aae01b9fa9c0e9f8b8d5e9965b0c899f53caebbd9ea4b2fb38afb06cbaa85571

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fluorine bridge/start.bat
Size 3KB
Sample261011-2772csba44
SHA256 aae01b9fa9c0e9f8b8d5e9965b0c899f53caebbd9ea4b2fb38afb06cbaa85571
MD5 0392716baf435c421deb8fffcf256fcc
SHA1 9bf2a77103387696826056411ea8ffc5a8699ee1
SHA512 877ceb4a461af5f4c3fb42542e54d84a67542aab69d542580b850f837b55880e6ccee93edd7effbb140349111808e2b33734ea8ae209278438a69f221015477f
TLSH
T1E48173373E98522604D7CD469C9801F3F20B80FB4A0569AC755B8278AF1D3DC25BE7C5
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 20 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	chrome.exe

Executes dropped EXE 31 IoCs

pid	Process
3448	node.exe
5612	node.exe
324	node.exe
2148	node.exe
3836	node.exe
2036	node.exe
2260	node.exe
3348	chrome.exe
5392	chrome.exe
2792	chrome.exe
3936	chrome.exe
2400	chrome.exe
5136	chrome.exe
1084	chrome.exe
5692	chrome.exe
4728	chrome.exe
1096	chrome.exe
5940	chrome.exe
5516	chrome.exe
5244	chrome.exe
2868	chrome.exe
4920	chrome.exe
5916	chrome.exe
4404	chrome.exe
5336	chrome.exe
5640	chrome.exe
3884	chrome.exe
5484	chrome.exe
4216	chrome.exe
5532	chrome.exe
4444	chrome.exe

Loads dropped DLL 49 IoCs

pid	Process
3348	chrome.exe
5392	chrome.exe
3348	chrome.exe
2792	chrome.exe
3936	chrome.exe
3936	chrome.exe
2792	chrome.exe
2400	chrome.exe
3936	chrome.exe
3936	chrome.exe
3936	chrome.exe
2400	chrome.exe
3936	chrome.exe
3936	chrome.exe
5136	chrome.exe
1084	chrome.exe
1084	chrome.exe
5692	chrome.exe
5692	chrome.exe
4728	chrome.exe
4728	chrome.exe
1096	chrome.exe
1096	chrome.exe
5940	chrome.exe
5940	chrome.exe
5516	chrome.exe
5516	chrome.exe
5244	chrome.exe
5244	chrome.exe
2868	chrome.exe
2868	chrome.exe
4920	chrome.exe
4920	chrome.exe
5916	chrome.exe
5916	chrome.exe
4404	chrome.exe
4404	chrome.exe
5640	chrome.exe
5640	chrome.exe
3884	chrome.exe
5484	chrome.exe
5484	chrome.exe
3884	chrome.exe
4216	chrome.exe
5532	chrome.exe
4444	chrome.exe
4444	chrome.exe
5532	chrome.exe
4216	chrome.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5376	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4844	cmd.exe
4756	cmd.exe
5244	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3348	chrome.exe
2792	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3268	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{CCA8FC4A-888B-4158-A90F-9EC164DD1033}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5376	powershell.exe
5376	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5376	powershell.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe
Token: SeCreatePagefilePrivilege	3348	chrome.exe
Token: SeShutdownPrivilege	3348	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe
3348	chrome.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4756	4844	cmd.exe	85
PID 4756 wrote to memory of 5376	4756	cmd.exe	86
PID 4844 wrote to memory of 2700	4844	cmd.exe	89
PID 2700 wrote to memory of 3448	2700	token-collector.exe	100
PID 3448 wrote to memory of 5612	3448	node.exe	101
PID 3448 wrote to memory of 324	3448	node.exe	111
PID 3448 wrote to memory of 2148	3448	node.exe	113
PID 3448 wrote to memory of 3836	3448	node.exe	116
PID 2700 wrote to memory of 2036	2700	token-collector.exe	118
PID 2700 wrote to memory of 2260	2700	token-collector.exe	119
PID 2260 wrote to memory of 3348	2260	node.exe	120
PID 3348 wrote to memory of 5392	3348	chrome.exe	121
PID 3348 wrote to memory of 3936	3348	chrome.exe	122
PID 3348 wrote to memory of 2792	3348	chrome.exe	123
PID 3348 wrote to memory of 2400	3348	chrome.exe	124
PID 3348 wrote to memory of 5136	3348	chrome.exe	127
PID 3348 wrote to memory of 1084	3348	chrome.exe	128
PID 3348 wrote to memory of 4728	3348	chrome.exe	129
PID 3348 wrote to memory of 5692	3348	chrome.exe	130
PID 3348 wrote to memory of 1096	3348	chrome.exe	131
PID 3348 wrote to memory of 5940	3348	chrome.exe	132
PID 3348 wrote to memory of 5516	3348	chrome.exe	133
PID 3348 wrote to memory of 5244	3348	chrome.exe	134
PID 3348 wrote to memory of 2868	3348	chrome.exe	135
PID 3348 wrote to memory of 4920	3348	chrome.exe	137
PID 3348 wrote to memory of 5916	3348	chrome.exe	138
PID 3348 wrote to memory of 5336	3348	chrome.exe	139
PID 3348 wrote to memory of 4404	3348	chrome.exe	140
PID 3348 wrote to memory of 5640	3348	chrome.exe	141
PID 3348 wrote to memory of 3884	3348	chrome.exe	142
PID 3348 wrote to memory of 5484	3348	chrome.exe	143
PID 3348 wrote to memory of 4216	3348	chrome.exe	144
PID 3348 wrote to memory of 5532	3348	chrome.exe	145
PID 3348 wrote to memory of 4444	3348	chrome.exe	146
PID 2260 wrote to memory of 5244	2260	node.exe	148
PID 5244 wrote to memory of 3268	5244	cmd.exe	149

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fluorine bridge\start.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "try { $h = Invoke-RestMethod -Uri 'http://127.0.0.1:3001/health' -TimeoutSec 5; if ($h.healthy) { 'UP ' + $h.tokenCount } else { 'DOWN 0' } } catch { 'DOWN 0' }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "try { $h = Invoke-RestMethod -Uri 'http://127.0.0.1:3001/health' -TimeoutSec 5; if ($h.healthy) { 'UP ' + $h.tokenCount } else { 'DOWN 0' } } catch { 'DOWN 0' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5376
- C:\Users\Admin\AppData\Local\Temp\fluorine bridge\token-collector.exe
  token-collector.exe -no-tui -tokens 150 -batch 2 -parallel 2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe
    C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\cli.js install chromium
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe
      C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\lib\entry\oopBrowserDownload.js
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:5612
  - - C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe
      C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\lib\entry\oopBrowserDownload.js
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:324
  - - C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe
      C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\lib\entry\oopBrowserDownload.js
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:2148
  - - C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe
      C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\lib\entry\oopBrowserDownload.js
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:3836
- - C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe
    C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\cli.js --version
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    PID:2036
- - C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe
    C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\node.exe C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\cli.js run-driver
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
      C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe --disable-field-trial-config --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-back-forward-cache --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-component-update --no-default-browser-check --disable-default-apps --disable-dev-shm-usage --disable-edgeupdater --disable-extensions --disable-features=AvoidUnnecessaryBeforeUnloadCheckSync,BoundaryEventDispatchTracksNodeRemoval,DestroyProfileOnBrowserClose,DialMediaRouteProvider,GlobalMediaControls,HttpsUpgrades,LensOverlay,MediaRouter,PaintHolding,ThirdPartyStoragePartitioning,BlockOriginHeaderModificationOnRedirect,Translate,AutoDeElevate,OptimizationHints,msForceBrowserSignIn,msEdgeUpdateLaunchServicesPreferredVersion --enable-features=CDPScreenshotNewSurface --allow-pre-commit-input --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-updater-scheduler --force-color-profile=srgb --metrics-recording-only --no-first-run --password-store=basic --use-mock-keychain --no-service-autorun --export-tagged-pdf --disable-search-engine-choice-screen --unsafely-disable-devtools-self-xss-warnings --edge-skip-compat-layer-relaunch --disable-infobars --disable-search-engine-choice-screen --disable-sync --enable-unsafe-swiftshader --no-sandbox --disable-blink-features=AutomationControlled --disable-background-timer-throttling --disable-renderer-backgrounding --disable-backgrounding-occluded-windows --disable-ipc-flooding-protection --disable-background-networking --disable-default-apps --disable-extensions --disable-sync --disable-translate --disable-component-update --disable-client-side-phishing-detection --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-domain-reliability --disable-features=Translate,MediaRouter,OptimizationHints --no-first-run --no-default-browser-check --metrics-recording-only --safebrowsing-disable-auto-update --password-store=basic --use-mock-keychain --lang=en-US --headless=new --window-size=1920,1080 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn --remote-debugging-pipe --no-startup-window
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Time Discovery
      Checks SCSI registry key(s)
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3348
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\Crashpad --annotation=plat=Win64 "--annotation=prod=Google Chrome for Testing" --annotation=ver=151.0.7922.34 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdcb28b9c0,0x7ffdcb28b9d0,0x7ffdcb28b9e0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=gpu-process --no-sandbox --disable-breakpad --headless=new --enable-unsafe-swiftshader --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1876 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --start-stack-profiler --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2020 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Time Discovery
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2472 /prefetch:8
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2400
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3624 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3628 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1084
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3728 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3700 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --start-stack-profiler --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3772 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1096
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --start-stack-profiler --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3892 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --start-stack-profiler --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3792 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3812 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3772 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2868
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5228 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --start-stack-profiler --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=3920 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5336 /prefetch:1
        5⤵
        Executes dropped EXE
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5384 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --no-sandbox --disable-back-forward-cache --disable-background-timer-throttling --disable-breakpad --force-color-profile=srgb --remote-debugging-pipe --allow-pre-commit-input --disable-gpu-compositing --disable-blink-features=AutomationControlled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5444 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5812 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5856 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=5248 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=3896 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
        
        "C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn" --force-high-res-timeticks=disabled --field-trial-handle=1900,i,4320110437903963316,3944694046593930767,262144 --enable-features=CDPScreenshotNewSurface --disable-features=MediaRouter,OptimizationHints,PaintHolding,Translate --variations-seed-version --pseudonymization-salt-handle=1904,i,15736046717260449613,13696500458381373052,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=3420 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "taskkill /pid 3348 /T /F"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5244
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /pid 3348 /T /F
        5⤵
        Kills process with taskkill
        
        PID:3268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_bpedvs5q.now.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bpedvs5q.now.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

playwright-download-ffmpeg-win64-1011.zip

Path C:\Users\Admin\AppData\Local\Temp\playwright-download-OroCOV\playwright-download-ffmpeg-win64-1011.zip
Size 1.3MB
SHA256 8d08827c019ad36e7b9d49d3648447d884534cb2acf200e71c715f6dd834cc50
MD5 64f21cf744e9a8d7e13213f2ab1c425c
SHA1 332cb05cfb673a52298c3d164f6b6c28fbd47a7f
SHA512 a16d0b28fc7a6330dd84aef7668a854ed6c9ac18be49be805f15a71ac3b925fb74ad0ddb429bec6c5f9d37e49a2696204a3ac928e100ef8a87342762977c0f55
SSDEEP 24576:3HsCK+zA2diQP3OeL/w4y2Gn8zMu1nCGFp24Qw1IqAuo4ehOgcCOwoBCmJ:3sTAOo/U2GRutHFwvaIqAP41woBHJ
TLSH
T1A86533681F57BF38442534BB4A8A843F4BC879CFAE6D68417137E984C95BA3705F360A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

playwright-download-winldd-win64-1007.zip

Path C:\Users\Admin\AppData\Local\Temp\playwright-download-mjjhEQ\playwright-download-winldd-win64-1007.zip
Size 125KB
SHA256 0069f0d11d4ad6df068a068c003d22fe7dbec192a47bba64b2e115e9c8ce41d8
MD5 644294505aa684d112592a07290ca73f
SHA1 4fd8e830765e89cfb0e66d68300a5582b81fb7b8
SHA512 ba8b8d0251685d99de8db79815d527a0e1613d42baa58e68e889a584763a91c16c8203ea51a9d395a20e0d822d71d980e34b09b6ce9307335df0883da346aa1e
SSDEEP 3072:Of10ezo2YmUfuDOSZee49O/A1ZFydc6lV2hqEb:OO/2YmUfuy2B81ZFyi6lI3
TLSH
T1E4C313B135B97EC8C557433925CA5573D50FB1C28C58398EB830CCBEEA9B682B894D93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05056fdb-c8be-41f7-bfcd-a991a99bca63.tmp

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\05056fdb-c8be-41f7-bfcd-a991a99bca63.tmp
Size 3KB
SHA256 51b96ad652986a34e72261eac968262261310751bbba880a743b5c376c3f163d
MD5 222af87a1816525088fb9a5897cbabdf
SHA1 e68240ca5ff2ac0418eae5d97533ba8cca86371f
SHA512 8479b1673388165031006e14005f8fab53bc8aa5684655567fa3b0e373e324be9a4c19bf81752792a2d333a6c4775794ebd4f98f009de7acd1df4d5f1af13c66
TLSH
T1FE81FA3268A49FB766B3E94471853C439B74616BF5927EC4D9ED0B1C02E76DC1363823
MD5 SHA1 SHA512 TLSH

Submit Download

497077fb-0849-4cc6-b826-3ff9285cf14f.tmp

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\497077fb-0849-4cc6-b826-3ff9285cf14f.tmp
Size 3KB
SHA256 9b3ab234237d4c21f2543151e19f7928797d19b608a755f87240661aeb9a2159
MD5 020e90fc31edc60c97cff7425c70935e
SHA1 0bda128a73e8640924d60b20762efd880e065278
SHA512 b335e63f8f892fbb7c4c7c41c140ba110e7668c4d4528a66e8978e775a2a5918175448467f93cbf777c481ac439af5af8e0ec80556f518a1660884ad5971a520
TLSH
T1DC81D73668A46F766AB3E944B1853D439B74616BF4927EC8E9ED0B0C01E76DC1362823
MD5 SHA1 SHA512 TLSH

Submit Download

57ab2bb9-6fde-4666-a078-ebc4e8234f8c.tmp

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\Default\57ab2bb9-6fde-4666-a078-ebc4e8234f8c.tmp
Size 6KB
SHA256 631df3c4723a58a5e548321c534b6603ea7df7fbbce911962a7961e83ad6e007
MD5 2983d0a2cccef43901d7c5d95ef96cc3
SHA1 ff6089bfb23ee88edd4242888251d935947dacb8
SHA512 8ddae5b1eb89fd69c482259b8f5e232375411465ef2d5ee00d7a5de505b07017df1c6c3a401ab4896cf6354d1c04163e4e37cca2e7f9d1cabfb5219c80f1fc12
SSDEEP 96:zR/imtqxoPFFCX5SgsTHv7+1kQAeu9AH79636+WVoMPktNm+Te09juFeNhHh:zR/i2RFCQv7+1y9AHc36+WNOxVh
TLSH
T151D1861BAE24AB374CD7DA1DBA747B92E5F6102025C51D4C5BFC8A3C0ADEACC511742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

8a93d5df-8fd9-44ca-a63e-2ab20c5c9e2a.tmp

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\Default\Network\8a93d5df-8fd9-44ca-a63e-2ab20c5c9e2a.tmp
Size 1KB
SHA256 3e03e2403a5fbb37c5c475186bea82bd4886da2abe6adfd66808b921960a3032
MD5 357a3423cd4085057977c0ea95dd80a9
SHA1 878411f45935e4d813dc020670dc1f81c4bfa53b
SHA512 051b22b6b23430b05657f8a1f78dc6c7b728c2a415ee64267508631657a4ed354419992f235b113d9d8a23a10ec74abfe1693c63b11c9eced123a652f9102b54
TLSH
T1AC31B0E7C7D8866EC96556F49B157A1BCE2E0A1C431C3C1A88D8BF1F97E2830D25168F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\Local State
Size 916B
SHA256 c264a4da712599b90fd88462b5b99d7ed0d7a1e7b17f7891dfc73f4b8667fd43
MD5 988ca7d3fc1e17db2a972d83080cd622
SHA1 492d0f512b0b55e8ba890adb424136cc42b7de45
SHA512 d777d1c5f99c35d5a511707d4ceb7908b9a3bbad7eb979dada762396509ecc0f70140c1092d1803a7aab8100a1b92fe23254a4387aad4ce0ef4a43a06a709117
TLSH
T11E1167711C243F66BB519D5557D1BE4B0F357126D1D21C88B8EF035411A76A82A17C32
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\ShaderCache\data_1
Size 264KB
SHA256 9bceedd78e5c648ffce2bc1758efea1a341bffda2f25c9be1bdd701987daafb8
MD5 81b8058eababdd1b01d900d9faa7504c
SHA1 5ab01cc4183191b4d844bdd620858ea07d3a9f79
SHA512 9ec46183416a91956657b42f4ed6bca9e5383ec8cfe65e73ce6701e18b5f5787dfc99233b619585bc2364ea5e7d51a3bac7b36ecb053f4675dea2aa8dd0b56e4
SSDEEP 3:MsEllllkEthXllkl2zEklxHZ+//:/M/xT02znTe
TLSH
T1AA4404047FC00405C5001030C017C3D10770DC110511D753357154135CCD7404C11004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa735d91-d33a-45cf-b063-fecd05fedbda.tmp

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\aa735d91-d33a-45cf-b063-fecd05fedbda.tmp
Size 4KB
SHA256 40dc8b7b2dca978dbd5065f0768db66892c2dcc4bb7425941d41e00e5c90b555
MD5 abc5487f86eb0810114480cdd8529d5e
SHA1 2bf631c3f8bf353da2652efd59b75116993d96f6
SHA512 730e95d4761ca4a793c66dd43a15a3b028476782a251d16633c26edc993ed04590dad79a3fc94bf084e8f917b0356dfc0860e383bd91b2744a9e5701af8cc39e
SSDEEP 96:6/zbJB/Uf2HXpoYe2otos5rdNDgjB63GwvCziddzLxu0j9QyYMphL7EH4a:+txHOf2UFhVg9H+dFxuUvhL7Y
TLSH
T18681D92268A49F776AB3E94471813D439B74616BE5927EC4E9ED0B1C02E76DC1353423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baea35ce-5560-40aa-bd4e-f859f6e9aad1.tmp

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\baea35ce-5560-40aa-bd4e-f859f6e9aad1.tmp
Size 3KB
SHA256 993013eee97a5b8e6f34991ec0370570ef3e4ee013c1149bfd2b6bc70e14337d
MD5 ae9df39b7d4bb7e21adb579f545e96d2
SHA1 abc9b4d194d287ac27fa90fe317cf0c4212c68d2
SHA512 15274a26e31105e4eb961eefedeb3dc1cfe0446d7e5f8f4947b4643354a3062d294736165a494bb24ff61db7a90a7fa69265041dcd5c302af84f6f846ee54090
TLSH
T16D81E92268A49F776AB3E94471813D439B74616BF1927EC4E9ED0B1C02E76DC1352823
MD5 SHA1 SHA512 TLSH

Submit Download

76844494-0c8a-493a-8f11-1c1687cc63bd.tmp

Path C:\Users\Admin\AppData\Local\Temp\playwright_chromiumdev_profile-XALYkn\extensions_crx_cache\76844494-0c8a-493a-8f11-1c1687cc63bd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

browsers.json

Path C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\browsers.json
Size 1KB
SHA256 f306eed529599b1eaf2f8a85db9de2b23e1a3fe36c2b66434b7c9434fb627a99
MD5 560015a1d50411c3086cee089ee30e47
SHA1 6bd997095230ff9950c7847830adefe3292c24ab
SHA512 23089ef97a256e44e1773ae48ea4b30406a453b617f6e2ff4509616f648712b8eb5804cba92bdf7165223d52810456237a74b78336dab4aadd35e507d673b51d
TLSH
T1D1312285D864CCBB284A1BA485890085BDB4069F2DA83C18BB1D254D1F4FB3F55FAFAD
MD5 SHA1 SHA512 TLSH

Submit Download

cli.js

Path C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\cli.js
Size 839B
SHA256 f1c4075aef116c766092250d7f37b3249a7cee6465d953207fc38c8f6145becd
MD5 03cfe1b9635ce4c9a37209dd32c079ec
SHA1 90ac6978b40532df55bf7f1ff71e7fdfd343a611
SHA512 d6fdbed3c6eba579accdf9186e84f6bcd97119aaf16f8a010fb2fdada6972b39093150b51a612f9c962029ff66b5bc9bf42ad7c66afbcd76c70215410cf4e888
TLSH
T1C101EB7CBA8816F737904AF67D0AC4CB670AD85D350F9351580A80EA9C2D7A642ECEB0
MD5 SHA1 SHA512 TLSH

Submit Download

coreBundle.js

Path C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\lib\coreBundle.js
Size 3.3MB
SHA256 710a92b65e9b31ee0081e3a3235b37178fe1ad55fb27818fb8cf0d8cab4c4469
MD5 e9580e4e46a530bb3b9b6b0825cc2c40
SHA1 69f2c5927f5c1fd7f497698c3289f0d78c8e0123
SHA512 eba6b113f9737b32ec9ca20f466c13886c107af7ac47762d5a9f5ddaa06745e6dde3aa42d7ae61c0cb0148c9c0ca5f6335cc64accdfe2b543f0787a3dfe79fde
SSDEEP 49152:senh/iKr6iTioC7qOgl5WJtyH/jD7GeW4qxR71ZcLGKMS:rDV
TLSH
T12FF5C75A69BB153242A371AA5F7790067334A0073409E9A87E4C83D81F8D568DAF3FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oopBrowserDownload.js

Path C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\lib\entry\oopBrowserDownload.js
Size 120B
SHA256 87567cdbd67dd2f50bb232d47d3784701ece7c81e39c0287bb7d1b466b68cf06
MD5 1e3ae44a8d82d5c038c7ea40f39df0ca
SHA1 677c9304e9bca503e09867815e99b4285c9b1007
SHA512 6b27841fa560f7ca0f7e83b188c4e50aed3c46cdddd425787e5f515e87535184eefbbe359983de06883e4d65efd3a16eef3449cf37f0f7697ca84591ca396258
TLSH
T1D4B022CBC8B8FA808230C0EC802A80000802802A80002022ECA0C3F0828C888A23A2A8
MD5 SHA1 SHA512 TLSH

Submit Download

utilsBundle.js

Path C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\lib\utilsBundle.js
Size 3.1MB
SHA256 580f571bf063e2256b51b3946a035bc452fc0e22808d5547b198baea39923a32
MD5 c8ecdbc4129f3ca97df52c5e5e79cb4e
SHA1 45f9472e70e37729cd79205c0471413ef74ec77e
SHA512 6074e485fca3c6634cdff8fa7978717799e2955f280994cd6513526922aba355ab381c36dc8f4e32cc75dd20f4d23731e31ef51263e333ed8b85db65b48fb20d
SSDEEP 49152:ZdGL4IQUHxMtmVtvM2qnBf5bLiwaYD6ZXoJEV5yslrRlLnlL1WL3Jh0MovQ/hizs:dnwv2
TLSH
T176E5D8496AF71052466370B85F6F9006B6749407250CEDA8BE9C93E06F8993887F7FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\ms-playwright-go\1.62.1\package\package.json
Size 876B
SHA256 07c47543631fef9508760365dee9fbe958c562093ec8d122543949ed231f233f
MD5 0ec0d1f956fbfa027c70ae0820d82a88
SHA1 9481e713c53d5f0ba44c6597e0cc3f1a1a19ba31
SHA512 77364bd1d2724c2923e635040f506653e05ebd900f3bdb402763ef4548263c087c7c5ca40ab8348a0eecb62ac4523709493b08c944b138ecf996b0199e6c36be
TLSH
T18B114812C5EC5D9326C8366DEA2A965070748C5F845A7E103BC6175C9F8C67F13BE319
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\D3DCompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome.exe
Size 3.8MB
SHA256 409805a16d6416087e6b2f778df1cf8f7bbb267d6b99f6b5bb0a618eace234f2
MD5 e4147570dba618b7b3be11259066e93e
SHA1 418c8d063e0703e8a35a6e4beb306c160b692894
SHA512 3633ac928ef8b8f6e2b8cbeca6379c070635966a421b0b718703cd67093e7bd230d850fc5452ce3567430ce8780a9bda41d5072eff641fe115efb0998c8ebabd
SSDEEP 49152:f9FCIwMA07VoZrUgzMeyWd+iSjcCE7Yg8WsDI9usDUkANZ8C8GHzSXJyKnp9odjw:f/CIwZygzxX7FTr2XcMj
TLSH
T11A168C13F2DA50D8C019D179875A9233EA61BC454B31B6DF0A90B7562FB6FE06B3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome_100_percent.pak
Size 692KB
SHA256 2ad4942582a53f411bd505b8e46fe48d029277de38b16abb28210868fd9ba42d
MD5 80003de1aaac1749f71c7b907c06f5da
SHA1 fc716752ad845d797a8b86ef8702c7273f5b135f
SHA512 a3384b0e1a24e148cf803894584bb7560e9bfddfa170125938a254d4eb28041e5b9deab2d34b004899ad16837cdd069cdbbb65c3779e80594a39db5162e3d99a
SSDEEP 12288:HI3H1fJwjjzgsz5B0GDJQrnKs8SNP+QSsEHeilSTe+gnPzmxKYJblI3csAjKQCrC:o3VBQ7zEEmPLVbTe+gnPzmxtbOAGQt
TLSH
T1BEE412E37370AC7DEE9B1777826615B0FC371A280A92160917DAF8796913B48D8D93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome_200_percent.pak
Size 1.2MB
SHA256 936d7fd943eacf4c22fd11563a65a3fa168cdf23f05597ba3e1ec15713b2525a
MD5 7e61f5c6ca76d675087bd13281357b62
SHA1 0a8477440d5abb78314f1081a395b36898298184
SHA512 ed7160a522a8f989fa7145f83a41606dd3b27a7e6ab84b53226d05e482b1afd2fdfc77a70dc351c9c308cdc91b58107628ac1ad6dc64080bbad15539d8ac8971
SSDEEP 24576:Z3zB09pLzLmmibkFR8+mZiqr8BWhQume1RvQt9wbcIQwuSXAeUGQ74:Z3yL3mNbkFRJmQ+8khQRa1QPv8uSXAh8
TLSH
T1EB4522D3D3B0EC7EDD520B77939B20E4FD7500271A72190F0B26AD7A39166C8DA95A83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\chrome_elf.dll
Size 2.6MB
SHA256 1afacfeca8fbbd9d32c22bb2d9c2482c76611d141dca0d53f11b6e082a097ac4
MD5 5d9fe46dcfe72069d74b3319608f126c
SHA1 e99c3e6172b47751fd56295a594cbdfdfa49cb40
SHA512 d774592ae32bea19ae24720da8e18106cc0476f398c70e650420f11dfcf486db6784136a7d831cf7aea7a20f7ece77c7e0550bca5ffe0628b895e2673a515f0b
SSDEEP 49152:hQNZbbsqhzq7ethFJ+BHnnbhRaJHTsy/PvG7yz7zsV:AZb982h2xQPvfM
TLSH
T19EC57B13F2DA01E8C05DD1788B5B9232EAA1BC454B35B6DF0A9076562F7AFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\dxcompiler.dll
Size 24.6MB
SHA256 6e4da9e1d498414bc33e051262f333a6f4c4ac51e756c1238284fcebc8b6bc2d
MD5 e1640116b155fe029af932bbe3e5104e
SHA1 316c74ff25c09e6eaf26ecfdf17e890954f366e1
SHA512 71dd16f7fbae5896dab7367a5d7d0ea151833b505eb31acd23413dde281b82161eb063291ed46ea88027026c1c00d952915e539365817c6c1b0ec7118b46b980
SSDEEP 196608:dZOZpehvut9C1brA6osHu+Jrc28Huy0dty2EbVS7HGVYJObo2xecey2zAmZ4kD:dZOHeZu+NxHR8OZy5Vijuo2bjWAwD
TLSH
T16D4729122686D49DC059C879C3678B268A6C30E73FA7B8EFC0F451252B79DEC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\icudtl.dat
Size 10.4MB
SHA256 9f48c7f9c7c94d516a14870707e910ab94d75ae640ff6842c4af53276cd26ebe
MD5 c9d17441b2314fe514cd8cb951577c1c
SHA1 15cae4dee805f3e04171e00781da13fe40036439
SHA512 836d4f4fa591ee059dbfb943c2f13ded58a0f5048b5505214ec7105d0963106e0078aa262090d0dac9cca80995c7961a900ffa7a2af8ff315aabad1313bd37a4
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89j:1/cBhORok2HiXUxO/RJk3IWhlYntjdOj
TLSH
T1A9B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am_FEMININE.pak

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\locales\am_FEMININE.pak
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\locales\en-US.pak
Size 504KB
SHA256 3915a43dab5c12f08562d1bb6d4e493b35cb88e87c04c532ee660fd9b9f432b7
MD5 10d006fad7d84057e3c4a524074da365
SHA1 b43a31f806087014a3e3113d690b54e0f1124aaa
SHA512 61ed6a4f96a02278b35de2b91640f4e69be9c445b6a390938ced45c68dc793ebffbe1231c37b3d48c311abe477fbf4ba05f480e2bf15588fd6bca376804c4b27
SSDEEP 6144:/ptV/LEpt+bViNJHfv7Oqk3waOprMf9BWFqcfaYNGf0uN/G7w/:/VzEUViPHfvjMnWFqaw/
TLSH
T1B2B43B1FF744122A059352A27F09A5A2FF36D06CA35112563CBD812C33B7B66C27B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\resources.pak
Size 20.3MB
SHA256 4711063046c16734c681448daa7e06433d9860a9b039fb72b97128680b7614db
MD5 4035a1ba797c63a6bdd0429104cee738
SHA1 f78e6f7fd81af98368da865b458e462fc23c96bd
SHA512 f5946419c47e12e49728f08cf0aed77097a2a55db74c1a55c97481cdfb1877a611dc31470fe934a4f65a0dbb1768ab3b28b7f804c6d693da5bc9f0338196e64c
SSDEEP 393216:DaZLZelLgg9mno8sbq+dNAcrIgsTCvbQ8qbCxa942xvkrBnlumqdl3:WIggJ5IJCnqb8a94gkBnlumqn3
TLSH
T19227126AB300523BCFA34376545BA23A7336804E3F4793672059E36D0C5BBE99F6894D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\v8_context_snapshot.bin
Size 723KB
SHA256 f4ca0c7dc3fa0329d15128cf217f279650d7dad93b6a1629bb3a303a8a04671b
MD5 2de8df916c64df3ee97e72a6f8ceea57
SHA1 afcba754d396c80c62d204c578887d5f19412a15
SHA512 4ad203cea529fb6c6be1235a0e36620409512eaf06766001213c420ece67c42c25503901e6b6ab2a6f2b0a84c94f4cbf7a658510437aa653635b63fe9b72aecf
SSDEEP 12288:7ER3hjl246rucdLsWqqUNpkG+VOqJh2ww:7ER3n+pdWqQpkKqJU
TLSH
T1ACF494B6F56A8A26CE5127BDCDB6CA063634F19DCF86C65B704217BC78A8FB44E1140C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\vk_swiftshader.dll
Size 5.2MB
SHA256 492c2b5cb17fd2e1cef419612cc389716d2bd2c33da617ae695d40a68b372333
MD5 8f86ed44f3a717ee78295adf264ccc94
SHA1 8747dcdab0cc3c92bda1e4e05f1321217af00e9e
SHA512 ff372c56d2f128c1c7c976f758eaa7864b2fafc407e7e21d74ae52f9f719281497f171b9e15cda30fec7556ac81d0be5ad344399a88a46acb8e4e6297ae50ef5
SSDEEP 49152://F78sN2WtWnDBQxGpgN7Q00pDyS/277Cu70uvMDHB7ZL1r78deye7haOBFEaaLT://F78sU2U1CdDXzWUL
TLSH
T122463803F28680E9C06DD579875EA623B231F8840B7276DF66A05F1A2E79FE0673D705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium-1234\chrome-win64\vulkan-1.dll
Size 943KB
SHA256 b6b2cf8b1e49e8a6e7b2a3415498931dc58fa384ce42aa39aac8b71619f4317a
MD5 c910884674feb4cc911dd57f54268ce1
SHA1 fd9781036f320288fa2ff90db3c6e349f42123ff
SHA512 b8e7a29d2d06ab5fb2a6ccbf639051fadc3d97d934cbe8e8e626233265f7fc083a833e0b1bb8b1bd03243485944e61c9a4ac0f04babf9e36f89e2e3bc15f04bb
SSDEEP 24576:XeqBgeQrf+Qv2c81wPacwsh0Pm+KNlC1EoDkw7+DV6g3v0TAE7yoeHe97:uq1QrxecaZsh0Pm+KNlC1EoDkw7+DV6X
TLSH
T1EE258D63DA548AA9D6768074D8D18A0399F0B4811332B6CF03B417186F6FEF47B7DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium_headless_shell-1234\chrome-headless-shell-win64\hyphen-data\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium_headless_shell-1234\chrome-headless-shell-win64\hyphen-data\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium_headless_shell-1234\chrome-headless-shell-win64\hyphen-data\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\ms-playwright\chromium_headless_shell-1234\chrome-headless-shell-win64\libGLESv2.dll
Size 449KB
SHA256 32d811521ab6d2249aee6c2cb51c0082e78c44ab4a32b0222c104b38a64c0389
MD5 525f13b82784dfac6c42a9ce8d056e68
SHA1 ea615448d561878681aada6e747ebfc83957d481
SHA512 f64f91e640b14a4e78233c79cf35e805ef175c50e7db4f57e769b9dbd867e818978a2af6e73790dca2281aafa2ef9649052125893fa88dd7f994c04970c6cccd
SSDEEP 6144:Z+cJPab9TfpocD588jeei3Cap5651zs4bcFtifJ2X+O:KicD5/eeap5651zs8cFtia+
TLSH
T179A47D05B7D548BCD077C1388A538647EBB178560B61EAEF03A0E2792F77BE41A7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3936-996-0x000001E496730000-0x000001E496732000-memory.dmp

Download

memory/3936-992-0x000001E4953B0000-0x000001E4953B4000-memory.dmp

Download

memory/3936-990-0x000001E4953B0000-0x000001E4953B1000-memory.dmp

Download

memory/3936-989-0x000001E4955B0000-0x000001E4955B2000-memory.dmp

Download

memory/3936-988-0x000001E4953B0000-0x000001E4953B1000-memory.dmp

Download

memory/3936-987-0x000001E495520000-0x000001E495522000-memory.dmp

Download

memory/3936-991-0x000001E496140000-0x000001E496142000-memory.dmp

Download

memory/3936-997-0x000001E496140000-0x000001E496144000-memory.dmp

Download

memory/3936-986-0x000001E4953B0000-0x000001E4953B1000-memory.dmp

Download

memory/3936-994-0x000001E496620000-0x000001E496622000-memory.dmp

Download

memory/3936-993-0x000001E496140000-0x000001E496141000-memory.dmp

Download

memory/5376-0-0x000001B0D82C0000-0x000001B0D82D0000-memory.dmp

Download

memory/5376-2-0x000001B0D87D0000-0x000001B0D87F2000-memory.dmp

Download

memory/5376-1-0x000001B0D82C0000-0x000001B0D82D0000-memory.dmp

Download