Files (x86)\Hotspot Shield\12.9.7\driver\hsstap-windows-9.24.4-I601-Win10.exe" /S
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1548
          • C:\Program Files\HotspotShield TAP-Windows\bin\tapinstall.exe
            "C:\Program Files\HotspotShield TAP-Windows\bin\tapinstall.exe" hwids hsstap
            5⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            PID:3920
          • C:\Program Files\HotspotShield TAP-Windows\bin\tapinstall.exe
            "C:\Program Files\HotspotShield TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\HotspotShield TAP-Windows\driver\oemvista.inf" hsstap
            5⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:612
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI4E0A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240733703 150 Foundation.Installer.CustomActions!Foundation.Installer.CustomActions.Networking.NetworkAdapterActions.ResetTapNetworkAdapter
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4704
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\system32\netsh.exe" int ip set address "Local Area Connection" dhcp
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1888
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\system32\netsh.exe" int ip set dns "Local Area Connection" dhcp
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4892
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI54B2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240735421 160 Foundation.Installer.CustomActions!Foundation.Installer.CustomActions.Networking.NetworkAdapterActions.LowerInterfaceMetric
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1292
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\system32\netsh.exe" int ip set interface 10 metric=10
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4684
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI581E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240736281 169 Foundation.Installer.CustomActions!Foundation.Installer.CustomActions.Networking.NetworkAdapterActions.RenameTapAdapters
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:3756
      • C:\Windows\SysWOW64\CMD.exe
        "C:\Windows\SysWOW64\CMD.exe" /C ECHO N | "C:\Windows\SysWOW64\REG.exe" ADD "HKLM\SOFTWARE\HotspotShield" /v client_tag /d plain-773-plain
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3124
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" ECHO N "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5088
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\SysWOW64\REG.exe" ADD "HKLM\SOFTWARE\HotspotShield" /v client_tag /d plain-773-plain
          4⤵
          • System Location Discovery: System Language Discovery
          PID:640
      • C:\Windows\SysWOW64\CMD.exe
        "C:\Windows\SysWOW64\CMD.exe" /C ECHO N | "C:\Windows\SysWOW64\REG.exe" ADD "HKLM\SOFTWARE\HotspotShield" /v hash_v /d 4 /t REG_DWORD
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3912
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" ECHO N "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3676
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\SysWOW64\REG.exe" ADD "HKLM\SOFTWARE\HotspotShield" /v hash_v /d 4 /t REG_DWORD
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3760
      • C:\Windows\SysWOW64\CMD.exe
        "C:\Windows\SysWOW64\CMD.exe" /C ECHO N | "C:\Windows\SysWOW64\REG.exe" ADD "HKLM\SOFTWARE\HotspotShield" /v install_time /d 1786063561464
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4176
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" ECHO N "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1416
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\SysWOW64\REG.exe" ADD "HKLM\SOFTWARE\HotspotShield" /v install_time /d 1786063561464
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4988
      • C:\Windows\SysWOW64\CMD.exe
        "C:\Windows\SysWOW64\CMD.exe" /C ECHO N | "C:\Windows\SysWOW64\REG.exe" ADD "HKLM\SOFTWARE\HotspotShield\Fx" /v InstallerPath /d C:\Users\Admin\AppData\Local\Temp\HotspotShield-12.14.1-plain-773-plain.exe
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" ECHO N "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2280
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\SysWOW64\REG.exe" ADD "HKLM\SOFTWARE\HotspotShield\Fx" /v InstallerPath /d C:\Users\Admin\AppData\Local\Temp\HotspotShield-12.14.1-plain-773-plain.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2884
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI5FE4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240738281 187 Hss.Setup.Actions!Hss.Setup.Actions.CustomActions.RepairHosts
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:4568
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI8EA9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240750218 204 Hss.Setup.Actions!Hss.Setup.Actions.CustomActions.InstallFinalCleanup
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1948
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\system32\sc.exe" delete hshld
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1944
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI8FC4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240750515 208 Hss.Setup.Actions!Hss.Setup.Actions.CustomActions.InstallWebview2Runtime
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:3756
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI9061.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240750671 213 Hss.Setup.Actions!Hss.Setup.Actions.CustomActions.WaitForManagementChannel
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1224
  • C:\ProgramData\Package Cache\{ee7cb9b6-623a-4c36-aa28-9195d3f8ac19}\HSS-12.9.7-install-plain-773-plain.exe
    "C:\ProgramData\Package Cache\{ee7cb9b6-623a-4c36-aa28-9195d3f8ac19}\HSS-12.9.7-install-plain-773-plain.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3544
    • C:\ProgramData\Package Cache\{ee7cb9b6-623a-4c36-aa28-9195d3f8ac19}\HSS-12.9.7-install-plain-773-plain.exe
      "C:\ProgramData\Package Cache\{ee7cb9b6-623a-4c36-aa28-9195d3f8ac19}\HSS-12.9.7-install-plain-773-plain.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Hotspot_Shield_12.9.7_20260807014542.log"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4120
      • C:\ProgramData\Package Cache\{ee7cb9b6-623a-4c36-aa28-9195d3f8ac19}\HSS-12.9.7-install-plain-773-plain.exe
        "C:\ProgramData\Package Cache\{ee7cb9b6-623a-4c36-aa28-9195d3f8ac19}\HSS-12.9.7-install-plain-773-plain.exe" -burn.clean.room="C:\ProgramData\Package Cache\{ee7cb9b6-623a-4c36-aa28-9195d3f8ac19}\HSS-12.9.7-install-plain-773-plain.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Hotspot_Shield_12.9.7_20260807014542.log"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1232
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "1" "c:\program files\hotspotshield tap-windows\driver\oemvista.inf" "9" "4d6f484c7" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files\hotspotshield tap-windows\driver"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3092
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:hsstap.ndi:9.24.4.601:hsstap," "4d6f484c7" "0000000000000154"
      2⤵
      • Drops file in Drivers directory
      • Checks SCSI registry key(s)
      PID:1944
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
      PID:512
    • C:\Program Files (x86)\Hotspot Shield\12.9.7\bin\cmw_srv.exe
      "C:\Program Files (x86)\Hotspot Shield\12.9.7\bin\cmw_srv.exe"
      1⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2716
      • C:\Program Files (x86)\Hotspot Shield\12.9.7\bin\hsscp.exe
        "C:\Program Files (x86)\Hotspot Shield\12.9.7\bin\hsscp.exe" "-closeupgrade"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:964
      • C:\Program Files (x86)\Hotspot Shield\12.9.7\bin\x64\hydra.exe
        "C:\Program Files (x86)\Hotspot Shield\12.9.7\bin\x64\hydra.exe" --rdy 3AC4F47AC899042B
        2⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:864
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" interface ip set address "HotspotShield Network Adapter" static 100.127.255.249 255.255.255.248 100.127.255.254
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:1572
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" interface ip set dns "HotspotShield Network Adapter" static 8.8.8.8
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:4976
    • C:\Program Files (x86)\Hotspot Shield\12.9.7\bin\hsscp.exe
      "C:\Program Files (x86)\Hotspot Shield\12.9.7\bin\hsscp.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      PID:4444
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5308
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe91d8c728,0x7ffe91d8c734,0x7ffe91d8c740
        2⤵
          PID:5324
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,5530929460703860198,14623035599825362564,262144 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1936 /prefetch:2
          2⤵
            PID:5512
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,10396541568398439451,1954639866881891305,524288 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:3
            2⤵
            • System Time Discovery
            PID:5532
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,3876639834867478902,18317166067712548583,524288 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2724 /prefetch:8
            2⤵
              PID:5612
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,4933422219961187992,9448098669555442080,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
              2⤵
                PID:5748
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,18437671952329502461,13251874853861323776,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
                2⤵
                  PID:5760
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4572,i,16218216542448813177,4907579865984921148,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4584 /prefetch:1
                  2⤵
                    PID:5920
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,15136428159582167590,13433505477023259582,524288 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5284 /prefetch:8
                    2⤵
                      PID:6128
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5644,i,9707396045537715012,18022120695843955905,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:1
                      2⤵
                        PID:5232
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5776,i,316173710157871633,14287181363652466667,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:1
                        2⤵
                          PID:6048
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3368,i,8789495824524270943,4653444025280164066,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3444 /prefetch:1
                          2⤵
                            PID:5900
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3264,i,14049907789506073045,17602433761006817193,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:1
                            2⤵
                              PID:5856
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5984,i,16297152369851306303,4980415668225907712,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:1
                              2⤵
                                PID:4740
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3384,i,2811391678533455691,16926803173424311742,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6128 /prefetch:1
                                2⤵
                                  PID:1000
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6280,i,7578187146180716297,18175888120522737720,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6296 /prefetch:1
                                  2⤵
                                    PID:2776
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6264,i,14182712052016445304,4410818494751406266,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6444 /prefetch:1
                                    2⤵
                                      PID:5716
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6616,i,6041932342391707262,13091488890239765455,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6632 /prefetch:1
                                      2⤵
                                        PID:6124
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=7064,i,3403430814419059774,7866461955729674523,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7060 /prefetch:1
                                        2⤵
                                          PID:804
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3944,i,8803959741015124427,17793816046493584772,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6904 /prefetch:1
                                          2⤵
                                            PID:5204
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6272,i,4505743589928315219,2552668440987889010,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:1
                                            2⤵
                                              PID:5752
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3300,i,16346073831230223262,12782895292768129004,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:1
                                              2⤵
                                                PID:1108
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7140,i,13280905082149262563,3330161504216045373,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7136 /prefetch:1
                                                2⤵
                                                  PID:3920
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7428,i,6573064323052246546,12887065551934594042,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7440 /prefetch:1
                                                  2⤵
                                                    PID:5848
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7580,i,1510431462797040872,3182405735902602043,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7592 /prefetch:1
                                                    2⤵
                                                      PID:5868
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7732,i,18042578718767625813,9983776615100835493,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7748 /prefetch:1
                                                      2⤵
                                                        PID:5876
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7884,i,18310943450750266251,18317344407254660239,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7900 /prefetch:1
                                                        2⤵
                                                          PID:5884
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=8036,i,8541751596992635840,15224742802692262388,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8052 /prefetch:1
                                                          2⤵
                                                            PID:536
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=8104,i,6669323156419138554,429052902456009630,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8208 /prefetch:1
                                                            2⤵
                                                              PID:2204
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=8348,i,11359140907055856379,7431738180569854479,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8364 /prefetch:1
                                                              2⤵
                                                                PID:5032
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=8520,i,13583209021010839378,14140158499382786164,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8528 /prefetch:1
                                                                2⤵
                                                                  PID:1048
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=8668,i,9860968069249070388,657539004089405265,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8680 /prefetch:1
                                                                  2⤵
                                                                    PID:1840
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=8828,i,10399169701435376044,17446802280567016512,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8808 /prefetch:1
                                                                    2⤵
                                                                      PID:4708
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=8976,i,12307197025869906739,18360673844947575586,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8972 /prefetch:1
                                                                      2⤵
                                                                        PID:6136
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5388,i,6996742847127330198,2968473646458892239,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8508 /prefetch:1
                                                                        2⤵
                                                                          PID:6856
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,17970970037399004033,16428443487628114967,524288 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6084 /prefetch:8
                                                                          2⤵
                                                                            PID:6220
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,15668999974516733932,15769226199249755986,524288 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6060 /prefetch:8
                                                                            2⤵
                                                                              PID:6228
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,5129898741519308479,2693734907689288365,524288 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6048 /prefetch:8
                                                                              2⤵
                                                                                PID:6200
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6044,i,12410744871238277056,3697623448221139423,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6896 /prefetch:1
                                                                                2⤵
                                                                                  PID:6840
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6952,i,2513158792959274586,346635569331978865,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6956 /prefetch:1
                                                                                  2⤵
                                                                                    PID:6852
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=8116,i,1548334774180458792,642861432382171927,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6056 /prefetch:1
                                                                                    2⤵
                                                                                      PID:2068
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=8464,i,1982898932228009390,17487058190593717389,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9108 /prefetch:1
                                                                                      2⤵
                                                                                        PID:2744
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6020,i,7317384775340988376,7952922921750167367,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6240 /prefetch:1
                                                                                        2⤵
                                                                                          PID:3312
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=8480,i,13919068432621537300,4555242524196392347,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3420 /prefetch:1
                                                                                          2⤵
                                                                                            PID:5232
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=8448,i,13294248805363974094,6024000349061377753,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6112 /prefetch:1
                                                                                            2⤵
                                                                                              PID:5856
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6236,i,7543047373830675225,15306193927731328958,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8676 /prefetch:1
                                                                                              2⤵
                                                                                                PID:5172
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=8460,i,5654065365011557654,2653160015233887794,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8712 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:6328
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=8412,i,2436849761439499492,9568604463880006020,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8320 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:5824
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7736,i,6788732616745977035,15920357584287922483,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7972 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:6340
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=8560,i,364554716314775073,14528070349196646639,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:6452
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=8600,i,5030585767056021592,10643671780427952171,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9124 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:6336
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=8516,i,13255507210723478590,278460331185304702,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7604 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:4448
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=8528,i,2384282431285952883,5165531155869169926,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7548 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:1784
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=5464,i,6262054359253424733,12908895767961652958,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6720 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:6292
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=6704,i,16161194344992896238,79175881188613403,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3500 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:6320
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=3472,i,15079151463655822146,4356944547146566897,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:1048
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=8332,i,8914951663525165252,10904706452156830845,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5652 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:6984
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=6816,i,2455728444685742436,8477699625742461809,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6508 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:7008
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=240,i,14025748959742696738,4034433918453801927,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=9324 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:6776
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=9332,i,1217599073584199478,4013741299872203630,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6060 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:6784
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=3468,i,11466709632360323635,7034905477235122468,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7392 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:6788
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=7324,i,10719947887113467655,2903353490787757592,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8672 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:6796
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=7876,i,18009292039401684607,7664881390697498154,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7808 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:6804
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=7720,i,6136756119071738016,9959250770400882057,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7744 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:6816
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=3432,i,595598609274323954,16556917087661892876,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6068 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:7028
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=9236,i,998917041401144258,10199905151803155699,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7680 /prefetch:1
                                                                                                                                      2⤵
                                                                                                                                        PID:6828
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=7500,i,8723461300651886232,12374460738689258720,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7124 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:6848
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=3316,i,3656562375739036565,14011360813452142019,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7164 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:4236
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=9400,i,15514965429321319536,5228128436441244088,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8352 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:6024
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=9424,i,18092710022792957473,10493874328873572584,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10604 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:6020
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=9440,i,9072740851272907847,832081183483196078,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10656 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:5940
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=9464,i,18400806647485424553,14975599111687901126,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10640 /prefetch:1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3720
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=9488,i,6726950223659583288,10209884036589595499,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10480 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2180
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=9512,i,15165517882581267165,1911296337989319161,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10396 /prefetch:1
                                                                                                                                                      2⤵
                                                                                                                                                        PID:432
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=9540,i,6496069169973167191,15335909237335355484,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10360 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:5204
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=9564,i,14598713052057886703,12636723125774585049,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10432 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5500
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=9712,i,5494386120873484508,14757928852303512343,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=10228 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5540
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=5896,i,3002158053279530084,1738740305333236214,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7488 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                                PID:7728
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=5912,i,5302794401450751077,8526119691195711996,2097152 --field-trial-handle=1940,i,8657866449744655694,18138736039977867365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:1
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:7736
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:5712
                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:2840

                                                                                                                                                                  Network

                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                        Reconnaissance

                                                                                                                                                                        Resource Development

                                                                                                                                                                        Initial Access

                                                                                                                                                                        Execution

                                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                                        1
                                                                                                                                                                        T1059

                                                                                                                                                                        Windows Command Shell

                                                                                                                                                                        1
                                                                                                                                                                        T1059.003

                                                                                                                                                                        System Services

                                                                                                                                                                        1
                                                                                                                                                                        T1569

                                                                                                                                                                        Service Execution

                                                                                                                                                                        1
                                                                                                                                                                        T1569.002

                                                                                                                                                                        Persistence

                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                        1
                                                                                                                                                                        T1547

                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                        1
                                                                                                                                                                        T1547.001

                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                        1
                                                                                                                                                                        T1543

                                                                                                                                                                        Windows Service

                                                                                                                                                                        1
                                                                                                                                                                        T1543.003

                                                                                                                                                                        Event Triggered Execution

                                                                                                                                                                        1
                                                                                                                                                                        T1546

                                                                                                                                                                        Netsh Helper DLL

                                                                                                                                                                        1
                                                                                                                                                                        T1546.007

                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                        1
                                                                                                                                                                        T1547

                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                        1
                                                                                                                                                                        T1547.001

                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                        1
                                                                                                                                                                        T1543

                                                                                                                                                                        Windows Service

                                                                                                                                                                        1
                                                                                                                                                                        T1543.003

                                                                                                                                                                        Event Triggered Execution

                                                                                                                                                                        1
                                                                                                                                                                        T1546

                                                                                                                                                                        Netsh Helper DLL

                                                                                                                                                                        1
                                                                                                                                                                        T1546.007

                                                                                                                                                                        Defense Evasion

                                                                                                                                                                        File and Directory Permissions Modification

                                                                                                                                                                        1
                                                                                                                                                                        T1222

                                                                                                                                                                        Impair Defenses

                                                                                                                                                                        1
                                                                                                                                                                        T1562

                                                                                                                                                                        Modify Registry

                                                                                                                                                                        2
                                                                                                                                                                        T1112

                                                                                                                                                                        Credential Access

                                                                                                                                                                        Discovery

                                                                                                                                                                        Browser Information Discovery

                                                                                                                                                                        1
                                                                                                                                                                        T1217

                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                        2
                                                                                                                                                                        T1120

                                                                                                                                                                        Query Registry

                                                                                                                                                                        6
                                                                                                                                                                        T1012

                                                                                                                                                                        System Information Discovery

                                                                                                                                                                        6
                                                                                                                                                                        T1082

                                                                                                                                                                        System Location Discovery

                                                                                                                                                                        1
                                                                                                                                                                        T1614

                                                                                                                                                                        System Language Discovery

                                                                                                                                                                        1
                                                                                                                                                                        T1614.001

                                                                                                                                                                        System Time Discovery

                                                                                                                                                                        1
                                                                                                                                                                        T1124

                                                                                                                                                                        Lateral Movement

                                                                                                                                                                        Collection

                                                                                                                                                                        Command and Control

                                                                                                                                                                        Exfiltration

                                                                                                                                                                        Impact

                                                                                                                                                                        Service Stop

                                                                                                                                                                        1
                                                                                                                                                                        T1489

                                                                                                                                                                        Replay Monitor

                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                        Downloads

                                                                                                                                                                        e58f2f9.rbs
                                                                                                                                                                        • Path C:\Config.Msi\e58f2f9.rbs
                                                                                                                                                                        • Size 487KB
                                                                                                                                                                        • SHA256 94b0a0182615e27cbf7f15a5216af3e2ea6e45646ec84ffd471689aab46b4186
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        e58f2fb.rbs
                                                                                                                                                                        • Path C:\Config.Msi\e58f2fb.rbs
                                                                                                                                                                        • Size 497B
                                                                                                                                                                        • SHA256 572fff11f8ecc452602e455d70070349e9b52659629d355831bf8156b913cd2e
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        hsscp.exe
                                                                                                                                                                        • Path C:\Program Files (x86)\Hotspot Shield\12.9.7\bin\hsscp.exe
                                                                                                                                                                        • Size 383KB
                                                                                                                                                                        • SHA256 4d8a06937ba0cb9639c6586f81e4a50c921921f5dc5618f1e9666f63ef0f29c5
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        afvpn.dll
                                                                                                                                                                        • Path C:\Program Files (x86)\Hotspot Shield\12.9.7\bin\x86\afvpn.dll
                                                                                                                                                                        • Size 2.7MB
                                                                                                                                                                        • SHA256 660ead88423377e75220a40f9e7fcdf65aa61d3d8e1b008110f48de276475745
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        hsssvc.12.9.7.12246.2026-08-07.jlog
                                                                                                                                                                        • Path C:\ProgramData\Hotspot Shield\system\logs\hsssvc.12.9.7.12246.2026-08-07.jlog
                                                                                                                                                                        • Size 10KB
                                                                                                                                                                        • SHA256 3bc1fe81e416ace4c00c29060e5f4b92f467be46c409a6229a1ee139da5caa3e
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        hsssvc.12.9.7.12246.2026-08-07.log
                                                                                                                                                                        • Path C:\ProgramData\Hotspot Shield\system\logs\hsssvc.12.9.7.12246.2026-08-07.log
                                                                                                                                                                        • Size 7KB
                                                                                                                                                                        • SHA256 ed62262fe7c1c7c7d979529079e426a2ed82f556e84cb9c03e0015d6739e530f
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        events.raw
                                                                                                                                                                        • Path C:\ProgramData\Hotspot Shield\user\rep\events.raw
                                                                                                                                                                        • Size 13KB
                                                                                                                                                                        • SHA256 9b0f2dda76bdc1c5525061850829067e3c9f7e4ee0dd5f4b0ece955cc0e09794
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        events.raw
                                                                                                                                                                        • Path C:\ProgramData\Hotspot Shield\user\rep\events.raw
                                                                                                                                                                        • Size 3KB
                                                                                                                                                                        • SHA256 9cb5ada1308867f4828aac6fddb925067232d19916f1f81831cf385fe01cf113
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                        • Size 471B
                                                                                                                                                                        • SHA256 0dced543fbf60c63698ebf816aa4be901abbccc965f3d1b77f4e7d0b4b401ee9
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        8EC9B1D0ABBD7F98B401D425828828CE_B1A0B1F58DF50844C50636602B46D04F
                                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_B1A0B1F58DF50844C50636602B46D04F
                                                                                                                                                                        • Size 727B
                                                                                                                                                                        • SHA256 63daa8abd59bebff7aff28f253a39fd0423eaf2b96f1e07981643ecff60a467f
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                        • Size 727B
                                                                                                                                                                        • SHA256 31530c48d4b9d2903020d05bed553129a4d2c0b8df2d03b5bb4a961f28b95e15
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                        • Size 400B
                                                                                                                                                                        • SHA256 bf3644e79b11d72301c238f51e901f6839fc403d71656d7cfd0f859069277c16
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        8EC9B1D0ABBD7F98B401D425828828CE_B1A0B1F58DF50844C50636602B46D04F
                                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_B1A0B1F58DF50844C50636602B46D04F
                                                                                                                                                                        • Size 408B
                                                                                                                                                                        • SHA256 02af6d345f4819e4b42b8abfbd58733a58499d46080b15f41300d0d123aa4cbb
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                        • Size 412B
                                                                                                                                                                        • SHA256 1dda8645e363844b309095bc1f28bf76f1e7c7a182c85e7a9147562e6b005d07
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        56d5c7be-c604-4551-818a-0b643241f419.tmp
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\56d5c7be-c604-4551-818a-0b643241f419.tmp
                                                                                                                                                                        • Size 12KB
                                                                                                                                                                        • SHA256 03e36bdcbf5c6122dd1359d937f4da7e6375472a811913953822bc367b3c4741
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        BookmarkMergedSurfaceOrdering
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                        • Size 6B
                                                                                                                                                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        BrowsingTopicsState
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                        • Size 414B
                                                                                                                                                                        • SHA256 9893cb8010d30987504026f4eccc6dce3dcebd45ccdeb80661df41d6c47eaa77
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        f_000007
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
                                                                                                                                                                        • Size 331KB
                                                                                                                                                                        • SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        f_000055
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000055
                                                                                                                                                                        • Size 35KB
                                                                                                                                                                        • SHA256 57ad3bc69c218a19cc3f44dde72302f0c9731f36fdc0d3f8ec3e781925b529ed
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        f_00005e
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005e
                                                                                                                                                                        • Size 73KB
                                                                                                                                                                        • SHA256 6dbf4ce8bd7984da3b3dec2833e8107b11b10aa56a537a2e23284cc52a2d9ea9
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        000001.dbtmp
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.speedtest.net_0.indexeddb.leveldb\000001.dbtmp
                                                                                                                                                                        • Size 16B
                                                                                                                                                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Network Persistent State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                        • Size 2KB
                                                                                                                                                                        • SHA256 129eda4ddb9c96d5703d8c7d8b279b534195ac30e7ab53401eba3fce015e32f7
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        SCT Auditing Pending Reports
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                        • Size 2B
                                                                                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                        • Size 12KB
                                                                                                                                                                        • SHA256 9546ea88aafd33be112d2ceb27ef49555d02a8cc668334c28a67520df82ad469
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Secure Preferences
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                        • Size 13KB
                                                                                                                                                                        • SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        the-real-index
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                                                                        • Size 144B
                                                                                                                                                                        • SHA256 f7f8b27df1d2867b5bff73f1451b2f1da485ca64a0aad843f93d7ba220d64732
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 235KB
                                                                                                                                                                        • SHA256 4436d72889a376f28f216e4a11cf6e820f817319de9ec12d7074538fea036bf8
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 115KB
                                                                                                                                                                        • SHA256 20aa0843b4af68a5bfcd0e563a5b3b49e126eb9b745ede9e909a2a10f0c88d2a
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Local State
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                        • Size 235KB
                                                                                                                                                                        • SHA256 209b6895cd2759a93986cf1102e4a4a07c3be1ebecbf5609838facc24dd50a1c
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Hotspot_Shield_12.9.7_20260807014542_000_HotspotShieldPackageId.log
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Hotspot_Shield_12.9.7_20260807014542_000_HotspotShieldPackageId.log
                                                                                                                                                                        • Size 3KB
                                                                                                                                                                        • SHA256 6ed1cfb50042327f0d342cdb4a92a807029d6adcd6c5ab3ea246eb88eff4f033
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        TmpD656.tmp
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\TmpD656.tmp
                                                                                                                                                                        • Size 1KB
                                                                                                                                                                        • SHA256 04493b0c31b139f4373efaec4416e955cd991aad901738d5eb17716616899e96
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        TmpD677.tmp
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\TmpD677.tmp
                                                                                                                                                                        • Size 1KB
                                                                                                                                                                        • SHA256 63bed24f4c3dd97aadfb055cee41af5d15512234e7d353550361c3d7fa5e13e4
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        nsExec.dll
                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\nsg4696.tmp\nsExec.dll
                                                                                                                                                                        • Size 6KB
                                                                                                                                                                        • SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Foundation.Installer.CustomActions.dll
                                                                                                                                                                        • Path C:\Windows\Installer\MSI17A9.tmp-\Foundation.Installer.CustomActions.dll
                                                                                                                                                                        • Size 77KB
                                                                                                                                                                        • SHA256 2025af14074dbff30c0ff24c55cc3ab0cc73eb29978aa095259b7c424c056baf
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Foundation.Bcl.dll
                                                                                                                                                                        • Path C:\Windows\Installer\MSI180.tmp-\Foundation.Bcl.dll
                                                                                                                                                                        • Size 17KB
                                                                                                                                                                        • SHA256 caaac994e5002277c4655d3235a846f4f6519ecde4e476de45aae24c10e4c921
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        System.Runtime.CompilerServices.Unsafe.dll
                                                                                                                                                                        • Path C:\Windows\Installer\MSI180.tmp-\System.Runtime.CompilerServices.Unsafe.dll
                                                                                                                                                                        • Size 17KB
                                                                                                                                                                        • SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        WixSharp.dll
                                                                                                                                                                        • Path C:\Windows\Installer\MSI180.tmp-\WixSharp.dll
                                                                                                                                                                        • Size 435KB
                                                                                                                                                                        • SHA256 4c384c1a02880d287666a880a13fdc6f0e67af67daaa276a8629c763cfd0f162
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        MSI21F2.tmp
                                                                                                                                                                        • Path C:\Windows\Installer\MSI21F2.tmp
                                                                                                                                                                        • Size 960KB
                                                                                                                                                                        • SHA256 2f96de5c0d63c400aaa922eee59a6f1fe4407c4ee0767edab87e26862b84f15a
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        CustomAction.config
                                                                                                                                                                        • Path C:\Windows\Installer\MSI66.tmp-\CustomAction.config
                                                                                                                                                                        • Size 593B
                                                                                                                                                                        • SHA256 d5c11fc5ae3d7b8ca35792ceb4917a156dff00b8b03347a764f95adf381d9819
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        MSIFA3A.tmp
                                                                                                                                                                        • Path C:\Windows\Installer\MSIFA3A.tmp
                                                                                                                                                                        • Size 211KB
                                                                                                                                                                        • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        MSIFD77.tmp
                                                                                                                                                                        • Path C:\Windows\Installer\MSIFD77.tmp
                                                                                                                                                                        • Size 973KB
                                                                                                                                                                        • SHA256 5498db094458643eee3434753aef3fcd2af996c30b2fe687169574cfe04395a9
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Foundation.Installer.WixSharp.dll
                                                                                                                                                                        • Path C:\Windows\Installer\MSIFD77.tmp-\Foundation.Installer.WixSharp.dll
                                                                                                                                                                        • Size 42KB
                                                                                                                                                                        • SHA256 5faf45880395ef2c34e5ef7d6343e5be3729967fef16c6a67d98d6a5cd77802d
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Hss.Setup.Actions.dll
                                                                                                                                                                        • Path C:\Windows\Installer\MSIFD77.tmp-\Hss.Setup.Actions.dll
                                                                                                                                                                        • Size 94KB
                                                                                                                                                                        • SHA256 44712a0629fe24e8cbd914dc7b35a2147ec72be604c1b4e0c29e5e2e7ac52faf
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        hsstap.cat
                                                                                                                                                                        • Path C:\Windows\System32\DriverStore\Temp\{b41a1aec-c157-6d4e-9cec-fe4c508ee886}\hsstap.cat
                                                                                                                                                                        • Size 10KB
                                                                                                                                                                        • SHA256 d0cc09e202185cbe839f23bfb41f559c63e70a510f1daf7a5701c5035c4252be
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        hsstap.sys
                                                                                                                                                                        • Path C:\Windows\System32\DriverStore\Temp\{b41a1aec-c157-6d4e-9cec-fe4c508ee886}\hsstap.sys
                                                                                                                                                                        • Size 38KB
                                                                                                                                                                        • SHA256 8e836cdb639c09679bc9ade82f8c9548b3f5807146f286c835238fb638f6ddc8
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        oemvista.inf
                                                                                                                                                                        • Path C:\Windows\System32\DriverStore\Temp\{b41a1aec-c157-6d4e-9cec-fe4c508ee886}\oemvista.inf
                                                                                                                                                                        • Size 7KB
                                                                                                                                                                        • SHA256 e5d9848f3b7abefbdebd035f2c0d1b1d5f39737d020226cad2d669433fe2a9b5
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        HotspotShield-12.14.1-plain-773-plain.exe
                                                                                                                                                                        • Path C:\Windows\Temp\{9DADA2F4-3A9D-4206-99A5-4186D614C524}\.cr\HotspotShield-12.14.1-plain-773-plain.exe
                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                        • SHA256 a6dd7dbfde0195e78e07443fe98bd741b900c12d1a209399aaa91e2e4262f53e
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        BootstrapperCore.config
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\BootstrapperCore.config
                                                                                                                                                                        • Size 625B
                                                                                                                                                                        • SHA256 ba4207b63f5d5b21f5db1330cb681ef3924b70e23f034edd8a6c19a71bd07297
                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        BootstrapperCore.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\BootstrapperCore.dll
                                                                                                                                                                        • Size 87KB
                                                                                                                                                                        • SHA256 f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Foundation.Composition.LightInject.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\Foundation.Composition.LightInject.dll
                                                                                                                                                                        • Size 155KB
                                                                                                                                                                        • SHA256 4673fa5fb24db236c26102e2ac6d8e51c7d1a6b913739e2bdd9db2642a034552
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Foundation.Composition.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\Foundation.Composition.dll
                                                                                                                                                                        • Size 44KB
                                                                                                                                                                        • SHA256 777c1318741dc86a6ab4af82ea38a7788dffbdf43b4f0655e01e4e0fec549ca9
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Foundation.Installer.Common.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\Foundation.Installer.Common.dll
                                                                                                                                                                        • Size 521KB
                                                                                                                                                                        • SHA256 4b7006a2951a7ccf6f99a7c73759d6488737292f0e589190aa04a45837fdf0d0
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Foundation.Installer.Diagnostics.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\Foundation.Installer.Diagnostics.dll
                                                                                                                                                                        • Size 150KB
                                                                                                                                                                        • SHA256 59d5eef24df036c06e989b3d0ceba09b8ecb20c62cb578bd876d732c4c2b0c7b
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Foundation.Installer.UI.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\Foundation.Installer.UI.dll
                                                                                                                                                                        • Size 37KB
                                                                                                                                                                        • SHA256 276a09f26a5bfad9fd8a012f918bc8d13ad73322a913479bed3c5c3fcfa8f27c
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Foundation.Logging.Dummy.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\Foundation.Logging.Dummy.dll
                                                                                                                                                                        • Size 16KB
                                                                                                                                                                        • SHA256 a5eba1b24a776619fe54ac10d97b3dad13ff74898f719f25b79336ed85c6b8c7
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Foundation.Logging.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\Foundation.Logging.dll
                                                                                                                                                                        • Size 18KB
                                                                                                                                                                        • SHA256 fc47626813ab8bfcaddd255f605e43d639901c1aae4071a3759bf4c8c9fb3fc6
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Hss.Setup.Bootstrapper.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\Hss.Setup.Bootstrapper.dll
                                                                                                                                                                        • Size 609KB
                                                                                                                                                                        • SHA256 971fad453e8b5267dd8931e0bd0a412a0d179e2efe22723fc88defc346e727af
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Hss.Setup.Common.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\Hss.Setup.Common.dll
                                                                                                                                                                        • Size 76KB
                                                                                                                                                                        • SHA256 65e912e1470f23a18db0b4e244875d2e101e2e1ad7fd5a6b0b7160f5474555cb
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Microsoft.Bcl.AsyncInterfaces.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\Microsoft.Bcl.AsyncInterfaces.dll
                                                                                                                                                                        • Size 21KB
                                                                                                                                                                        • SHA256 295af2142d9214f3fd84eafe4778dca119be7e0229f14b6ba8d5269c2f1e2e78
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Microsoft.Deployment.WindowsInstaller.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\Microsoft.Deployment.WindowsInstaller.dll
                                                                                                                                                                        • Size 179KB
                                                                                                                                                                        • SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Newtonsoft.Json.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\Newtonsoft.Json.dll
                                                                                                                                                                        • Size 695KB
                                                                                                                                                                        • SHA256 c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        System.IO.Abstractions.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\System.IO.Abstractions.dll
                                                                                                                                                                        • Size 56KB
                                                                                                                                                                        • SHA256 5a77068fe1ce176d0526e66813bb35941d2e2acf74a2533f26fd89799ebf8306
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        System.Memory.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\System.Memory.dll
                                                                                                                                                                        • Size 138KB
                                                                                                                                                                        • SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        System.Threading.Tasks.Extensions.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\System.Threading.Tasks.Extensions.dll
                                                                                                                                                                        • Size 25KB
                                                                                                                                                                        • SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        Trinet.Core.IO.Ntfs.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\Trinet.Core.IO.Ntfs.dll
                                                                                                                                                                        • Size 29KB
                                                                                                                                                                        • SHA256 8e933ee562d9e1fe6b951cccf8d954a8974bff2ddd3e1947c93994ecbfe761df
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        mbahost.dll
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\.ba\mbahost.dll
                                                                                                                                                                        • Size 119KB
                                                                                                                                                                        • SHA256 9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        HotspotShieldPackageId
                                                                                                                                                                        • Path C:\Windows\Temp\{BABB7390-EACC-48E5-87AD-4D0F38133F07}\HotspotShieldPackageId
                                                                                                                                                                        • Size 27.2MB
                                                                                                                                                                        • SHA256 2313df9acd96861635047241d9497ead2ecfe3066e5789501d5f1f1ba854934b
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        en.tsv
                                                                                                                                                                        • Path C:\Windows\Temp\{C637BB5E-0C42-47D1-B7DC-5CC9C066C646}\.ba\lang\en.tsv
                                                                                                                                                                        • Size 22KB
                                                                                                                                                                        • SHA256 000348cf473cdb462e592d835c72451b438f5e490907ac20dbf8480b7e0eff87
                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                        Submit Download

                                                                                                                                                                        memory/628-358-0x00000000026B0000-0x00000000026BE000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/628-354-0x00000000026C0000-0x00000000026DC000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-150-0x00000000076E0000-0x00000000076F2000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-322-0x0000000006A80000-0x0000000006A90000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-235-0x0000000006A80000-0x0000000006A90000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-74-0x0000000006A80000-0x0000000006A90000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-202-0x000000000D9B0000-0x000000000D9BE000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-201-0x000000000D9D0000-0x000000000DA08000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-200-0x000000000D320000-0x000000000D328000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-79-0x0000000003B70000-0x0000000003B88000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-431-0x0000000006A80000-0x0000000006A90000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-197-0x000000000DA20000-0x000000000DADA000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-196-0x0000000006A80000-0x0000000006A90000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-192-0x0000000008FF0000-0x0000000008FFC000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-188-0x0000000008AF0000-0x0000000008E44000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-80-0x0000000006A80000-0x0000000006A90000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-183-0x0000000008AD0000-0x0000000008ADC000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-176-0x0000000008200000-0x0000000008222000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-151-0x0000000006A80000-0x0000000006A90000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-149-0x0000000007670000-0x0000000007678000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-145-0x0000000007660000-0x0000000007668000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-87-0x0000000006D30000-0x0000000006DCC000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-91-0x0000000006CF0000-0x0000000006CFE000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-95-0x0000000006D00000-0x0000000006D0A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-103-0x0000000006F60000-0x0000000006FE6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-99-0x0000000006D10000-0x0000000006D1A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-107-0x0000000006F00000-0x0000000006F2A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-111-0x0000000006EE0000-0x0000000006EEE000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-115-0x0000000006FF0000-0x000000000701A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-116-0x0000000007710000-0x0000000007CB4000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-117-0x0000000007340000-0x00000000073D2000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-121-0x00000000074A0000-0x0000000007552000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-127-0x00000000073E0000-0x000000000740E000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-128-0x0000000007560000-0x00000000075C6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-129-0x0000000007440000-0x0000000007462000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-133-0x0000000007470000-0x0000000007482000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-137-0x0000000007600000-0x0000000007626000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/1396-141-0x0000000007630000-0x0000000007648000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1302-0x00000205A19D0000-0x00000205A19E8000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1314-0x00000205A1F30000-0x00000205A1F64000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1284-0x00000205A1730000-0x00000205A1784000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1286-0x00000205A16D0000-0x00000205A1704000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1288-0x00000205A1650000-0x00000205A166A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1287-0x00000205A17F0000-0x00000205A1850000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1297-0x00000205A1910000-0x00000205A192C000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1298-0x00000205A1960000-0x00000205A1986000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1307-0x00000205A1AD0000-0x00000205A1AF6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1306-0x00000205A1A10000-0x00000205A1A28000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1305-0x00000205A1A70000-0x00000205A1A92000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1304-0x00000205A1A40000-0x00000205A1A66000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1303-0x00000205A19F0000-0x00000205A1A10000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1279-0x00000205A1390000-0x00000205A13B0000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1301-0x00000205A19B0000-0x00000205A19CC000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1300-0x00000205A1990000-0x00000205A19A6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1299-0x00000205A1930000-0x00000205A194E000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1296-0x00000205A18B0000-0x00000205A18C6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1295-0x00000205A18E0000-0x00000205A1908000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1294-0x00000205A1890000-0x00000205A18A8000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1293-0x00000205A17D0000-0x00000205A17EE000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1292-0x00000205A17B0000-0x00000205A17C6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1291-0x00000205A1850000-0x00000205A1884000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1290-0x00000205A1790000-0x00000205A17AC000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1289-0x00000205A1710000-0x00000205A1730000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1308-0x00000205A1B00000-0x00000205A1B30000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1309-0x00000205A1CB0000-0x00000205A1D22000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1310-0x00000205A1630000-0x00000205A1646000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1312-0x00000205A1C30000-0x00000205A1C44000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1311-0x00000205A1AA0000-0x00000205A1ABA000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1313-0x00000205A1FB0000-0x00000205A202E000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1285-0x00000205874E0000-0x00000205874E8000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1315-0x00000205A1C50000-0x00000205A1C70000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1318-0x00000205A1C70000-0x00000205A1C90000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1319-0x00000205A2090000-0x00000205A20C0000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1317-0x00000205A2030000-0x00000205A2060000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1320-0x00000205A20C0000-0x00000205A20E6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1316-0x00000205A1F70000-0x00000205A1F9A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1420-0x00000205A23C0000-0x00000205A252A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1280-0x00000205A13B0000-0x00000205A13C6000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1281-0x00000205A1600000-0x00000205A162C000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1282-0x00000205A13D0000-0x00000205A13E8000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1572-0x00000205A23C0000-0x00000205A252A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1583-0x00000205A23C0000-0x00000205A252A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1283-0x00000205A1680000-0x00000205A16CE000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1278-0x00000205A1370000-0x00000205A1388000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1661-0x00000205A23C0000-0x00000205A252A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1276-0x0000020587300000-0x000002058730A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1277-0x0000020587360000-0x000002058736A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1275-0x00000205A1540000-0x00000205A15F2000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1273-0x0000020587390000-0x00000205873B4000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1274-0x00000205873C0000-0x00000205873F0000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1272-0x00000205A1400000-0x00000205A1538000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1270-0x0000020587320000-0x0000020587334000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1271-0x00000205872F0000-0x00000205872FE000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1269-0x00000205872C0000-0x00000205872D4000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1267-0x0000020587280000-0x000002058729A000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1266-0x00000205868F0000-0x0000020586932000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/2716-1268-0x0000020587400000-0x00000205874DE000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/3492-960-0x0000000005600000-0x0000000005608000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4500-422-0x00000000052E0000-0x00000000052F8000-memory.dmp
                                                                                                                                                                        Download

                                                                                                                                                                        memory/4636-391-0x0000000004770000-0x00000000047E0000-memory.dmp
                                                                                                                                                                        Download