Analysis
- user interaction
yes - max time kernel
1331s - max time network
1363s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 16:18
Static task
static1
Behavioral task
behavioral1
Sample
camtasia.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
camtasia.exe
Resource
win11ltsc2024-20260911-en
General
- Target camtasia.exe
- Size 306.2MB
- Sample261023-tsb2dacw7w
- SHA256 9bc4a48a348248b67fdbbd7bf8c53c4cd31270143e3d921166737e0eecbe65b7
- MD5 1dd6b621648d3b9466ecef8f6a891187
- SHA1 a64376e3740c1944b0c1894b13a0c76b53361d5a
- SHA512 a795a5f47470920c5b86f39ba03f418b1637ebbe897042ab5c49b2b316fb96d14e415308d7dab78e4d1f36909d4b04085dff41ef055bb3b9e2d3977c77865a9b
- SSDEEP 6291456:Ubd2q+xy6FyqgOiqs3u/XQyO8NXRtJoudPFxLwdgkhvuNOLOjei56el5V:Ubdiw6EqgOZs+4yOiXzJoudDLSuF91N
- TLSH T123E83311B1A5145FF2F404B7B54592306F5C96083B824AAB8178F6AA3C7BCE65FF730A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 TTPs 2 IoCs
description pid Process procid_target PID 6280 created 200 6280 taskmgr.exe 140 PID 6280 created 200 6280 taskmgr.exe 140 - Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts notepad.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{A70C4630-EA5A-4956-B048-7EC8FF8670E9} = "\"C:\\ProgramData\\Package Cache\\{A70C4630-EA5A-4956-B048-7EC8FF8670E9}\\CamtasiaInstaller.exe\" /burn.runonce" CamtasiaInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} = "\"C:\\ProgramData\\Package Cache\\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} = "\"C:\\ProgramData\\Package Cache\\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 214 5852 Process not Found - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\D: VC_redist.x64.exe File opened (read-only) \??\I: VC_redist.x64.exe File opened (read-only) \??\L: VC_redist.x64.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: VC_redist.x64.exe File opened (read-only) \??\B: VC_redist.x64.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: VC_redist.x64.exe File opened (read-only) \??\M: VC_redist.x64.exe File opened (read-only) \??\N: VC_redist.x64.exe File opened (read-only) \??\O: VC_redist.x64.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: VC_redist.x64.exe File opened (read-only) \??\J: VC_redist.x64.exe File opened (read-only) \??\Q: VC_redist.x64.exe File opened (read-only) \??\S: VC_redist.x64.exe File opened (read-only) \??\X: VC_redist.x64.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: VC_redist.x64.exe File opened (read-only) \??\T: VC_redist.x64.exe File opened (read-only) \??\U: VC_redist.x64.exe File opened (read-only) \??\V: VC_redist.x64.exe File opened (read-only) \??\Z: VC_redist.x64.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: VC_redist.x64.exe File opened (read-only) \??\R: VC_redist.x64.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: VC_redist.x64.exe File opened (read-only) \??\Y: VC_redist.x64.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 5140 netsh.exe 3940 netsh.exe 6372 netsh.exe - Drops file in System32 directory 56 IoCs
description ioc Process File created C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\WF.msc mmc.exe File opened for modification C:\Windows\system32\vcomp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140ita.dll msiexec.exe File created C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\mfc140u.dll msiexec.exe File created C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140deu.dll msiexec.exe File created C:\Windows\system32\mfc140chs.dll msiexec.exe File created C:\Windows\system32\mfc140ita.dll msiexec.exe File created C:\Windows\system32\mfcm140.dll msiexec.exe File created C:\Windows\SysWOW64\tsc2_codec32.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140cht.dll msiexec.exe File created C:\Windows\system32\mfc140deu.dll msiexec.exe File created C:\Windows\SysWOW64\tsc2_codec64.dll msiexec.exe File opened for modification C:\Windows\system32\vcamp140.dll msiexec.exe File created C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File created C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140u.dll msiexec.exe File created C:\Windows\system32\mfc140jpn.dll msiexec.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File created C:\Windows\system32\concrt140.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File opened for modification C:\Windows\system32\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140rus.dll msiexec.exe File created C:\Windows\system32\mfc140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\vcomp140.dll msiexec.exe File created C:\Windows\system32\vcruntime140_threads.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140fra.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140jpn.dll msiexec.exe File created C:\Windows\system32\mfc140cht.dll msiexec.exe File created C:\Windows\system32\mfc140fra.dll msiexec.exe File created C:\Windows\system32\msvcp140_1.dll msiexec.exe File created C:\Windows\system32\vcamp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140chs.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140enu.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140esn.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\mfc140enu.dll msiexec.exe File created C:\Windows\system32\mfc140esn.dll msiexec.exe File created C:\Windows\system32\mfc140rus.dll msiexec.exe File created C:\Windows\SysWOW64\tsccvid.dll msiexec.exe File created C:\Windows\SysWOW64\tsccvid64.dll msiexec.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Mac\Tahoe2xColored\resizenorthwestsoutheast_os26.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Windows\Windows10\48x48\aero_helpsel_l.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Replacement\Mac\bottomleftresize.json msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\ToolPreviews\Cursor_KineticCursor.mp4 msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Windows\Windows10\128x128\aero_up.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Windows\Windows7\48x48\aero_move_l.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\CommonImages\WhiteOutline\mediumKeyBlack.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Mac\2x\poof.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Mac\Colored\resizenorthwest.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Mac\Tahoe1xColored\ibeamvertical_os26.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Replacement\Mac\wait(catalina).pdf msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\Bridge\Effect\CursorScale.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\HTML\SmartPlayer\scorm04_3rd\lom.xsd msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\HTML\SmartPlayer\scorm04_3rd\lomLoose.xsd msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\zh-CN\Information\Clear\KeystrokeData.json msiexec.exe File created C:\Program Files\TechSmith\Camtasia\en-US\tschtmlproducerres.dll.mui msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Mac\Tahoe2x\resizeeast_os26.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Replacement\Mac\wait(catalina).json msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\HTML\SmartPlayer\scorm04_4th\imsss_v1p0control.xsd msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\ja-JP\Images\Keystroke_Clear32.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\Theming\ThemeEditorDemoIcon_128.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Mac\Tahoe1x\resizenortheast_os26.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Replacement\Mac\notallowed.pdf msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Replacement\Mac\resizeup_os26.json msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Replacement\Windows\appstarting.json msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\Callouts\anim_drawnperfectoval.svg msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Replacement\Mac\resizesouth.pdf msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\Captions\zh-CN\sync.caption.training.step.3.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Mac\2x\resizeleft.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Mac\Tahoe2xColored\resizeright_os26.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Windows\Windows8\48x48\aero_arrow_l.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\avcodec-62.dll msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Mac\2x\resizenortheast.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\Callouts\anim_star.svg msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\HTML\SmartPlayer\scorm04_3rd\unique\strict.xsd msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\ToolPreviews\Cursor_CursorSmoothing.mp4 msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Mac\Tahoe1xColored\resizeeast_clr_os26.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Windows\Windows8\48x48\aero_nesw.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\HTML\SmartPlayer\scorm04_4th\imsss_v1p0objective.xsd msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Mac\Tahoe2x\resizenorthwest_os26.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\HTML\SmartPlayer\scorm04_3rd\imsss_v1p0random.xsd msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Backtrace.dll msiexec.exe File created C:\Program Files\TechSmith\Camtasia\pangowin32-1.0-0.dll msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Mac\Tahoe2xColored\openhand_os26.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Replacement\Mac\resizenorth.json msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Mac\Tahoe2xColored\resizenorthsouth_os26.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Windows\Windows7\32x32\aero_ns_l.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Replacement\Mac\openhand.json msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Replacement\Mac\resizenorthwest_clr_os26.json msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Replacement\Windows\hand.json msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\PresetPreviews\BorderPreview.tscproj msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\RemixCallouts\25-bold-rectangle.json msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\ToolPreviews\Audio_Compression_Thumbnail.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\BITSReference5_0.dll msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Native\Mac\Tahoe1xColored\resizenorthwestsoutheast_os26.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Luma-Resources\Cursors\Replacement\Mac\resizenorthwest.pdf msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\HTML\SmartPlayer\scorm04_2nd\vocab\loose.xsd msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\CommonImages\GrayKeys\left.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\WPFElementsRes.dll msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\ToolPreviews\Effect_CursorPath_Thumbnail.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\ToolPreviews\Audio_FadeOut_Thumbnail.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\Images\OnboardingTip_AudioEffectsIcon.png msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\PresetPreviews\CursorEffectPreview.tscproj msiexec.exe File created C:\Program Files\TechSmith\Camtasia\Media\Studio\RemixCallouts\11-abstract-ellipse.json msiexec.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Fonts\OpenSans-BoldItalic.ttf msiexec.exe File created C:\Windows\Fonts\OpenSans-Italic.ttf msiexec.exe File created C:\Windows\Fonts\PermanentMarker-Regular.ttf msiexec.exe File created C:\Windows\Fonts\Caveat-Regular.ttf msiexec.exe File created C:\Windows\Fonts\CormorantInfant-Regular.ttf msiexec.exe File created C:\Windows\Fonts\Oswald-Medium.ttf msiexec.exe File opened for modification C:\Windows\Installer\SFXCA18F312A20446E7B8BFF5827C70E11845\CustomAction.config rundll32.exe File created C:\Windows\Fonts\ZillaSlab-SemiBoldItalic.ttf msiexec.exe File created C:\Windows\Installer\{817B37FD-3113-4C86-A0FF-FA63798C2CEC}\CamtasiaIcons.exe msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7080_1387984880\manifest.fingerprint msedgewebview2.exe File created C:\Windows\Fonts\Dosis-Regular.ttf msiexec.exe File created C:\Windows\Fonts\RobotoCondensed-Regular.ttf msiexec.exe File created C:\Windows\Fonts\Rochester-Regular.ttf msiexec.exe File created C:\Windows\Fonts\SourceSansPro-Regular.ttf msiexec.exe File opened for modification C:\Windows\Installer\SFXCADA5DBFA93A461ED8E42DFFDD8D32E67A\CustomAction.config rundll32.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7080_1387984880\hyph-hi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7080_1387984880\hyph-kn.hyb msedgewebview2.exe File created C:\Windows\Fonts\BarlowCondensed-Bold.ttf msiexec.exe File created C:\Windows\Fonts\Raleway-ThinItalic.ttf msiexec.exe File created C:\Windows\Fonts\Roboto-Medium.ttf msiexec.exe File created C:\Windows\Fonts\RobotoCondensed-LightItalic.ttf msiexec.exe File opened for modification C:\Windows\Installer\MSI3B73.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9273.tmp msiexec.exe File created C:\Windows\Fonts\OpenSans-SemiBold.ttf msiexec.exe File created C:\Windows\Fonts\RobotoSlab-ExtraBold.ttf msiexec.exe File opened for modification C:\Windows\Installer\SFXCA34D85B61AE44F5FB6EE4113A1FD20C3B\WixToolset.Dtf.WindowsInstaller.dll rundll32.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7080_1387984880\hyph-mn-cyrl.hyb msedgewebview2.exe File created C:\Windows\Installer\{817B37FD-3113-4C86-A0FF-FA63798C2CEC}\CamStudio.ico msiexec.exe File opened for modification C:\Windows\Installer\SFXCA8415A5F79942242A8D21105C9D5734EC\FuseCA.dll rundll32.exe File created C:\Windows\Fonts\BarlowCondensed-ExtraBoldItalic.ttf msiexec.exe File created C:\Windows\Fonts\Dosis-Bold.ttf msiexec.exe File created C:\Windows\Fonts\Montserrat-BlackItalic.ttf msiexec.exe File created C:\Windows\Fonts\RobotoSlab-Regular.ttf msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7080_1202598151\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7080_1387984880\hyph-el.hyb msedgewebview2.exe File created C:\Windows\Installer\e5b2796.msi msiexec.exe File created C:\Windows\Fonts\Bangers-Regular.ttf msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7080_828059214\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7080_1387984880\hyph-de-1901.hyb msedgewebview2.exe File opened for modification C:\Windows\Installer\SFXCACEDED543E44EEAFBD20AF6D25ECA8129\FileSystemCA.dll rundll32.exe File created C:\Windows\Fonts\Montserrat-Thin.ttf msiexec.exe File created C:\Windows\Fonts\OpenSans-Regular.ttf msiexec.exe File created C:\Windows\Fonts\Dosis-ExtraBold.ttf msiexec.exe File created C:\Windows\Fonts\Raleway-MediumItalic.ttf msiexec.exe File opened for modification C:\Windows\Installer\MSI4F6A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI516F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2DC3.tmp msiexec.exe File opened for modification C:\Windows\Installer\SFXCA18F312A20446E7B8BFF5827C70E11845\Microsoft.Web.WebView2.Core.dll rundll32.exe File opened for modification C:\Windows\Installer\SFXCA18F312A20446E7B8BFF5827C70E11845\Microsoft.Web.WebView2.Wpf.dll rundll32.exe File opened for modification C:\Windows\Installer\e5b2796.msi msiexec.exe File created C:\Windows\Fonts\RobotoSlab-ExtraLight.ttf msiexec.exe File created C:\Windows\Fonts\Lato-Thin.ttf msiexec.exe File created C:\Windows\Fonts\NotoSerif-Italic.ttf msiexec.exe File created C:\Windows\Fonts\OpenSans-Bold.ttf msiexec.exe File created C:\Windows\Fonts\Roboto-BoldItalic.ttf msiexec.exe File created C:\Windows\Fonts\RobotoSlab-Medium.ttf msiexec.exe File created C:\Windows\Fonts\Montserrat-Black.ttf msiexec.exe File created C:\Windows\SystemTemp\~DFE2351BD1DBCB9E1B.TMP msiexec.exe File created C:\Windows\Fonts\BarlowCondensed-ExtraLightItalic.ttf msiexec.exe File created C:\Windows\Fonts\Dosis-ExtraLight.ttf msiexec.exe File created C:\Windows\Fonts\Raleway-Bold.ttf msiexec.exe File created C:\Windows\Fonts\RobotoSlab-Thin.ttf msiexec.exe File created C:\Windows\Fonts\ZillaSlab-Bold.ttf msiexec.exe File created C:\Windows\Fonts\BarlowCondensed-Regular.ttf msiexec.exe - Executes dropped EXE 23 IoCs
pid Process 4932 CamtasiaInstallerUI.exe 5936 CamtasiaInstaller.exe 6044 CamtasiaInstaller.exe 6028 CamtasiaInstaller.exe 3304 vc_redist.x64.exe 4232 vc_redist.x64.exe 6008 CamtasiaInstallerUI.exe 3976 VC_redist.x64.exe 4520 VC_redist.x64.exe 4896 VC_redist.x64.exe 1884 VC_redist.x64.exe 5660 VC_redist.x64.exe 5616 TechSmithAgent.exe 200 CamtasiaStudio.exe 1148 crashpad_handler.exe 6024 CamtasiaStudio.exe 716 crashpad_handler.exe 2896 CamtasiaStudio.exe 7040 crashpad_handler.exe 2584 CamtasiaStudio.exe 6860 CamtasiaStudio.exe 1820 crashpad_handler.exe 2888 CamtasiaStudio.exe - Loads dropped DLL 64 IoCs
pid Process 4932 CamtasiaInstallerUI.exe 4932 CamtasiaInstallerUI.exe 4932 CamtasiaInstallerUI.exe 4932 CamtasiaInstallerUI.exe 4932 CamtasiaInstallerUI.exe 4932 CamtasiaInstallerUI.exe 4932 CamtasiaInstallerUI.exe 4932 CamtasiaInstallerUI.exe 4932 CamtasiaInstallerUI.exe 4932 CamtasiaInstallerUI.exe 4932 CamtasiaInstallerUI.exe 4232 vc_redist.x64.exe 6008 CamtasiaInstallerUI.exe 6008 CamtasiaInstallerUI.exe 6008 CamtasiaInstallerUI.exe 6008 CamtasiaInstallerUI.exe 6008 CamtasiaInstallerUI.exe 1884 VC_redist.x64.exe 3736 VC_redist.x64.exe 3828 MsiExec.exe 4340 rundll32.exe 4340 rundll32.exe 4340 rundll32.exe 4340 rundll32.exe 4340 rundll32.exe 4340 rundll32.exe 4340 rundll32.exe 4340 rundll32.exe 3828 MsiExec.exe 4848 rundll32.exe 4848 rundll32.exe 4848 rundll32.exe 4848 rundll32.exe 4848 rundll32.exe 3828 MsiExec.exe 5472 rundll32.exe 5472 rundll32.exe 5472 rundll32.exe 5472 rundll32.exe 5472 rundll32.exe 3828 MsiExec.exe 5788 rundll32.exe 5788 rundll32.exe 5788 rundll32.exe 5788 rundll32.exe 5788 rundll32.exe 4396 MsiExec.exe 4396 MsiExec.exe 3828 MsiExec.exe 816 rundll32.exe 816 rundll32.exe 816 rundll32.exe 816 rundll32.exe 816 rundll32.exe 3828 MsiExec.exe 4464 rundll32.exe 4464 rundll32.exe 4464 rundll32.exe 4464 rundll32.exe 4464 rundll32.exe 4396 MsiExec.exe 4396 MsiExec.exe 4396 MsiExec.exe 4396 MsiExec.exe - Checks whether UAC is enabled 1 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA CamtasiaStudio.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6116 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 30 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname TechSmithAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain TechSmithAgent.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe - System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CamtasiaInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CamtasiaInstallerUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CamtasiaInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language camtasia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CamtasiaInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CamtasiaInstallerUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 6992 chrome.exe - Checks SCSI registry key(s) 3 TTPs 11 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000463f4e358e8ea170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010463f4e30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010463f4e3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30463f4e300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60463f4e300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Checks processor information in registry 2 TTPs 11 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier CamtasiaStudio.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier CamtasiaStudio.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CamtasiaStudio.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CamtasiaStudio.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CamtasiaStudio.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier CamtasiaStudio.exe - Enumerates system info in registry 2 TTPs 15 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 6392 ipconfig.exe - Modifies data under HKEY_USERS 23 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d msiexec.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FC797AF667B6D6B478EE67F829007802\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CamtasiaStudio.Themes\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CamtasiaStudio.Packages msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\camtasiaauth\Shell\open\command msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" mmc.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff notepad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CamtasiaRecorder.TechSmithRecording\shell\ = "open" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CamtasiaStudio.LibraryAssets\shell\open\command\ = "\"C:\\Program Files\\TechSmith\\Camtasia\\CamtasiaStudio.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CamtasiaStudio.LibraryAssets\DefaultIcon\ = "C:\\Windows\\Installer\\{817B37FD-3113-4C86-A0FF-FA63798C2CEC}\\CamtasiaIcons.exe,6" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF73B718311368C40AFFAF3697C8C2CE\Language = "1033" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0\0\4 mmc.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\25\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" mmc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic" notepad.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5a00310000000000575db483100053797374656d33320000420009000400efbe8158a93a575db4832e000000a80d000000000100000000000000000000000000000081100301530079007300740065006d0033003200000018000000 mmc.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" mmc.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" mmc.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} mmc.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\33\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" mmc.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} notepad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DF73B718311368C40AFFAF3697C8C2CE\Options_Files msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 mmc.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0\0\1\0 = 6000310000000000575dce8310004241434b47527e310000480009000400efbe575dce83575deb832e00000096c6010000000b000000000000000000000000000000b71504006200610063006b00670072006f0075006e0064007300000018000000 mmc.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\21\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" mmc.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0\0\10\0 mmc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\techsmithcamtasia\Shell\open\command\ = "\"C:\\Program Files\\TechSmith\\Camtasia\\CamtasiaStudio.exe\" \"%1\"" CamtasiaStudio.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\38\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" notepad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0FC2A1394042AE54285F437553EAA609 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tscprojzip\ = "CamtasiaOnline.Project" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DF73B718311368C40AFFAF3697C8C2CE\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tscprojzip\CamtasiaOnline.Project msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files|TechSmith|Camtasia|Microsoft.Toolkit.Uwp.Notifications.dll\Microsoft.Toolkit.Uwp.Notifications,culture="neutral",version="2.0.0.0",processorArchitecture="MSIL",fileVersion="2.0.0.0" = 5a00460040005d0051003f003f0057005a0040007e00370046002e00480047002c00240076007400530074007500640069006f003e006100520050004a003800730032007400750038004e006f0047007800300026006b002a0046002d0000000000 msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" mmc.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\31\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" mmc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\32\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" mmc.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202 mmc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CamtasiaStudio.TechSmithShader\shell\open msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{b2762713-8c64-4d94-8e75-7001a90b535c} CamtasiaStudio.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" mmc.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0\0\6\0\MRUListEx = 00000000ffffffff mmc.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\34\Shell mmc.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" mmc.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CamtasiaStudio.Packages\ = "Camtasia Packages" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CLSID\{b2762713-8c64-4d94-8e75-7001a90b535c}\LocalServer32\ = "\"C:\\Program Files\\TechSmith\\Camtasia\\CamtasiaStudio.exe\" -ToastActivated" CamtasiaStudio.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" mmc.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" mmc.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0\0\MRUListEx = 0700000006000000050000000400000003000000020000000100000000000000ffffffff mmc.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0\0\9\0\1 = 5a00310000000000575dd183100043616c6c6f7574730000420009000400efbe575dd183575deb832e00000090ca010000000800000000000000000000000000000048822800430061006c006c006f00750074007300000018000000 mmc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CamtasiaStudio.TechSmithProject\shell\open\command\command = 5a00460040005d0051003f003f0057005a0040007e00370046002e00480047002c00240076007400530074007500640069006f003e006b002b0065003d002b0041005f0064004f004100430078002c00780045006500660070005f004a002000220025003100220000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CamtasiaStudio.DeviceFrames\ = "Camtasia Device Frames" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\techsmithcamtasia\Shell\open\command\ = "\"C:\\Program Files\\TechSmith\\Camtasia\\CamtasiaStudio.exe\" \"%1\"" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 mmc.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" mmc.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" mmc.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 mmc.exe Set value (int) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" mmc.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell mmc.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{F2144426-4EF2-4fd0-A32A-9F77371C1D62}\VersionIndependentProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\techsmithcamtasia\DefaultIcon msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:|Program Files|TechSmith|Camtasia|SharedManagedTypes.dll\SharedManagedTypes,culture="neutral",version="26.2.0.19099",processorArchitecture="MSIL",fileVersion="26.2.0.19099" = 5a00460040005d0051003f003f0057005a0040007e00370046002e00480047002c00240076007400530074007500640069006f003e0073004a00300058002600600025006e0048004000530074006a004500760059003500690031006e0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\techsmithcamtasia\DefaultIcon\ = "C:\\Program Files\\TechSmith\\Camtasia\\CamtasiaStudio.exe" CamtasiaStudio.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0\0\MRUListEx = 0100000000000000ffffffff mmc.exe - Modifies system certificate store 2 TTPs 13 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\CA\Certificates\06B25927C42A721631C1EFD9431E648FA62E1E39\Blob = 03000000010000001400000006b25927c42a721631c1efd9431e648fa62e1e391400000001000000140000008418cc8534ecbc0c94942e08599cc7b2104e0a086b000000010000002000000087dcd4dc74640a322cd205552506d1be64f12596258096544986b4850bc727060f0000000100000020000000c95f7b20f6fcd39fd3a07a2e44252423b634fdbe35e1e045d964deea626115cb19000000010000001000000094ba2a8e68434595d5aff46246c54c125c00000001000000040000000008000018000000010000001000000014d4b19434670e6dc091d154abb20edc200000000100000096040000308204923082037aa0030201020213067f944a2a27cdf3fac2ae2b01f908eeb9c4c6300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3135303532353132303030305a170d3337313233313031303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a38201313082012d300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08301f0603551d230418301680149c5f00dfaa01d7302b3888a2b86d4a9cf2119183307806082b06010505070101046c306a302e06082b060105050730018622687474703a2f2f6f6373702e726f6f7467322e616d617a6f6e74727573742e636f6d303806082b06010505073002862c687474703a2f2f6372742e726f6f7467322e616d617a6f6e74727573742e636f6d2f726f6f7467322e636572303d0603551d1f043630343032a030a02e862c687474703a2f2f63726c2e726f6f7467322e616d617a6f6e74727573742e636f6d2f726f6f7467322e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b050003820101006237425cbc10b53e8b2ce90c9b6c45e207007af9c5580bb9088c3eedb3253cb56f50e4cd356aa79334963221a94844ab9ced3db4aa736de47f1680896ccf280318834779a3107e305bac3bb060e077d408a6e11d7c5ec0bbf99a7b229da700097eac461783dc9c265799303962968feddadeaac5cc1b3eca43686c5716bcd50e202efeffc26a5d2ea04a6d14588794e639315f7c73cb90886a84119627a6edd98146a67ea372000a523e83880763778969170f3985d2ab08454dd0513afd5d5d37644c7e30b25524429d36b05d9c178161f1caf9100224abeb0d74918d7b4529503988b2a68935251e146a4723312f5c9afaad9a0e6251a42aa9c4f9349d2118 CamtasiaStudio.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\DE294FFF5DF1AC6E4CD561A687D2A287AD6F15C9 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\DE294FFF5DF1AC6E4CD561A687D2A287AD6F15C9\Blob = 030000000100000014000000de294fff5df1ac6e4cd561a687d2a287ad6f15c90b0000000100000048000000540065006300680053006d006900740068002000430061006d00740061007300690061002000460075007300650020004300650072007400690066006900630061007400650000000200000001000000bc0000001c0000006c00000000000000200000000000000000000000000000007b00440041003800460035004400380046002d0037003700300031002d0034004600420039002d0042003900420042002d003600440034003100340043004300320036003800390037007d00000000004d006900630072006f0073006f0066007400200053006f0066007400770061007200650020004b00650079002000530074006f0072006100670065002000500072006f007600690064006500720000002000000001000000540300003082035030820238a003020102020900d841432992da586e300d06092a864886f70d01010b05003029312730250603550403131e7473636d6f62696c65636f6e6e6563742e74656368736d6974682e636f6d301e170d3236313032333136333030325a170d3336313032333136333030325a3029312730250603550403131e7473636d6f62696c65636f6e6e6563742e74656368736d6974682e636f6d30820122300d06092a864886f70d01010105000382010f003082010a02820101009fbdc53bb0ed1b45a4ed4efe79985bc02bbe8492d301b73ac0a993e8a29bff1e067ef76d710e022983323c497d6d184d11a0c09e327e3126195ddbd20449c239be94ad17b8d2f3029b667d0cd7a4c596e8c40f066c5b6158c53ddcffb3e69add026ac4c23db0b543dae992dc2fa422c101fd578b9ae20834b93da4e4f1549671176a5ff8e13847bb68c3f6a607b8c0d5e0feb53829d7def58d212677ed99b159a92f1d34c80e4b46cbff950dc9dd3602fa55b1c7a551ae70f42feae47742ffa1ce5a4a62293e87f8316605b19a9f72d755ea909926908571dcd113cef3956a8a9ca789b4c4b54f212b869b7a09856b4b3d2b5bb2e6dc4952e2111e64b3e573390203010001a37b3079300e0603551d0f0101ff0404030205a0301d0603551d250416301406082b0601050507030206082b0601050507030130290603551d1104223020821e7473636d6f62696c65636f6e6e6563742e74656368736d6974682e636f6d301d0603551d0e0416041409fe220ce6276c6a9cddb67c1fba02b98c435e8c300d06092a864886f70d01010b05000382010100691bc70835712626889dd02a690fa7125729f4e3a9ba0cc5522728f3c67ac9aa9a34f5060ff8e59bd8590449c05a53d58d21004cb404e0eadf270c88458dca7dda3df1e4d56ca834f63eda1698ccfdd7220931a9818b119b0aa75f712081c78037235963f89a2a06ed4df80081612890eb3858e79859cf6d6a91f937f96095d4f41de1b76d25a92e30cbde8850f23679fd5fd10e7f545c9bd2c6f2e6967dd9984f93272af563709d4bd366ebb3ceb430b0a1a9013c8ea76c04fa92e4518755b7d39ad52eebc6b372ad47460a5ece7d37763cf52639557031f70d58bd746a051f54d411fd86755e89d69c9e282a34d1b146fe489be62edf04ddfd3f8c264b5935 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\DE294FFF5DF1AC6E4CD561A687D2A287AD6F15C9\Blob = 14000000010000001400000009fe220ce6276c6a9cddb67c1fba02b98c435e8c0200000001000000bc0000001c0000006c00000000000000200000000000000000000000000000007b00440041003800460035004400380046002d0037003700300031002d0034004600420039002d0042003900420042002d003600440034003100340043004300320036003800390037007d00000000004d006900630072006f0073006f0066007400200053006f0066007400770061007200650020004b00650079002000530074006f0072006100670065002000500072006f007600690064006500720000000b0000000100000048000000540065006300680053006d006900740068002000430061006d0074006100730069006100200046007500730065002000430065007200740069006600690063006100740065000000030000000100000014000000de294fff5df1ac6e4cd561a687d2a287ad6f15c92000000001000000540300003082035030820238a003020102020900d841432992da586e300d06092a864886f70d01010b05003029312730250603550403131e7473636d6f62696c65636f6e6e6563742e74656368736d6974682e636f6d301e170d3236313032333136333030325a170d3336313032333136333030325a3029312730250603550403131e7473636d6f62696c65636f6e6e6563742e74656368736d6974682e636f6d30820122300d06092a864886f70d01010105000382010f003082010a02820101009fbdc53bb0ed1b45a4ed4efe79985bc02bbe8492d301b73ac0a993e8a29bff1e067ef76d710e022983323c497d6d184d11a0c09e327e3126195ddbd20449c239be94ad17b8d2f3029b667d0cd7a4c596e8c40f066c5b6158c53ddcffb3e69add026ac4c23db0b543dae992dc2fa422c101fd578b9ae20834b93da4e4f1549671176a5ff8e13847bb68c3f6a607b8c0d5e0feb53829d7def58d212677ed99b159a92f1d34c80e4b46cbff950dc9dd3602fa55b1c7a551ae70f42feae47742ffa1ce5a4a62293e87f8316605b19a9f72d755ea909926908571dcd113cef3956a8a9ca789b4c4b54f212b869b7a09856b4b3d2b5bb2e6dc4952e2111e64b3e573390203010001a37b3079300e0603551d0f0101ff0404030205a0301d0603551d250416301406082b0601050507030206082b0601050507030130290603551d1104223020821e7473636d6f62696c65636f6e6e6563742e74656368736d6974682e636f6d301d0603551d0e0416041409fe220ce6276c6a9cddb67c1fba02b98c435e8c300d06092a864886f70d01010b05000382010100691bc70835712626889dd02a690fa7125729f4e3a9ba0cc5522728f3c67ac9aa9a34f5060ff8e59bd8590449c05a53d58d21004cb404e0eadf270c88458dca7dda3df1e4d56ca834f63eda1698ccfdd7220931a9818b119b0aa75f712081c78037235963f89a2a06ed4df80081612890eb3858e79859cf6d6a91f937f96095d4f41de1b76d25a92e30cbde8850f23679fd5fd10e7f545c9bd2c6f2e6967dd9984f93272af563709d4bd366ebb3ceb430b0a1a9013c8ea76c04fa92e4518755b7d39ad52eebc6b372ad47460a5ece7d37763cf52639557031f70d58bd746a051f54d411fd86755e89d69c9e282a34d1b146fe489be62edf04ddfd3f8c264b5935 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\09FE220CE6276C6A9CDDB67C1FBA02B98C435E8C rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\09FE220CE6276C6A9CDDB67C1FBA02B98C435E8C\Blob = 0200000000000000bc0000001c0000006c00000000000000200000000000000000000000000000007b00440041003800460035004400380046002d0037003700300031002d0034004600420039002d0042003900420042002d003600440034003100340043004300320036003800390037007d00000000004d006900630072006f0073006f0066007400200053006f0066007400770061007200650020004b00650079002000530074006f0072006100670065002000500072006f0076006900640065007200000023000000000000001400000009fe220ce6276c6a9cddb67c1fba02b98c435e8c rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F CamtasiaStudio.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c00000001000000040000000008000019000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa46b0000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab52000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba CamtasiaStudio.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 6b0000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab50f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f19000000010000001000000014d4b19434670e6dc091d154abb20edc2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba CamtasiaStudio.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\CA\Certificates\E7B8B5A6743CE1B2F17B041DE59558A41472D70C CamtasiaStudio.exe Set value (data) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\CA\Certificates\E7B8B5A6743CE1B2F17B041DE59558A41472D70C\Blob = 030000000100000014000000e7b8b5a6743ce1b2f17b041de59558a41472d70c1400000001000000140000001f5292615682547f8166d81d3d0aaa325c87dd086b0000000100000020000000138bdf6e23ac971eb4e626b279dd6a26f057510f1de394293a5eea2860de019b0f0000000100000020000000ff45868fb631cdc246df2ffc080d9664f0d9fb3c784a1481382c5da82582e2c519000000010000001000000088406e56bbf68271e27caad6f7e2758f5c00000001000000040000000008000018000000010000001000000094ba2a8e68434595d5aff46246c54c122000000001000000620400003082045e30820346a00302010202130773124f2a952e3ed18a58bdb85d1bc0ce5f27300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323633355a170d3330303832333232323633355a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303430820122300d06092a864886f70d01010105000382010f003082010a0282010100cde9551e809503a9e317bbefa15d78f5f27a3800dfc998c75a2ef7f8eba55e927e7fbfa2a04a830858e9e3ec4071d06b258125d067bf85b3dfadea448e17521f6cc01149d754e76772ea38cbc7996ab6fa5a00d103ed39f5dd2767c704bac1ae782d27f181d29e68940558ad2660bd018fd7a45ff1d76d372c44121626dc7ba198d8bebd2780ab5b4b6093c0bd1097a274e959d483c58ea1bdd9b196a4d88bcd80b415d27e9190e7c1c7334870d02e9a41a92086bc168b97c6b252ceab3a6298d308b13edca9ad06271e897caa89aa641036994eda1f27f59b05260068c287f4d69a5da0b01683a71a30e334a26fd520b29a6b7d05f56febf108da87b96d19590203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e041604141f5292615682547f8166d81d3d0aaa325c87dd08301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b050003820101003ed4ee54b0068db96de51f326da4d1b006765df5011816dc698809c8695e2a0299c64bd382c3964fc227bb612943645e72c853ec161502d90f6e24763f0915756f98488861f4fbafb0e4f80a898d4c5ae593f1501a263171bee84cedafde7cdd93230d5677a58297a6118acba78d03ab48ffae9ea0bc039e3424dc99d49384de356a6addce6411a032f8a1763db0636dc4a707acaca890ce41f39af487ebb3d55b8c9c6cfcb4f075599c1c59e4dae5186f5bc174777cd4dacfe73e123e9ce409f0237aa4385812920dd8ef971d173ea93bfa252be7b702aca001cbf45a3ce69033ee063b2cb998c21cc0b9ea81f7189915dbd0e2da3e69ac725bc198c6d629d4 CamtasiaStudio.exe Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\SystemCertificates\CA\Certificates\06B25927C42A721631C1EFD9431E648FA62E1E39 CamtasiaStudio.exe - Suspicious behavior: AddClipboardFormatListener 4 IoCs
pid Process 200 CamtasiaStudio.exe 6024 CamtasiaStudio.exe 2896 CamtasiaStudio.exe 6860 CamtasiaStudio.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3308 msiexec.exe 3308 msiexec.exe 3308 msiexec.exe 3308 msiexec.exe 3308 msiexec.exe 3308 msiexec.exe 3308 msiexec.exe 3308 msiexec.exe 3308 msiexec.exe 3308 msiexec.exe 3308 msiexec.exe 3308 msiexec.exe 200 CamtasiaStudio.exe 200 CamtasiaStudio.exe 200 CamtasiaStudio.exe 2492 wmic.exe 2492 wmic.exe 2492 wmic.exe 2492 wmic.exe 5088 wmic.exe 5088 wmic.exe 5088 wmic.exe 5088 wmic.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 4804 mmc.exe 6616 taskmgr.exe 3780 notepad.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
pid Process 2284 msedgewebview2.exe 2284 msedgewebview2.exe 2284 msedgewebview2.exe 2284 msedgewebview2.exe 7080 msedgewebview2.exe 7080 msedgewebview2.exe 7080 msedgewebview2.exe 7080 msedgewebview2.exe 7080 msedgewebview2.exe 5380 msedgewebview2.exe 5380 msedgewebview2.exe 5380 msedgewebview2.exe 5380 msedgewebview2.exe 5208 msedgewebview2.exe 5208 msedgewebview2.exe 5208 msedgewebview2.exe 5208 msedgewebview2.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe 5948 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 3588 vssvc.exe Token: SeRestorePrivilege 3588 vssvc.exe Token: SeAuditPrivilege 3588 vssvc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: 33 4804 mmc.exe Token: SeIncBasePriorityPrivilege 4804 mmc.exe Token: SeBackupPrivilege 2720 srtasks.exe Token: SeRestorePrivilege 2720 srtasks.exe Token: SeSecurityPrivilege 2720 srtasks.exe Token: SeTakeOwnershipPrivilege 2720 srtasks.exe Token: SeBackupPrivilege 2720 srtasks.exe Token: SeRestorePrivilege 2720 srtasks.exe Token: SeSecurityPrivilege 2720 srtasks.exe Token: SeTakeOwnershipPrivilege 2720 srtasks.exe Token: SeShutdownPrivilege 3976 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 3976 VC_redist.x64.exe Token: SeSecurityPrivilege 3308 msiexec.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4932 CamtasiaInstallerUI.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6280 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4804 mmc.exe 4804 mmc.exe 3308 msiexec.exe 3828 MsiExec.exe 4396 MsiExec.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 6100 MsiExec.exe 464 MsiExec.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 200 CamtasiaStudio.exe 200 CamtasiaStudio.exe 200 CamtasiaStudio.exe 200 CamtasiaStudio.exe 200 CamtasiaStudio.exe 6280 taskmgr.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 4804 mmc.exe 6024 CamtasiaStudio.exe 6024 CamtasiaStudio.exe 6024 CamtasiaStudio.exe 6024 CamtasiaStudio.exe 6024 CamtasiaStudio.exe 6616 taskmgr.exe 6616 taskmgr.exe 6616 taskmgr.exe 3780 notepad.exe 3780 notepad.exe 3780 notepad.exe 3780 notepad.exe 3780 notepad.exe 3780 notepad.exe 3780 notepad.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5508 wrote to memory of 4932 5508 camtasia.exe 90 PID 5508 wrote to memory of 5936 5508 camtasia.exe 91 PID 6044 wrote to memory of 6028 6044 CamtasiaInstaller.exe 102 PID 5936 wrote to memory of 3304 5936 CamtasiaInstaller.exe 103 PID 3304 wrote to memory of 4232 3304 vc_redist.x64.exe 104 PID 6028 wrote to memory of 6008 6028 CamtasiaInstaller.exe 105 PID 4232 wrote to memory of 3976 4232 vc_redist.x64.exe 106 PID 4520 wrote to memory of 4896 4520 VC_redist.x64.exe 111 PID 4896 wrote to memory of 1884 4896 VC_redist.x64.exe 112 PID 1884 wrote to memory of 5660 1884 VC_redist.x64.exe 114 PID 3976 wrote to memory of 3000 3976 VC_redist.x64.exe 116 PID 3000 wrote to memory of 3736 3000 VC_redist.x64.exe 117 PID 3736 wrote to memory of 4888 3736 VC_redist.x64.exe 118 PID 3308 wrote to memory of 3828 3308 msiexec.exe 119 PID 3828 wrote to memory of 4340 3828 MsiExec.exe 120 PID 3828 wrote to memory of 4848 3828 MsiExec.exe 121 PID 3828 wrote to memory of 5472 3828 MsiExec.exe 122 PID 3828 wrote to memory of 5788 3828 MsiExec.exe 123 PID 3308 wrote to memory of 4396 3308 msiexec.exe 124 PID 3828 wrote to memory of 816 3828 MsiExec.exe 125 PID 3828 wrote to memory of 4464 3828 MsiExec.exe 126 PID 3308 wrote to memory of 6100 3308 msiexec.exe 128 PID 3308 wrote to memory of 464 3308 msiexec.exe 129 PID 464 wrote to memory of 5872 464 MsiExec.exe 130 PID 464 wrote to memory of 3328 464 MsiExec.exe 131 PID 6100 wrote to memory of 6116 6100 MsiExec.exe 132 PID 6116 wrote to memory of 5576 6116 cmd.exe 134 PID 4932 wrote to memory of 200 4932 CamtasiaInstallerUI.exe 140 PID 200 wrote to memory of 1148 200 CamtasiaStudio.exe 141 PID 200 wrote to memory of 2492 200 CamtasiaStudio.exe 143 PID 200 wrote to memory of 5088 200 CamtasiaStudio.exe 146 PID 200 wrote to memory of 2284 200 CamtasiaStudio.exe 149 PID 2284 wrote to memory of 4980 2284 msedgewebview2.exe 150 PID 2284 wrote to memory of 5364 2284 msedgewebview2.exe 151 PID 2284 wrote to memory of 5364 2284 msedgewebview2.exe 151 PID 2284 wrote to memory of 5364 2284 msedgewebview2.exe 151 PID 2284 wrote to memory of 5364 2284 msedgewebview2.exe 151 PID 2284 wrote to memory of 5980 2284 msedgewebview2.exe 152 PID 2284 wrote to memory of 1888 2284 msedgewebview2.exe 153 PID 2284 wrote to memory of 1888 2284 msedgewebview2.exe 153 PID 2284 wrote to memory of 1888 2284 msedgewebview2.exe 153 PID 2284 wrote to memory of 1160 2284 msedgewebview2.exe 154 PID 2284 wrote to memory of 1160 2284 msedgewebview2.exe 154 PID 2284 wrote to memory of 1160 2284 msedgewebview2.exe 154 PID 2284 wrote to memory of 1160 2284 msedgewebview2.exe 154 PID 2284 wrote to memory of 1160 2284 msedgewebview2.exe 154 PID 2284 wrote to memory of 2080 2284 msedgewebview2.exe 155 PID 2284 wrote to memory of 2080 2284 msedgewebview2.exe 155 PID 2284 wrote to memory of 2080 2284 msedgewebview2.exe 155 PID 2284 wrote to memory of 2080 2284 msedgewebview2.exe 155 PID 2284 wrote to memory of 2080 2284 msedgewebview2.exe 155 PID 2284 wrote to memory of 3388 2284 msedgewebview2.exe 156 PID 2284 wrote to memory of 3388 2284 msedgewebview2.exe 156 PID 2284 wrote to memory of 3388 2284 msedgewebview2.exe 156 PID 2284 wrote to memory of 3388 2284 msedgewebview2.exe 156 PID 2284 wrote to memory of 3388 2284 msedgewebview2.exe 156 PID 2284 wrote to memory of 4900 2284 msedgewebview2.exe 157 PID 2284 wrote to memory of 4900 2284 msedgewebview2.exe 157 PID 2284 wrote to memory of 4900 2284 msedgewebview2.exe 157 PID 2284 wrote to memory of 4900 2284 msedgewebview2.exe 157 PID 2284 wrote to memory of 4900 2284 msedgewebview2.exe 157 PID 6024 wrote to memory of 716 6024 CamtasiaStudio.exe 176 PID 6024 wrote to memory of 5208 6024 CamtasiaStudio.exe 177 PID 6024 wrote to memory of 3092 6024 CamtasiaStudio.exe 179 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\camtasia.exe"C:\Users\Admin\AppData\Local\Temp\camtasia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\TEMP\{DE4C5D77-6A48-4B36-A5BE-DFEF1F615B8F}\.ba\CamtasiaInstallerUI.exe"C:\Windows\TEMP\{DE4C5D77-6A48-4B36-A5BE-DFEF1F615B8F}\.ba\CamtasiaInstallerUI.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{85527FBD-1568-41AC-B37A-E29565F0F354} {897972A1-E9C9-416F-93A7-422940F10CD4}2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Program Files\TechSmith\Camtasia\CamtasiaStudio.exe"C:\Program Files\TechSmith\Camtasia\CamtasiaStudio.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Program Files\TechSmith\Camtasia\crashpad_handler.exe"C:\Program Files\TechSmith\Camtasia\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\CrashReportingNative --metrics-dir=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\CrashReportingNative --url=https://submit.backtrace.io/techsmith/252ca6f32f8a07a44ceb1046d56ffdae143ffbae8f1c0fb906b4c9aea03dad15/minidump --annotation=format=minidump --annotation=token=252ca6f32f8a07a44ceb1046d56ffdae143ffbae8f1c0fb906b4c9aea03dad15 --initial-client-data=0xba8,0xbac,0xbb0,0xb84,0xbc4,0x7ffffb941f98,0x7ffffb941fb0,0x7ffffb941fc84⤵
- Executes dropped EXE
PID:1148
-
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe /namespace:'\\root\virtualization\v2' path msvm_computersystem get caption4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:2492
-
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe /namespace:'\\root\virtualization\v2' path msvm_computersystem get caption4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5088
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=200.5372.18029394416124083047 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c004⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView /prefetch:4 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x198,0x7ffff2ad5fd8,0x7ffff2ad5fe4,0x7ffff2ad5ff05⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1692 --field-trial-handle=1700,i,17337615861515634067,9816585635109159678,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c005⤵PID:5364
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2192 --field-trial-handle=1700,i,17337615861515634067,9816585635109159678,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c005⤵PID:5980
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2380 --field-trial-handle=1700,i,17337615861515634067,9816585635109159678,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c005⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3300 --field-trial-handle=1700,i,17337615861515634067,9816585635109159678,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:15⤵PID:1160
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3456 --field-trial-handle=1700,i,17337615861515634067,9816585635109159678,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:15⤵PID:2080
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3584 --field-trial-handle=1700,i,17337615861515634067,9816585635109159678,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:15⤵PID:3388
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3792 --field-trial-handle=1700,i,17337615861515634067,9816585635109159678,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:15⤵PID:4900
-
-
-
-
-
C:\Windows\TEMP\{DE4C5D77-6A48-4B36-A5BE-DFEF1F615B8F}\.be\CamtasiaInstaller.exe"C:\Windows\TEMP\{DE4C5D77-6A48-4B36-A5BE-DFEF1F615B8F}\.be\CamtasiaInstaller.exe" -q -burn.elevated BurnPipe.{5A166C22-9CED-42DB-82C8-E52F82F82DD3} {28D342C5-2B58-4ED1-ACF5-FEE2C07A20AB} 55082⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\ProgramData\Package Cache\C42C82CFD5EAA2165B600F6109CB14FF4308CDF4CFF656A1375B4A933F1630BF\vc_redist.x64.exe"C:\ProgramData\Package Cache\C42C82CFD5EAA2165B600F6109CB14FF4308CDF4CFF656A1375B4A933F1630BF\vc_redist.x64.exe" /install /quiet /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\Temp\{3DEA67B1-C0B6-4309-8324-6C350BE8B069}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{3DEA67B1-C0B6-4309-8324-6C350BE8B069}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\C42C82CFD5EAA2165B600F6109CB14FF4308CDF4CFF656A1375B4A933F1630BF\vc_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\Temp\{DB4EC45F-80BF-4EB6-B9AC-402BAAFAD25C}\.be\VC_redist.x64.exe"C:\Windows\Temp\{DB4EC45F-80BF-4EB6-B9AC-402BAAFAD25C}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{2D635F98-11DA-4419-B161-C830EEDD7856} {118D5F50-914D-455B-A156-DFF97CD1FFCB} 42325⤵
- Adds Run key to start application
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=932 -burn.embedded BurnPipe.{5A21AEA7-2C47-4E72-9E11-21B154A27AC4} {DA3B9C18-81CE-42B2-A1AF-B70074D2FADC} 39766⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=932 -burn.embedded BurnPipe.{5A21AEA7-2C47-4E72-9E11-21B154A27AC4} {DA3B9C18-81CE-42B2-A1AF-B70074D2FADC} 39767⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{01957B3B-921F-4440-85DB-E5FC275F5AE4} {431E5445-4829-4D00-AEDA-CD456412C54A} 37368⤵
- System Location Discovery: System Language Discovery
PID:4888
-
-
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding1⤵PID:5912
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\WF.msc"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4804
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5668
-
C:\ProgramData\Package Cache\{A70C4630-EA5A-4956-B048-7EC8FF8670E9}\CamtasiaInstaller.exe"C:\ProgramData\Package Cache\{A70C4630-EA5A-4956-B048-7EC8FF8670E9}\CamtasiaInstaller.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\ProgramData\Package Cache\{A70C4630-EA5A-4956-B048-7EC8FF8670E9}\CamtasiaInstaller.exe"C:\ProgramData\Package Cache\{A70C4630-EA5A-4956-B048-7EC8FF8670E9}\CamtasiaInstaller.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Camtasia_20261023172836.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\TEMP\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\CamtasiaInstallerUI.exe"C:\Windows\TEMP\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\CamtasiaInstallerUI.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{600EF4BB-724D-420C-A2FA-3406D2BB39A6} {9D8047AF-88B8-4518-A295-012EABA82430}3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6008
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2DAA4BB79F61B1E12B5B089EA66EDA7B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI85DB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240879281 7 CamtasiaManagedCA!CamtasiaManagedCA.CustomActions.IsWebView2RuntimeInstalled3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4340
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI8ACE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240880390 11 FileSystemCA!FileSystemCA.CustomActions.TSC_SetPropertyFromIniFile3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4848
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI8D11.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240880937 19 FileSystemCA!FileSystemCA.CustomActions.TSC_SetPropertyFromIniFile3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5472
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI8EA8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240881390 27 FileSystemCA!FileSystemCA.CustomActions.TSC_SetPropertyFromIniFile3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5788
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIA550.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240887140 58 FuseCA!FuseCA.CertificateCustomActions.TSC_FindFuseCertificate3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:816
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIA62C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240887359 62 FuseCA!FuseCA.CertificateCustomActions.TSC_CreateFuseCertificate3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4464
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 193E1D0949BBDF2DF6B450D03B9382932⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4396
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding E8ADE10F52EA6363B8FB23FC0B102772 E Global\MSI00002⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\System32\cmd.exe"cmd" /c netsh http add sslcert ipport=0.0.0.0:8327 certhash=DE294FFF5DF1AC6E4CD561A687D2A287AD6F15C9 appid={817B37FD-3113-4C86-A0FF-FA63798C2CEC}3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\System32\netsh.exenetsh http add sslcert ipport=0.0.0.0:8327 certhash=DE294FFF5DF1AC6E4CD561A687D2A287AD6F15C9 appid={817B37FD-3113-4C86-A0FF-FA63798C2CEC}4⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5576
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 15758D448BDC27C20EDF547E7C0B6F69 E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI3893.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240924953 484 FileSystemCA!FileSystemCA.SupportToolCustomAction.TSC_ReplaceTokenInSupportToolConfig3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5872
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI3B73.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240925640 494 FuseCA!FuseCA.CertificateCustomActions.TSC_InstallFuseCertificate3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:3328
-
-
-
C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261023172926.log" /install2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261023172926.log" /install3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{26543351-148A-48F8-8864-7509492B8A1A} {0BAD803B-A61B-47B2-920F-593272BBFD1A} 18844⤵
- Adds Run key to start application
- Enumerates connected drives
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5660
-
-
-
-
C:\Program Files\Common Files\TechSmith Shared\TechSmith Agent\TechSmithAgent.exe"C:\Program Files\Common Files\TechSmith Shared\TechSmith Agent\TechSmithAgent.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵PID:5728
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6280
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\adee361f4c2d4abcb6e7689c799fc323 /t 2820 /p 2001⤵PID:6880
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:6240
-
C:\Program Files\TechSmith\Camtasia\CamtasiaStudio.exe"C:\Program Files\TechSmith\Camtasia\CamtasiaStudio.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Program Files\TechSmith\Camtasia\crashpad_handler.exe"C:\Program Files\TechSmith\Camtasia\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\CrashReportingNative --metrics-dir=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\CrashReportingNative --url=https://submit.backtrace.io/techsmith/252ca6f32f8a07a44ceb1046d56ffdae143ffbae8f1c0fb906b4c9aea03dad15/minidump --annotation=format=minidump --annotation=token=252ca6f32f8a07a44ceb1046d56ffdae143ffbae8f1c0fb906b4c9aea03dad15 --initial-client-data=0xb78,0xb7c,0xb80,0xb18,0xba8,0x7ff800031f98,0x7ff800031fb0,0x7ff800031fc82⤵
- Executes dropped EXE
PID:716
-
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe /namespace:'\\root\virtualization\v2' path msvm_computersystem get caption2⤵
- Reads the TCP/IP host and domain name from the registry
PID:5208
-
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe /namespace:'\\root\virtualization\v2' path msvm_computersystem get caption2⤵
- Reads the TCP/IP host and domain name from the registry
PID:3092
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6024.4616.3649838822523038751 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c002⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:7080 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView /prefetch:4 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x110,0x7ffff2ad5fd8,0x7ffff2ad5fe4,0x7ffff2ad5ff03⤵PID:6452
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1740,i,4108807677146123524,1568651395533495814,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c003⤵PID:6700
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=1740,i,4108807677146123524,1568651395533495814,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c003⤵PID:5548
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1740,i,4108807677146123524,1568651395533495814,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c003⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3556 --field-trial-handle=1740,i,4108807677146123524,1568651395533495814,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3736 --field-trial-handle=1740,i,4108807677146123524,1568651395533495814,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:5576
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3860 --field-trial-handle=1740,i,4108807677146123524,1568651395533495814,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:3264
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4008 --field-trial-handle=1740,i,4108807677146123524,1568651395533495814,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:3320
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4952 --field-trial-handle=1740,i,4108807677146123524,1568651395533495814,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:6872
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5236 --field-trial-handle=1740,i,4108807677146123524,1568651395533495814,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c003⤵PID:6828
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5376 --field-trial-handle=1740,i,4108807677146123524,1568651395533495814,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c003⤵PID:6860
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5368 --field-trial-handle=1740,i,4108807677146123524,1568651395533495814,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c003⤵PID:5632
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:6616
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5212
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"1⤵PID:5912
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"1⤵PID:3516
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"1⤵
- Drops file in Drivers directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3780
-
C:\Program Files\TechSmith\Camtasia\CamtasiaStudio.exe"C:\Program Files\TechSmith\Camtasia\CamtasiaStudio.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
PID:2896 -
C:\Program Files\TechSmith\Camtasia\crashpad_handler.exe"C:\Program Files\TechSmith\Camtasia\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\CrashReportingNative --metrics-dir=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\CrashReportingNative --url=https://submit.backtrace.io/techsmith/252ca6f32f8a07a44ceb1046d56ffdae143ffbae8f1c0fb906b4c9aea03dad15/minidump --annotation=format=minidump --annotation=token=252ca6f32f8a07a44ceb1046d56ffdae143ffbae8f1c0fb906b4c9aea03dad15 --initial-client-data=0xb04,0xb08,0xb0c,0xb5c,0xbb8,0x7ffffdcd1f98,0x7ffffdcd1fb0,0x7ffffdcd1fc82⤵
- Executes dropped EXE
PID:7040
-
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe /namespace:'\\root\virtualization\v2' path msvm_computersystem get caption2⤵
- Reads the TCP/IP host and domain name from the registry
PID:3064
-
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe service where (Name='vmcompute') get Name, State2⤵
- Reads the TCP/IP host and domain name from the registry
PID:716
-
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe /namespace:'\\root\virtualization\v2' path msvm_computersystem get caption2⤵
- Reads the TCP/IP host and domain name from the registry
PID:4516
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2896.3084.12008131914335511529 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c002⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5380 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView /prefetch:4 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1cc,0x7ffff2ad5fd8,0x7ffff2ad5fe4,0x7ffff2ad5ff03⤵PID:6560
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1712 --field-trial-handle=1716,i,11014567666293422916,12384632737418936210,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c003⤵PID:7052
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1964 --field-trial-handle=1716,i,11014567666293422916,12384632737418936210,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c003⤵PID:424
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2444 --field-trial-handle=1716,i,11014567666293422916,12384632737418936210,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c003⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3612 --field-trial-handle=1716,i,11014567666293422916,12384632737418936210,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:6984
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3804 --field-trial-handle=1716,i,11014567666293422916,12384632737418936210,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3920 --field-trial-handle=1716,i,11014567666293422916,12384632737418936210,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:4640
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4064 --field-trial-handle=1716,i,11014567666293422916,12384632737418936210,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:6976
-
-
-
C:\Program Files\TechSmith\Camtasia\CamtasiaStudio.exe"C:\Program Files\TechSmith\Camtasia\CamtasiaStudio.exe"1⤵
- Executes dropped EXE
PID:2584
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:5012
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns2⤵
- Gathers network information
PID:6392
-
-
C:\Program Files\TechSmith\Camtasia\CamtasiaStudio.exe"C:\Program Files\TechSmith\Camtasia\CamtasiaStudio.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
PID:6860 -
C:\Program Files\TechSmith\Camtasia\crashpad_handler.exe"C:\Program Files\TechSmith\Camtasia\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\CrashReportingNative --metrics-dir=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\CrashReportingNative --url=https://submit.backtrace.io/techsmith/252ca6f32f8a07a44ceb1046d56ffdae143ffbae8f1c0fb906b4c9aea03dad15/minidump --annotation=format=minidump --annotation=token=252ca6f32f8a07a44ceb1046d56ffdae143ffbae8f1c0fb906b4c9aea03dad15 --initial-client-data=0xb44,0xb7c,0xb80,0xb58,0xc38,0x7ffffd9a1f98,0x7ffffd9a1fb0,0x7ffffd9a1fc82⤵
- Executes dropped EXE
PID:1820
-
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe /namespace:'\\root\virtualization\v2' path msvm_computersystem get caption2⤵
- Reads the TCP/IP host and domain name from the registry
PID:6092
-
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe /namespace:'\\root\virtualization\v2' path msvm_computersystem get caption2⤵
- Reads the TCP/IP host and domain name from the registry
PID:6188
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6860.6768.1428813326277976550 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c002⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5208 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView /prefetch:4 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1cc,0x7ffff2ad5fd8,0x7ffff2ad5fe4,0x7ffff2ad5ff03⤵PID:3876
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1784,i,6590446402152346419,10373251400591588540,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c003⤵PID:2576
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2656 --field-trial-handle=1784,i,6590446402152346419,10373251400591588540,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c003⤵PID:5848
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2724 --field-trial-handle=1784,i,6590446402152346419,10373251400591588540,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c003⤵PID:7148
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3540 --field-trial-handle=1784,i,6590446402152346419,10373251400591588540,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:4508
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3740 --field-trial-handle=1784,i,6590446402152346419,10373251400591588540,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3860 --field-trial-handle=1784,i,6590446402152346419,10373251400591588540,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:6428
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4004 --field-trial-handle=1784,i,6590446402152346419,10373251400591588540,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:3008
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:5088
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Blocked_Repack_CamtasiaRecorder" dir=out action=block program="C:\Program Files\TechSmith\Camtasia\CamtasiaRecorder.exe" enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5140
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Blocked_Repack_CamtasiaStudio" dir=out action=block program="C:\Program Files\TechSmith\Camtasia\CamtasiaStudio.exe" enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3940
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Blocked_Repack_crashpad_handler" dir=out action=block program="C:\Program Files\TechSmith\Camtasia\crashpad_handler.exe" enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:6372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5948 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xc4,0x134,0x7ff812f6c728,0x7ff812f6c734,0x7ff812f6c7402⤵PID:6960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,18161374196019330414,17234697993001378452,262144 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:22⤵PID:7016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1544,i,4890754030717483863,8713298565009039512,524288 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:112⤵
- System Time Discovery
PID:6992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,859340930286979609,1240841195977412239,524288 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:132⤵PID:5396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,10503984293175439051,13309881947688562505,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,12688830781634498548,28628387555565015,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:1668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4828,i,5145987968295732364,14559124721439738333,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:12⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,5322156402773106050,9889472874204368080,524288 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:142⤵PID:6088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5156,i,10021552681499766099,11057608917243118637,524288 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:142⤵PID:6308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5484,i,14040324740390975734,8201607130328252034,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:6776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5512,i,13878196028296415530,1188578358172543889,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:12⤵PID:5160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5780,i,13056683088538557817,16782017379526026150,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:12⤵PID:5640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,9313442669622464826,2488370583696206192,524288 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:142⤵PID:5692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5940,i,4688904020330701,4597168160649749149,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:6952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6240,i,4139284396543779631,15463249242911129974,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:12⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6024,i,16388281574076334130,4955772517436186483,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:12⤵PID:5656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,5757126101491388484,7126320518605235499,524288 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:142⤵PID:4196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6468,i,6619722960622427030,15309160338270146511,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:12⤵PID:5956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,4631106596193726237,10270301999016031996,524288 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:142⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6076,i,7256799270321478280,17712771324885943832,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:12⤵PID:1140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6012,i,1933729588444298094,8727316068019607439,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:12⤵PID:5072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6148,i,17727386729025374651,6494983161798344661,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:92⤵PID:2864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6084,i,12069660601984018114,3720762175003719024,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:12⤵PID:3068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5648,i,4012279324316616602,9978643761311024724,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:12⤵PID:108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6280,i,15935683825653700280,16474092547954270005,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:12⤵PID:3720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6584,i,16986669962412795272,3271458626237022767,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:12⤵PID:5648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4656,i,4281828704497652644,5634558281071837108,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:12⤵PID:6120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6304,i,535738589250051346,5426323695009935557,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:12⤵PID:1908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6812,i,5181964404704976704,17553615749149765485,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:12⤵PID:6108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6928,i,6526279115427064596,16555890355436177501,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:12⤵PID:3664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6492,i,2835166159123196447,4044072365351334272,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:12⤵PID:3092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7236,i,13518876227876262073,5033322765184219878,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:12⤵PID:6996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7288,i,17678788550800282446,6017599697292766039,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:12⤵PID:7012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7404,i,8880571413927397107,995650232042406862,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:12⤵PID:6416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7456,i,1950819320357500672,9408735842924612467,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:12⤵PID:6620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7604,i,15022232274565032974,14776776530946633173,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:12⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7752,i,1341133037769227075,11173025659352774484,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:12⤵PID:1064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7896,i,6539991783995597507,5260514735418186361,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:12⤵PID:6648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=8040,i,16533291892378384925,4497602730989013079,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:12⤵PID:6972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=8288,i,10175898157992165607,8089294452581535080,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8304 /prefetch:12⤵PID:6836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=8348,i,11631858492523169261,93680820021542876,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8312 /prefetch:12⤵PID:5160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=8476,i,17040373585653943925,2830380784055283616,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8484 /prefetch:12⤵PID:1276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=8740,i,16153018123348611498,15262347295886468999,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8756 /prefetch:12⤵PID:2712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=8892,i,11256824285193815342,3397950536703366854,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8904 /prefetch:12⤵PID:2956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=8948,i,4748825216171525986,17750210399391661598,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8932 /prefetch:12⤵PID:6104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=8840,i,2838870450421601532,11980452808434543413,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9376 /prefetch:12⤵PID:6952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=5712,i,10287621297961608335,4671123915184069639,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9352 /prefetch:12⤵PID:6784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=5488,i,17294781574514973258,10520151656591866484,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:12⤵PID:4056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=6360,i,5108884872690638964,15917369570903758038,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:12⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=5708,i,17957832114702133716,1740479362779688037,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9408 /prefetch:12⤵PID:3552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=6184,i,13281617734698237628,14206603402923486259,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7832 /prefetch:12⤵PID:5640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=8836,i,2422560106075981631,7760325539482741471,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9276 /prefetch:12⤵PID:1852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=9464,i,16949535697356508514,14944066352377244918,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9480 /prefetch:12⤵PID:1636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=9600,i,12623092431041360369,7362761170879403117,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9620 /prefetch:12⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=9760,i,15565590988301804400,9526319792897791394,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9756 /prefetch:12⤵PID:6864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=9896,i,9071522968876712841,5638348011881963706,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9920 /prefetch:12⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=9944,i,3803320762961609651,4795562148755371919,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9960 /prefetch:12⤵PID:3972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=10224,i,9614944078935552669,11644853920333950889,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=10092 /prefetch:12⤵PID:1244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=10248,i,2190476680814867341,2351053525878569628,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=10256 /prefetch:12⤵PID:4176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=10520,i,4869193213637858480,5899788711700236848,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=10300 /prefetch:12⤵PID:5876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=10660,i,1223302067849581154,12263908937405224588,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=10540 /prefetch:12⤵PID:4088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=10500,i,6021285293609583596,15622409008047995924,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=10888 /prefetch:12⤵PID:836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=10984,i,6743971429062372569,10831005811667002369,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=10988 /prefetch:12⤵PID:3764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=11116,i,10957226050550772435,3374092320965570369,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11128 /prefetch:12⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=11148,i,10466395147487663573,1419672533944565179,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=10304 /prefetch:12⤵PID:6760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=11236,i,5666811658423587860,9107286985304305114,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11272 /prefetch:12⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=9896,i,7891557661101642496,9983909644603492080,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:12⤵PID:7276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=11604,i,18071565512804505210,11093622751002021969,524288 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11616 /prefetch:142⤵PID:7576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=11668,i,12923170230308591831,7988587549327495334,524288 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11576 /prefetch:142⤵PID:7584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=11620,i,3652869394971091892,7840808034401712172,524288 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11592 /prefetch:142⤵PID:7592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=12076,i,17831313129716753942,1605328484642162856,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=12080 /prefetch:12⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=10544,i,5981083274845382865,14656967748524119979,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11492 /prefetch:12⤵PID:7244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=5432,i,8662460691536441136,1085481245915722452,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11416 /prefetch:12⤵PID:7272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=10000,i,235201764714553590,11190720506929537972,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:12⤵PID:7264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=5612,i,2538897303090981439,10747689048459892508,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:12⤵PID:7252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=5580,i,1344770088162986345,17067493462819857685,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:12⤵PID:5568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=8984,i,9525928958676817752,16739656598383389385,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7924 /prefetch:12⤵PID:4032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=9632,i,5460944441478057237,2431777458279111258,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:12⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=8236,i,13547774860102724399,17488844391153866696,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9684 /prefetch:12⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --metrics-shmem-handle=8240,i,16222401007663692467,8726210106475558281,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8228 /prefetch:12⤵PID:4756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=8268,i,4921080401467514670,112454002283163708,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:12⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --metrics-shmem-handle=11376,i,4612580644695004204,17741745763931973369,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8840 /prefetch:12⤵PID:5576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=9056,i,12446598551793267197,5651768703173319966,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8448 /prefetch:12⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --metrics-shmem-handle=5488,i,3141621516232125898,13456033824546556627,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:12⤵PID:6744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --metrics-shmem-handle=8544,i,15232508162845777372,3169259297437164165,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8548 /prefetch:12⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --metrics-shmem-handle=7144,i,11185690344398068701,16298729541747493088,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:12⤵PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --metrics-shmem-handle=9632,i,10766083259110483666,14846719904078678587,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:12⤵PID:7860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --metrics-shmem-handle=6196,i,14244170036761050100,10769133008900865519,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:12⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --metrics-shmem-handle=5940,i,10911301821117396040,11629333638977663993,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9168 /prefetch:12⤵PID:8032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --metrics-shmem-handle=6496,i,16749506171365363055,5546612716157516447,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:12⤵PID:8040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --metrics-shmem-handle=6260,i,16881234537660002056,13658591007954521450,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:12⤵PID:1892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --metrics-shmem-handle=9316,i,14600814350802211811,6342475844907419974,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8004 /prefetch:12⤵PID:6976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --metrics-shmem-handle=7564,i,11030080295093823450,3011427829345021686,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:12⤵PID:4036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --metrics-shmem-handle=6696,i,10732043421150270658,2069387397439411079,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:12⤵PID:5140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --metrics-shmem-handle=11456,i,5827832508790679436,6192655559309241569,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9300 /prefetch:12⤵PID:2792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --metrics-shmem-handle=7212,i,3709886215529965333,3684637803710788235,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8248 /prefetch:12⤵PID:5592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --metrics-shmem-handle=6956,i,16807432345177712024,2215345874405162235,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:12⤵PID:6584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --metrics-shmem-handle=11720,i,861039007886688399,1305536711837137268,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11688 /prefetch:12⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --metrics-shmem-handle=11756,i,6459844238407984567,11646951570608285405,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:12⤵PID:7128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --metrics-shmem-handle=11752,i,2246712173664469120,10848468204258704399,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11696 /prefetch:12⤵PID:2676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --metrics-shmem-handle=11776,i,16308071175944358010,12205787553049374362,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=10896 /prefetch:12⤵PID:2632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --metrics-shmem-handle=8348,i,1168795280400792093,18337303052984508091,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8828 /prefetch:12⤵PID:2252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --metrics-shmem-handle=7404,i,13392993692075802205,6382762677716075252,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11088 /prefetch:12⤵PID:6540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --metrics-shmem-handle=9872,i,13772784310587247406,6595285040767286093,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:12⤵PID:3088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --metrics-shmem-handle=6852,i,17690130813891654260,589295333305127888,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9680 /prefetch:12⤵PID:5584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --metrics-shmem-handle=8676,i,3632401299996885323,14239713209063138308,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:12⤵PID:3264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --metrics-shmem-handle=8512,i,16122776355094855466,15886594924091654229,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:12⤵PID:1304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --metrics-shmem-handle=8652,i,705135015349548562,15029151979607395335,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11876 /prefetch:12⤵PID:6232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --metrics-shmem-handle=11788,i,15784821195101584061,8269016877897447055,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:12⤵PID:4752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --metrics-shmem-handle=7724,i,18027888842552332938,8732740664053724481,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8768 /prefetch:12⤵PID:4408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --metrics-shmem-handle=7752,i,16262352082498884880,543840736867668011,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=900 /prefetch:12⤵PID:3552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --metrics-shmem-handle=6852,i,10680364529916026538,9991092330882517402,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:12⤵PID:5980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --metrics-shmem-handle=7208,i,3181597436888781641,4109209129231488120,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:12⤵PID:7296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --metrics-shmem-handle=9872,i,13248760533019780259,7217927768619232255,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:12⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --metrics-shmem-handle=8688,i,965409065875035324,13357406394911055368,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8536 /prefetch:12⤵PID:7324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --metrics-shmem-handle=6524,i,8051470349032129232,830854382401882444,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8680 /prefetch:12⤵PID:7288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --metrics-shmem-handle=6364,i,11625121283642250992,14394746003355320705,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11316 /prefetch:12⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --metrics-shmem-handle=5740,i,2274358517405947576,10746185652916892069,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8500 /prefetch:12⤵PID:6996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --metrics-shmem-handle=8668,i,404797404307095538,4657130879985382778,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:12⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --metrics-shmem-handle=10404,i,12423597253743184840,14059237870575505421,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:12⤵PID:7124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --metrics-shmem-handle=7908,i,3182702610437679488,13798559768349383189,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:12⤵PID:7316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --metrics-shmem-handle=7204,i,7133169693051577865,10282103456212506785,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:12⤵PID:7304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --metrics-shmem-handle=8476,i,530835755280009151,16369006162166868978,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11644 /prefetch:12⤵PID:7392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --metrics-shmem-handle=8092,i,6351644897544999281,2653102218512441985,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9068 /prefetch:12⤵PID:5160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --metrics-shmem-handle=7096,i,5432767903503103783,9588949963620645496,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11616 /prefetch:12⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --metrics-shmem-handle=9160,i,10911394426817650607,16666936031859098082,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:12⤵PID:4368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --metrics-shmem-handle=9788,i,10720270743465749752,7306365070960389323,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11268 /prefetch:12⤵PID:5796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --metrics-shmem-handle=8868,i,940420803781739120,7434164952659671499,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:12⤵PID:6536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --metrics-shmem-handle=11440,i,9493786228393337316,15427036544176571471,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=12272 /prefetch:12⤵PID:8116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --metrics-shmem-handle=10104,i,4759708247077054931,9964546394236593975,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9724 /prefetch:12⤵PID:8124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --metrics-shmem-handle=11948,i,15710246327635385405,13860223388674318236,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:12⤵PID:6400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --metrics-shmem-handle=11984,i,4323689342874637583,9908885971551659507,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=12284 /prefetch:12⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --metrics-shmem-handle=7156,i,9818542886250436407,4708998631314145363,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:12⤵PID:5832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --metrics-shmem-handle=6516,i,2301039135997696075,6646204535548265826,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:12⤵PID:5484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --metrics-shmem-handle=8856,i,7656351540136589080,17817511204429179285,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:12⤵PID:5700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --metrics-shmem-handle=8112,i,3774338565747638153,1528849027101530840,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8400 /prefetch:12⤵PID:7396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --metrics-shmem-handle=7332,i,6337347190758863259,9431171472057787814,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8396 /prefetch:12⤵PID:7432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --metrics-shmem-handle=7364,i,14480782096405962188,13932177466864839173,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8084 /prefetch:12⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --metrics-shmem-handle=10700,i,1645241200922322370,5819010814025855726,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:12⤵PID:7544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --metrics-shmem-handle=11008,i,2412983353426351654,14557172198072665553,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=12244 /prefetch:12⤵PID:6696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --metrics-shmem-handle=7372,i,10877839402282709446,10894538001844678423,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:12⤵PID:7552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --metrics-shmem-handle=7164,i,13416393317261362870,12241512877038329940,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=8772 /prefetch:12⤵PID:7568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --metrics-shmem-handle=11936,i,4628407897013246445,133751984237799172,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:12⤵PID:7572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=144 --metrics-shmem-handle=8996,i,4057354596482690996,2652006424225821308,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:12⤵PID:3532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=145 --metrics-shmem-handle=9200,i,1984102912992864608,16713575027789702160,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=9096 /prefetch:12⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=146 --metrics-shmem-handle=7288,i,5815394450178857185,195355885266662499,2097152 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:12⤵PID:5640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=11304,i,8670308209831068735,8208055637124238418,262144 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=11028 /prefetch:102⤵PID:1344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=896,i,10996284046815599754,3846395341638011160,524288 --field-trial-handle=1872,i,6527332412088033659,11603764161627568940,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:142⤵PID:676
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:7120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1904
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:4480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:6320
-
C:\Program Files\TechSmith\Camtasia\CamtasiaStudio.exe"C:\Program Files\TechSmith\Camtasia\CamtasiaStudio.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2888 -
C:\Program Files\TechSmith\Camtasia\crashpad_handler.exe"C:\Program Files\TechSmith\Camtasia\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\CrashReportingNative --metrics-dir=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\CrashReportingNative --url=https://submit.backtrace.io/techsmith/252ca6f32f8a07a44ceb1046d56ffdae143ffbae8f1c0fb906b4c9aea03dad15/minidump --annotation=format=minidump --annotation=token=252ca6f32f8a07a44ceb1046d56ffdae143ffbae8f1c0fb906b4c9aea03dad15 --initial-client-data=0xa40,0xa44,0xa48,0xa10,0xa60,0x7ffffd4b1f98,0x7ffffd4b1fb0,0x7ffffd4b1fc82⤵PID:7504
-
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe /namespace:'\\root\virtualization\v2' path msvm_computersystem get caption2⤵PID:4756
-
-
C:\Windows\System32\wbem\wmic.exeC:\Windows\System32\wbem\wmic.exe /namespace:'\\root\virtualization\v2' path msvm_computersystem get caption2⤵PID:352
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2888.1564.14679095963740968641 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c002⤵PID:1144
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView /prefetch:4 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x1cc,0x7ffff2ad5fd8,0x7ffff2ad5fe4,0x7ffff2ad5ff03⤵PID:3428
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2008 --field-trial-handle=2012,i,16760511979816762814,14277252222215518912,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c003⤵PID:6192
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2096 --field-trial-handle=2012,i,16760511979816762814,14277252222215518912,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c003⤵PID:6404
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2372 --field-trial-handle=2012,i,16760511979816762814,14277252222215518912,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c003⤵PID:7020
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3456 --field-trial-handle=2012,i,16760511979816762814,14277252222215518912,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:4340
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3608 --field-trial-handle=2012,i,16760511979816762814,14277252222215518912,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:6692
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3768 --field-trial-handle=2012,i,16760511979816762814,14277252222215518912,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:3320
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView" --webview-exe-name=CamtasiaStudio.exe --webview-exe-version=26.2.0.19099+305077fe3a4f3e9fe148bcaa26631962f2ed4b2e --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3900 --field-trial-handle=2012,i,16760511979816762814,14277252222215518912,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:b154073187985de401242cf60ad31c09e7a00c00 /prefetch:13⤵PID:3856
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Query Registry
5System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5b276f.rbs
- Size 19KB
- SHA256 3a38dbfd22270f5ffade1c3abbf7f2feb5f48c046305495dfc3b933bd34cfcb4
- MD5 4583948b3eb0985b182a1724a315c2b5
- SHA1 94112cf63e3eec5efdbb3a58cf3c18ebf32ed37b
- SHA512 31cef8511569094b4faeaecdf68848d0caf55539b8d559cec8a608467249ec6e4c41bc15405d23ee1eab46a9a7c134f3c19c238df051d0abcab0a8d1e5fb9992
- SSDEEP 192:UvvRu1kRa15dXcFUADIc1f+W+y4+ogPxm/A7:qvRu6RaTeC81f/cmp7
- TLSH T12A92FC427680C9E2D8766B30CD631BA57B76DBD5A350438B50DC90308F93BCA2F9D69E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5b277b.rbs
- Size 19KB
- SHA256 197a45f3f82954689e20e4f692708b7aed1892e2ab72c1d65f0ab82384948447
- MD5 1a0d8370401d0354d0cd3554e8742532
- SHA1 5c208e5a0300368c6944cd2c3c1995d827a58531
- SHA512 e90e9ac86e584d34ee3d11a31e3daab27e56bad515cce4ff31e45df7483de106b97ddfab842114fcde30ef3360c08222914c03baf3f037c7d187d99f6814920a
- SSDEEP 384:pshpsucPI+wHORW6VrhiIRRJ64J6jLP2F:pshpsucPI+wHORW61MIhx+iF
- TLSH T1B5921E01BA44C5E3D4A62B30EE5B27243B35D7D9A721674B84DCC1308F877C5AF9E68A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5b2782.rbs
- Size 21KB
- SHA256 c98e254c2ebcbd02e8b8a4b76388984fb2d9481590e2dffcf183455d8291025c
- MD5 5f7fb0f91f30385a99e0a64a14e88d9e
- SHA1 e5482482f0f80c49e85fa873f0c807c13be38c67
- SHA512 8c333081ec658963a19145255284ecd89c8456d1447d70577cfac8001990aa05914f4b677a3c36cf8fe3957f61291d2e33eeeb7f948a376cd4e4ab95f6124dc8
- SSDEEP 384:LdR7GRrnAKxNAUhUC7xJjrMNYPzIbSfuGWdgKhmDsp/kP:LTyTAKhkmD
- TLSH T13EA20D03768099E3C86227B1DD671BA97B72D7D99350434B10ECD1388F633C72F5AA9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5b2791.rbs
- Size 21KB
- SHA256 704689c41bd614b8e052fb5d5b96db1b597dbffff0a95ad73a575cf5fe3683b9
- MD5 9eb15beaba1290566ecef8392763516b
- SHA1 2c84533f77f765b4b8b4b134cc5be9754c264478
- SHA512 08b57dc390350bda426884e9d4c2204eff76fa824bcc273c2d8f5bd2e30876dc076048f4151ad86def39b03a90cdd9355304269bd55079ed7658ed950085f3b2
- SSDEEP 384:LJOphE89gMipMzZjr4/mU7salckU72eC6RKK5saMgqJ74J7C60esUp:LJOphE89gMipMzZ3umUVKiagCO60/0
- TLSH T16FA2B902BA049593D8A72B70DD9B1B143BBAD3D99791534B04CDC0305E837DB2F9EA9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5b2795.rbs
- Size 3KB
- SHA256 2d11eb77c64d38a9b5f82cef9ffae6584027e4233b2679fc490708a217e5d8a9
- MD5 693e588a20434f597b901a263831bd96
- SHA1 ff7b8b596e0604b3cf2a7bb1de5e5c80a9f985fb
- SHA512 f3ffabeba073331f1cef47796d8a495e7206305ce3ce79eb815ec5634f8a8c66f1f783a7f96c218be939ff54769f52bdc0864f8390e7046be66156cb5cec857c
- TLSH T1E281AE03A9089693ECE76B70CD570B1037BBD2D9D791438B048C91705E47BDAAFEE686
- MD5 SHA1 SHA512 TLSH
- Path C:\Config.Msi\e5b2797.rbs
- Size 1.6MB
- SHA256 3cce1386c1d54de9f9ede4e96326b22cb4df1d82bbc911c841721cc7f10f5a9d
- MD5 e08b108f0138589bbb4ba1768b681734
- SHA1 d8878c7c7e80f1ffef61e219e3b4e71ef1e6127b
- SHA512 0998e0a8c4271da54315178dd3dbc81b7f3b88245b40a6f783da44c602ef9ebcb24c75c9bbf01818c72d830335f9565a5a531370d5712caa5db4ef2050aa5be7
- SSDEEP 24576:dkfX3RibKkbr8ZztPdSjGRNyjLt5iuoYkOB:chm5brgKANyjLtOY5B
- TLSH T1F4752A10B951C4E4EC62477482D27A36EF65B958A7E091AF4388432EDF2EFD01E7EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TechSmith\Camtasia\CamtasiaMediaResource\ToolPreviews\DynamicCaptions\DynamicCaptionPreviewBaseProject_pt-BR.tscproj
- Size 29KB
- SHA256 00d4d0d08f82d011676f5bfd5a1506b45f6dfaa07c8fafadbb1764099a9a0d12
- MD5 3a4d665e3c8d16f3c63a4fbb29fbb06c
- SHA1 51ff66a08e5824d92f14852679bbde58a76b1f2c
- SHA512 e09846a415c6dd8f70fd9bf3861dc13ad788cf99ebdfbf90cd5d2e1f666e50663b5895bfae25ff6019c5853c3ede5909c86d40de41c96e40d4db469247c9f101
- SSDEEP 192:gZcEdIBideCDzHp9kP6Hvj6mg91n+6OhK6k9YYYYcAtOLwURVD:gZcEHdeovfgH+k+oswUL
- TLSH T130D25525E0144C3790B3833D2BA15D4AE2B75F2BA5871D48B6CD4A9C7F3E824D487FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\HTML\SmartPlayer\scorm04_3rd\imsss_v1p0delivery.xsd
- Size 4KB
- SHA256 1decbd57c376729b009e77bf99847d305b796e983df24d391c691c85fd958f51
- MD5 3d35e0e15b9ad48ad2e4fcd5ebf58e4a
- SHA1 bade429e1a9f9d887d024b506f70d48a23bb9523
- SHA512 0f8341dba0b1629638aa311da02953b6058cf9538f2a0dfb09ab03c5113fe32c76220bfd0bb0deecfd50f19a93b73bba9ee987a68f28272077d1acff0d933e2c
- SSDEEP 96:MU7UnMKJVo0Z6TK6Dh6DKZd52GTtLSXbA9:J7HKJVrg1D8yd5h0c9
- TLSH T1DFA1A6EF778497621BC3015A7B76A585762AD03C7B173121D45C907C239AF7CD3B218A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\HTML\SmartPlayer\scorm04_4th\Template.html
- Size 677B
- SHA256 efe1ce928484cdbef3d2d0011a30ec18ca5e6d1e4fa6dd4005056d3ff94b0b9a
- MD5 86e380b12319cf55692a5d067dad8af2
- SHA1 66c8fb57e09c7d746ec8fb5cd2b13e6df46af23f
- SHA512 d2328fdabb20b17b627874b6f6950db4db63ee2190cce509e1fe6f4a285ec9e51bd9b20b50fa32403825fd9a83da0dc5eba5829ad139101a5172cef703bdc0b6
- TLSH T1830123A79E172D0EA35116BDE2C02093A4925401B21069E0F0E4743B6A8DF0CC9D720F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\HTML\SmartPlayer\scorm04_4th\embed.css
- Size 790B
- SHA256 b88283422cf4f2547b4eb7ac5f485ca2983b752cdc13bf28cbe71217470e99d3
- MD5 13e2cbc2a2b32b085245f4c9884bd993
- SHA1 f3fbd6354ef6b01e6f4d28f0a34b6cd5d2f9aaa1
- SHA512 7c70a7dd65f8b84dc56c950d982bdc4300ed0e5ee7a107417cca397af1ff3f26befe430cc743cbb153b7cdd221e5e69c3750182a587d859fe2d6d863dedb5932
- TLSH T10D016DE64B12104C9237C7EE9B94046CB769401553170AEAFAF5306BB1EAB8C34229E5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\HTML\SmartPlayer\scorm04_4th\scripts\embedded-smart-player.min.js
- Size 2KB
- SHA256 e162e932023582744df842a0f1245bd72bcb0e8d788ef6528d4ca75ae511de87
- MD5 0e6a636631d3599eab0897590b0cb2fc
- SHA1 e33523329b21305180b375ade0ddc45e75b5b241
- SHA512 864ace6769a9af3ce1b12ed1ab5e015e454da9f87e99f0935bf78203b5ca8a3769675d621caf2b2ff8959a67c59d1a064afa7897c88396356a4d4bc26518d17b
- TLSH T15E41944E36D92E7126F35AEFA11F210931335816740DAAA1B064E4FE9F7D1CD1233B69
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\HTML\SmartPlayer\scorm04_4th\scripts\techsmith-smart-player.min.js
- Size 572KB
- SHA256 65400b899a041aa879bf6fe4b929e10c765aff4b0f9a93354b10d76e55b59043
- MD5 acdc60c750cd936b2f136ecfcfaae755
- SHA1 65593574d12f0f7949e8208e6007be45aff1e08c
- SHA512 3f09869adb6c8e6fc73f86b6fae8d063d38f446eacd2a1a43dccf04e71fbf5bd890a8f460fe8b3f8fe0131dafcaf299c8e97769f047faf097ee94de4ba57e8d8
- SSDEEP 6144:iajvTai0mNpzn9Htg7bfbDcEee5GFye8633vOaRi9Sv1h7hth/jWnMd2r1TlhRz/:Zv4fbee5cye86PZL7hr6x5N
- TLSH T1E1C44B89B2C2767142937078513F210BB33A2E9A640D8214FA2BD5C97DBD68DD237F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\HTML\SmartPlayer\scorm04_4th\skins\Remix\techsmith-smart-player.min.css
- Size 107KB
- SHA256 69b0e8a62d53797661a9f7e6fee2c2de0900a2cc88bb2cf1c8764f6ae88c8db5
- MD5 c8269cda59325763e8b0607cd05ea170
- SHA1 3b1371de8a992aa52ef87922a6219edd02b94668
- SHA512 f47fbd0c383a6a8af0db6053a8c00ef346f3cf2cbdc372846a27e658b0ff6d81ba9338911b8fbb9cf25a61e1cddd7f6a7e45cda9d2953550b8c063db23072b0c
- SSDEEP 1536:WD6zUx/R9oZ2kcAnFZmpCbVeTwKVeTs/Z+p1fkIFjpuaLOLEz8TKqjhuqVeTlVe/:8OZ/kZkQknkb
- TLSH T1C6B395718F59046C609F86A5A56295CC733EDC59F1A5035BFEAEF339838F243E213A48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\HTML\SmartPlayer\scorm12\Template_Player.html
- Size 6KB
- SHA256 dca29a16675a68427f9d8fd2d5b1b9979972ccc3d62a7f1e35bf7343e10c4e95
- MD5 ddb80a2efddc3c0093f33a1d53c1e112
- SHA1 c1fd312e63064373fe3d0d8bbe961e1c2b7e5fc5
- SHA512 76d0ffb6c8a0d2949e55b3a9d755bb5f651f4997b21f4eca978153c391c7dba2034d2eb0fbd40ad320d3ab8b6aafe96b313f553cacebca735ef1791a5259d4c3
- SSDEEP 96:PUx+IvdZb2rz68S7ga2f/BhRILbcRTn8S79Uigt7hEn7iZLwxzhw10eUGsEqgm+g:c0Ifn+/fRILbcxNRULVCyLwxzhwQEqDp
- TLSH T1A7E14AB14C0A6D6A13D25A92A7D6B800CD3D33135A04D3D8F07DE10E5FAEA158E6BC44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\CommonImages\WhiteOutline\plusWhite.png
- Size 6KB
- SHA256 c1ff7a05e9e939a5c67ac657add0755ca27aa679f8ccd3125d624278d6089795
- MD5 3f868e381f5c2dce7c95095fa6e2309f
- SHA1 60a2e41c65240d4c821657af7c1d474037ea7d87
- SHA512 4f532d3ed85f3f904f7c371de3f5f96ae444e0dca352af163d8a15d0c0003f213f5e1b01255e74898770ad0fd1ec93fb7a0736d76c33ff2401adc4caa33c8767
- SSDEEP 96:9SDZ/I09Da01l+gmkyTt6Hk8nT1wuqgUECVm4OzzD8r3Mzzj:9SDS0tKg9E05T+uqg3Ym4OzzD8ozzj
- TLSH T127D165C7A4A5109731BD3FA343C1ABA64B0D2F9E6BF5E7700A0111DF4211A942AD7CD6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\ja-JP\Images\Keystroke_Clear.png
- Size 3KB
- SHA256 f8e9d39e992d2c8bd374c0f29bd5e6a289786cff4beef684316f507294c31f32
- MD5 2c2d6f62a585bc59377d8b9bd50f57f7
- SHA1 b55bbba3a0156075bada2cc2371a37cdb8634c7d
- SHA512 82abd865e488ec5177cc1850715cdc85a185924e14f41310c1f33e7a3f60b0ad2e5f3258adb96c7273e70922f0176600920a3722995853b70ecac9ff94ad5788
- TLSH T115617FDFA170A04F75DD39910DDD5305D754126C9D6F353C64D21AEE2834D8B3B560B2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\ja-JP\Images\Keystroke_Clear32.png
- Size 3KB
- SHA256 ba797dfc7606a00de578165d0c11f60378e6be7e7a2deb689d81cab7f3734ce7
- MD5 5111a3d856dfc134b29302d278d536d3
- SHA1 5b3499b678d6d4078c181d06991b6c3d9f5427e6
- SHA512 f8f696d7bb207488926685b78230bb342f5b87f19e5beebc1ebb27c707809d37e17733a979f6fe321f7ad1bc21654fa7cf090a8f31de750002ffd2ec597e7065
- TLSH T114616CEF8A60A08F64DD35110DED4242E77A22AC8A9A3B3CB0C158DE00B0D572B6107A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\ja-JP\Images\Keystroke_Gray.png
- Size 3KB
- SHA256 781a24a0445d2c14bce23b1555c617d777cc549a221c04e3d7865dc940de9437
- MD5 ae1ff85ecd222ec129526a8869157bbd
- SHA1 55a83a0f8a433e3860c951d415182a089e587c81
- SHA512 8a2c878a18bf0100edeed787910ce4812d9dc681a8a77b5c95abddcc575906ca3595c1bbf425ffe8453fe48b9002ee01c4523918b6c433d2603b9ed5cea1e80d
- TLSH T19E716CEF6F60656ED8AC79111DCD0207D7B423BC8A473728E4866EDF2461E53BB4A4B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\ja-JP\Images\Keystroke_Gray32.png
- Size 3KB
- SHA256 c17b26cb1dce4b1755f15ac80a4c1dd92d7d00702ccc3726882f4227e2bfb2da
- MD5 070f3ae2745f1d0f28b11f20f4241c04
- SHA1 4b244bff9bf4dc966a873abf588f596369ab95fe
- SHA512 eab627503a7a845f63308f9cb590896b852f47f37eb751f8b3f809a4457ee5cdf20908f60ab0f4c607bb94012c562fef1d0dbb9ff42977db83dda9af0bb9ac13
- TLSH T1D5716D7FC97050DF7CC830111DDE8295A756236CC6E33268D0D055CD58A6E677B79071
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\ja-JP\Images\Keystroke_Traditional.png
- Size 3KB
- SHA256 7e82b24f0c0e7fbba47f3cbca6e4d509048967fa92b4d257096a7688d36fe44b
- MD5 d6444cf6eddbf645bf51f25bd5e47f36
- SHA1 5b51adefebb4a1a3e953a50dc94fe548406b203e
- SHA512 7bdecf5d0775f9a91253bfabeab0670a6f2b31e30f33264bc349a54b0c98822cbe45131bd9dc456c8168a69560208785979297cf95a636b06b9f63386f11b92b
- TLSH T1AF719D8F8A64909F2EDD7402088C15C7C768327C6EAF2AA488C295DE40C7D1B2BC64B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\ja-JP\Images\Keystroke_Traditional32.png
- Size 3KB
- SHA256 608e47d001901229e59ad5dd2c684f39ace965918dcd7729e693ec37c1b25666
- MD5 682028a3c70d636ea8875155e0a8a16b
- SHA1 8570de2162e5d88107cf1df882cef1e61131b2d9
- SHA512 19c3a1229a039e0dfe2234b1a53ea7f5816b0be6a72fd5a7042c866b0104a5db418c2d52f665513129da3678bcd6182434d6db2477cf63544f848bf60286b623
- TLSH T1C5718EAF8030B08F6CDD76510DDD8205976B227CD6A73A3854CEB8DD88B0D075B6607A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\ja-JP\Images\Keystroke_White_outline.png
- Size 3KB
- SHA256 55d999ecd380557fb0b9294518251360c324cb82c2c0f2d46d1f01e8472b83e1
- MD5 a60346e86fb4ee31600d20423dbddc03
- SHA1 a7749f434a3177ffed47fd86594fcb878394b677
- SHA512 e89a4d664e615bb631714c679f0f139451c03aa7cf5ce379efaf73fe89deffdf0937233381bd6391ade274bd39a5cae84d4498c6d9e018dd21e9bd153c53bea3
- TLSH T16D616B5FC97090DFB88D39222FCE0284C3B920AC4A0B373C94E149DE9094D0BAB650BE
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\ja-JP\Images\Keystroke_White_outline32.png
- Size 3KB
- SHA256 781156fa6e1cebce3286b09328060abf1e12f0dbf3ec75738357a3af6ba24159
- MD5 d27c81ee6a3b2f0ce884963e08d5d64f
- SHA1 7d016311db8abe8c24f77088dd2a8f7657eb1d3b
- SHA512 3437a27578ccbdf95759ae838a7220bf75a518e52b3492bd715e1381dbb1acbbf6e907f0dda44f26de15c41bed72291933fe9c2433525a77255f098db71d0b09
- TLSH T1D4616ABB4DB0F5DEA989B8020DDC4200DB69367CD4AB362896D27AFE1092C0B2F55075
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\pt-BR\Information\Clear\KeystrokeData.json
- Size 11KB
- SHA256 bc783394d36adce6923477872a1aeb70751130a6878f1ac5bef0c9d849a3f44f
- MD5 fc9e803c6a0663825c1e329c8858cf05
- SHA1 40473681acb7647c2c5cdc7d4baef1436196686c
- SHA512 b57b70761b46ed3c41f37dfe94e884cdcc79ee2221d1c4ca1ea5f2f8225894957e22310ea8189c04d72a9bd0f496e4bb40f604dcfa338ac25b4b50d800aee8b8
- SSDEEP 96:aabapxwJPJ0JZfJgJ3JZvUhQzeJ/Qeda6S9bk3tbe7lU:aqapxwJPJ0JZfJgJ3JZ6/Qeda6ShkhkO
- TLSH T164426D2AD1B06C7B58BD2772BD6D1A56F28513BF40854A1F7B3D061C4FBA057028EE2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\pt-BR\Information\GrayKeys\KeystrokeData.json
- Size 11KB
- SHA256 32dc3c928778b879a907bf7c84feb8f4965b50feaeb9be91228c94fc6b0f03ce
- MD5 b1407fd90b1070d923c607d845543f74
- SHA1 cb713baa4d9f278e46eac7924b24699478ee9aaa
- SHA512 b1a1fcd9eb2df0463b68ba18e8de68efde7359a6b95b03b125619b26cc10ba53b8c4a50104c923aa8712f4f4975ebcf14db932d64d74019b80ea23249d89fc61
- SSDEEP 192:OnsbapxwJ0JAJ4JoJ4JT6H5Qeda6Shkhj:Ose6H5Fda6Shkhj
- TLSH T1FB427F2AD1B06C3B58BD2762BD6D1A56F28513BF40854A1F7B3D061C4FBA157028EE2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\pt-BR\Information\Keystrokes.json
- Size 472B
- SHA256 294879afbd31bcff0dca791addfc10170a9098399dd7d807e8a2221393f78524
- MD5 cd5e749e4b3cd2385e132d6fb1c79e28
- SHA1 66b9be8030e9dfc4237d2d54e2082ff106c5f07c
- SHA512 76ba7161afe14fb20c99749210fd222c97ac3611392216abf9bf9e10e2639d2c0299e94bce9db67c614e86265b71a8d8a451dba29112a009796afa84bf781771
- TLSH T18BF01A37C941EE1B4679A3786AAA4543F4A5833F21C41A02BDBD0C19BF332522365E8A
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\pt-BR\Information\Traditional\KeystrokeData.json
- Size 11KB
- SHA256 fe49a65c2a68eee5a8d69dcb61a801d74b922792d72467289b623a4dcd2b75d4
- MD5 6ad151e8b9fd6b62faa39cb454eb277c
- SHA1 9788207a9de5c7a8f419f8ea93700c100e4b63d2
- SHA512 f2880f9dc348d58a248fd4cf7e913c4c9a47d70693f1c9ed45f39ecd8abda92964d9635e28dd271b09463a956cf235b63eb8872859495fb5635233da50124373
- SSDEEP 96:6WapxwJ0JAJ4JoJ4J3vUhQzeJH5Qeda6S9bk3tbe/U:3apxwJ0JAJ4JoJ4JT6H5Qeda6Shkhj
- TLSH T17442702AD1B06C3B58BE2761BD6D1A56F28513BF40814A0F7B3D065C4FBB057028EE2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TechSmith\Camtasia\Media\Studio\Keystrokes\pt-BR\Information\WhiteOutline\KeystrokeData.json
- Size 11KB
- SHA256 b954712005a5b861da457d2b44cecf6826d732e60bf4b75593bb83dad8106af0
- MD5 343cddabec42347ffc84f60307868438
- SHA1 eaca166eb72dcfe4ae8fff88027a06cac5f5527d
- SHA512 4c5d4ceee107c61e80165720fe435b605dfa7b36ee87b5a6bbffe18df44083dad8202dbafab883e17eb1d8e96ca7836e0ce1597d2e5516268fd93aadc76c6b51
- SSDEEP 96:CagxpJpzJ0JZfJgJ3JZvUhQzeJ/Qeda6S9bk3tbe/U:CagxpJJJ0JZfJgJ3JZ6/Qeda6Shkhj
- TLSH T10C426E2AD1B06C7B58B92772BD6D1A56F28513BF40854A0F7B3D065C4FBB057028EE2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TechSmith\Camtasia\Microsoft.Web.WebView2.Core.dll
- Size 589KB
- SHA256 88a3b62f45225a811cdb85df6dfd95c2bff9a0e43e3b04f813b125eaca56cc9f
- MD5 a53ba26a25f78f512cb2f393f9c96463
- SHA1 4176d5607859817a0b44a253c34f7edb3a46f21e
- SHA512 df1cd812fce4a46cae7f4d59256a12732367d16981b01f1067d58966d6612ae102eaa274fc3c9ac21aeb0422cf09ac1232fbe2b74d1daf6c76489f6e8de16751
- SSDEEP 12288:WrCyR/rpQ322fy+uFKcDmuRFNEMzeu+imQ269pRFZNIEJdIEY0lxEIPrEIgcvLc6:Va7
- TLSH T1C4D4502223FD865AF5F27BB5A57803308BFAFC96B979E35D05A8151C0D72B4099A0733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechSmith\Camtasia.lnk
- Size 2KB
- SHA256 632f0a66a24872c455b015170972581b4dbd9fac886b38d0eeaa1747bb02f37a
- MD5 7552119542de23706676dc7f1e54e642
- SHA1 4a975138a35797a7201c85fc459949afeae6a645
- SHA512 98869e55649f51eb8cb7a27ba8c102f5f4db01ef89ce6c93fef95683ca70f3ecc692c83f136268fb22c34bbca682bad88d67e87f8cc1eb062e1279b7c7edcecd
- TLSH T1E85192545DFC0654E2B38FF1A26563201771FC36AD428F6F514882484A2A451E8B6F2F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechSmith\~amtasia.tmp
- Size 2KB
- SHA256 c6514ac3428415bfad0e4a87a21990592b8b38e17fe8c3715c325004962a98b8
- MD5 49151c1afe950d9ca9941e001778d04d
- SHA1 b3b8f7cce8718c4baa8fda6be0491132e017e3b4
- SHA512 01ab6bc82993fbcb76f84c09aaefc550a1d12ce1023877ba452b9ce914972ea82e50d4353630b3b7751db681e85aee441c497aa36e69d50973d6b2122750b987
- TLSH T16151B1149DFC0654E2B38EF2A265A32017B1FC76BD418F6E514882480A3A051D8B6F2F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechSmith\~amtasia.tmp
- Size 2KB
- SHA256 f58fe9ea17554e614e81e0bab7326cfcf5322b83f9166e77df87a4aafb5f043c
- MD5 aebf71a33b42e3b7a41b968bafdb686f
- SHA1 0b0957913285b9822b49661947a44c93f516b1cb
- SHA512 75e78ff3a09b2207245c9711239b0eef714cbee63c32dc891f8369855a5deb13b9610eab27f6ba5b92258349c0616102a7ef2d6e4e6c23e83ee7e20a1c4ef86f
- TLSH T1C35191145DFC0654E2F38EF2A265A32017B1FC76BD418F6E514882480A3A051D9B6F2F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\state.rsm
- Size 1KB
- SHA256 fc376306b3140e5c2a2732a704d2e7f4cdbd747d670fd96e29bed9d4d6d505dc
- MD5 9448279f572ea6506e6c85c2b918ff5e
- SHA1 b2a39fcd6d2d1b3c4ea9054dd77985a4f47fead0
- SHA512 a5115e2a1e64ab404d3f64f0d4777da02d3b91cd929a0c38ba750d1e8c81f415d41ccd143d5aad997b07237484562b983a97434a6634c028cfc231f1f98b4758
- TLSH T1A621BE264FF5052AF373E5F46BF506267966F4336521C42E004323478F32AC1995776E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\state.rsm
- Size 1KB
- SHA256 e34a5dcc55ee29254dca0795895611e0c0a36bb252a8ce31e0544e5e5af01416
- MD5 d36eefc41e5e07956b1867fcc395b780
- SHA1 adb034fb3fc66b7cbea7c9789da08212a4eea08b
- SHA512 09523486cdf3376dabcfda293d499a42d30395bc705c8047afcb4168276919a29702e0e82f6fcb090b55cef92c7c967db762b8cb484b8c2965812bf5f0e5ffd1
- TLSH T11021BE264FF5052AF373E5F46BF506267966F4336521C42E004323478F32AC1995776E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Package Cache\{931A2CF0-2404-45EA-82F5-345735AE6A90}v14.51.36247\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi
- Size 208KB
- SHA256 bab5d0257e6a18a4a008e683442e3077b38172dd61af3cb1c588b46724a714e2
- MD5 929579267bee38006631f56eff1d4366
- SHA1 1bda1592ce7edca6c30421c2c8a00ba3ddf448d8
- SHA512 ea52b41f16c06a53e1b9f8d2d4268b2dfaf89968bfd97e033f13bd26ee44bfb3e6b377c873900224ab6e4e3b0b7dcb5037ae0f46c77d3afd6266b4f1dffac44d
- SSDEEP 3072:K9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTE:0laZeKFxCnBheIdlu
- TLSH T1F324AF12B5808033DAFE1A350578DB615F3DBE608E544A9B6364B6AC1E717C0CF36AB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{A70C4630-EA5A-4956-B048-7EC8FF8670E9}\state.rsm
- Size 1KB
- SHA256 c3b43953094e9ffbf5bebe16dd55ce78ef3d23f9871a2dcb56c335cde9f28180
- MD5 7d94c1dce9879e2e206fd5996fc7458a
- SHA1 8ecdf8e2a6b77715abf9810444aed4cb1f3ce402
- SHA512 12e2cf793224c7c47b497c876a3da1cc568471df268d4b4dc9c7e87fefe2aa27de6d312579bbf71828e0e0d7364225c898f2f1ab2e08a99bea651d06bd2bb773
- TLSH T1CC217151ABFA1458F3F3BF746AB64624567EF8222D21D12F0001614A4F32A94CE61722
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
- Size 4B
- SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
- MD5 f49655f856acb8884cc0ace29216f511
- SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
- SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\D3DSCache\c59bf8fd2ebb78c6\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
- Size 64KB
- SHA256 40cee42ff50173585abb23170c4d098c083cd21588143cd85d9e12b05551ea16
- MD5 df9923edc1764b663766c170e967aaed
- SHA1 802c0e6192de6f76dd3590720c87ae4167bc62e8
- SHA512 8027de2affe6b6bf539b1d2e48c79e8753b060668d90d0510e16979a647c22fdd0a6c78099a6a65a37ef23ff304d879d11c21ec1ef8f39530e69c5bcbbd80769
- SSDEEP 3:uPgqO/n/lGlll/l/lXp9ZjrPBY0HlGlxeIdP:uu//0dPBY0Kt
- TLSH T1A653124091C20127C442033009CB06483A7962050343085342504130C4EE71004611C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\D3DSCache\c59bf8fd2ebb78c6\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
- Size 1008B
- SHA256 13e0f78dc7a6d04a6ed7fba9aa7294b6c0315ac9c46b5bbdcdfbc2f0885dc253
- MD5 bfb0f8346f1b36e74b059a1a5cdd5c1b
- SHA1 b2239121d18e91017d7e4aff7ea5496884a5cb48
- SHA512 c7822a6e00308d60b4e764dd07381b9d513bbc8391c56e71720233532ac9c4c91ce4de46e7333828ecac601e086ffa46668cfed4a10c5a86f378e290cbd7e260
- TLSH T1D41112506BDB1DB0F3F77C70413582302123F5425CB1D21A80C8C41A4F32409C135BD2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\200b8d66-0365-4c1b-a168-63cb296c3286.tmp
- Size 144KB
- SHA256 78397e59bbd574f0b873d7778f30c565665ecb9a7a97bd02a2932a0d9996a7b8
- MD5 7eb68156c4998d21bacd489274b63912
- SHA1 2b955e1d006d134e9c48afafeb682e93c2568708
- SHA512 dcb698d742e27ae257ed77a6954ea872e11cd061b9d04be54196c207ede7ae198cd540cdfc8eae8e38790dcfd0d4e23c1213f34ccfa83c3e2cf442d5a1ffa85d
- SSDEEP 3072:v0WRpY1K5Z0vU+NyLwIoubTzL2MijHd/Yy7:v0hsZe8wIFbPcLd/YI
- TLSH T105E302E3E8DEED733F1BE3384C26321EDEB0FF0BC960A599E6955945014A4142AA7E05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\348cc54f-c866-435a-b600-1855348a8bbf.tmp
- Size 4KB
- SHA256 9f8ad32e3ed152c5df9695a9e6defcceb5a2e3918cc7e6cf5afcedec6cd3a3d0
- MD5 ef5874e50c429ef5e50d2dedd3caa971
- SHA1 78be3099c4edf584cb28bf12b3008929bd9546ce
- SHA512 aee5743629218acedf30815f5ab21c67b675b9fa6a05c1025516bc59f52c51ed3967e9234ebe4728cacad055c4bd4ce68a3b61f394619431b37702870cb3d4a5
- SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok5/ciD/vB6m8dGyvELkzAa7rbuj1v4a:kC0pB+fTbnvDUDfx4w/gAorbu1
- TLSH T18FA12B70A8BC88B755B5C584B5563E43CFB462EBA8209E80D9DE1F0D11A71F82381A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6603053c-2fce-458c-8a9a-2b0ab6ff16cb.tmp
- Size 143KB
- SHA256 1416a3a22e1462732162cc78414e2d558b73c222f668c7a47d8f56156a665c7d
- MD5 21592c1a04e2fe9fc51176a8f9f78405
- SHA1 f57515dcb13c2cdf5e188222989947d02abd6e72
- SHA512 74085f271c353f8b48ca2139e3eba5d5bb6b21a3f7aba3cd8070c5c063b160be5dd8a13592962d28290ff3abb7218319100807c9575f56215be607e9e017b1ba
- SSDEEP 3072:tWRpY1K5Z0vU+NyLwIoubTzL2MijHd/Yy7:thsZe8wIFbPcLd/YI
- TLSH T174E302D3E4DEEDB33F0BE3345C6A331EDF70EE0B89A0A5A6D6E28945015641026E6F05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8330ca71-81f6-4a02-b454-a1b9e8ce58b1.tmp
- Size 144KB
- SHA256 e3a59eb5d36b220dc08f70861bdd34d73198f3170b6e8de0698698fb3e53d05f
- MD5 e245b2bde696598f51e923e39818f974
- SHA1 47f77e9caf27c6ca3db9ddd5e7080d1dff7faf97
- SHA512 61eefd0a5dea231a9c9a55470d14e67e1f5a08eb0e62232529963bfef573f172ed289a5c0e20ea217b5688d9233e087dc834db0d3711cc880048dab7f1ac8d66
- SSDEEP 3072:f0WRpY1K5Z0vU+NyLwIoubTzL2MijHd/Yy7:f0hsZe8wIFbPcLd/YI
- TLSH T159E302E3E8DEED733F1BE3384C26321EDEB0FF0BC960A559E6A55945014A4142AA7E05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\86f62aa9-e56d-444d-9f04-3916381b3d24.tmp
- Size 143KB
- SHA256 b77de6c2f71ffb3094743b7a3a4c6af508567c4bcc4997492703cc1e01c52007
- MD5 7f7b974b2cfb2bd564219413de733ee7
- SHA1 589e69d5be0834dc17d7d287270169d1201c7bfd
- SHA512 2ca26a61824e3369a980ac97a9ba20207bb01206792aee1f2932f0e39a44b68c3a75fb825c47103dbd13886e1e62f59099db0038b3b36173ca8dbfcf33682a54
- SSDEEP 3072:mWRpY1K5Z0vU+NyLwIoubTzL2MijHd/Yy7:mhsZe8wIFbPcLd/YI
- TLSH T120E302D3E4DEEDB33F0BE3345C6A331EDF70EE0B89A0A5A6D6E28945015645026E6F05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\904329c7-3bd1-4c76-9473-cea370bc7067.tmp
- Size 144KB
- SHA256 ae3055ef6391fe5704281c3298a453f463c016f55b10a0981b5178cd04203e14
- MD5 2f91d63caaf0ea66c76acc0c0f48b3db
- SHA1 11637d6cfb96cfbfeea2f741b5892c8e4beb2037
- SHA512 1f191b67dcb803b387c071c33905eefe89a4d4cee0faddbe778dde8fb24c73e1671c3bfd84fda5c4aba380978bc5e752ef76afceca9518c7f431f0b2416769ed
- SSDEEP 3072:YDWRpY1K5Z0vU+NyLwIoubTzL2MijHd/Yy7:YDhsZe8wIFbPcLd/YI
- TLSH T1CEE302E3E8DEED733F1BE3384C26321EDFB0FF0BC960A559E6955985004A4142AA7E05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
- Size 40B
- SHA256 d8b9f6b3b9a215f0ce7a911dc243e42c4a408cef8396b955f5429a76fbc6a1ab
- MD5 b9ca8d0e2252dc7edd00350f18a54b48
- SHA1 532114cd0c61852ec9b6946cdb7b6cb49a5fa51f
- SHA512 f2bf4cbf48b84bf7b23b79579da73e608c64124d99491db65b32efdb7265f9db9f57154bb29add3e56792cba361cb9b2f7740d0edbb426fe923112f715240c57
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\068b1e6f-9c97-43fd-b18e-6b97a121afba.tmp
- Size 13KB
- SHA256 19a32c07ffdd4bd88c9cda23335d447802dc4132f70042d1df317450027fd45e
- MD5 4dcf5621fa308e83deb811699d9ae67e
- SHA1 f0688a70dee6921348f683871ca8c11e7c6383d1
- SHA512 9a65425970e6d1adaf67e8c80e398852ea250bb6ee17416faf4306629df7462c7ac1fe9737708cd45104aec246401cf8ba326113ff02e2273bcd7fc1dbf90a15
- SSDEEP 192:/RycBPaXcfhv7H1zPRpvYLuQ9OHsb+WNHErYELF+1S2gm12+faXNHVyIsnAUgE:/RymPaXuxbFXKkwvgR2D2maTE
- TLSH T18252E82AAD647A3B9CDBC319F921B75BE2F5102560E42E84F6FD883D24E76CC2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5081d22f-64f6-4eec-907a-fb43fea167ff.tmp
- Size 11KB
- SHA256 474af81790f1ba24b5afce0f971f1c8a6c58e029e3bf1f1664143a8657f97e30
- MD5 0e7f0cb5bedb5abfa2b86e45384353a1
- SHA1 34739310fc4cbd746849c57ff9b4d2ced05773fb
- SHA512 a9aad922b04ac85101d3dff32ff14c52f743b9ef0dec9b750b7381a80c5ca3e2804d8bd0da120aa4faffdbca3c04f1b73dc7c71e0579324de05b7e46043748fa
- SSDEEP 192:/RiaXcfYv7H1APRp2b9OHsb+WNnrYn612+faXNQVyIsnAUge:/RiaXuEbAXokwsn62maae
- TLSH T13C42A72DAE54B93F9CDBC319EA21B757D6F5102520A42E84EAFD893C24E75CC2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
- Size 22KB
- SHA256 063db433e1a9b5f2cb2349ad748778e1c9e8cb4958413b805963127fd7ddb071
- MD5 0c5e0c6ab08a8875e5543a863be6016b
- SHA1 6b96e05b48ee0ba863daa45b7525e8c7f0d5d8b5
- SHA512 408d513f9c6759a200bee2cc12dceb9a395bf78feb539a582b11ee704b612d4636b072d74b1cd4178cb417bbe65fbe32757facc92561e6b5ed4f1dcbe82d9540
- SSDEEP 384:TlQq/rmmOWjJr1VRPvxuOUjYfx4Zpo/c4h7gvzQIJa9sBKy2:TTaBYPVeOCSIpGc4h7w2sEn
- TLSH T125A2E1CF490324E16212F29B368A57C9259296B6F72447D6ADE524019A8F3ECCF1F06D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d
- Size 23KB
- SHA256 b73f6e1f9c2b97abb6100e7b09619c209fba23c547b77b80292af072f5092c98
- MD5 55482e6240efdbfc6500df4a3a922389
- SHA1 8db27df8e26b890b9a550f358b7af2de225c434f
- SHA512 ddc63e365fb389c54022d4726ef5446e61ba5c3d6aa6f3e7df036dd4552dec8ffefd823fd1398c64dd5525840aad4740dfab12e8f0534f3526fd811d7429a0b7
- SSDEEP 384:oTAevjTIoFNk2uzd/bJBi/W4BSEAQG5jBT6AFOBTWKO21VuoqLR:gAeLTjF8ZTJB6PB4QCu7Tpv1m
- TLSH T156B2F1E2194E13EBFB612D6D5335DE30C8779D19134DC5C399AE42B21A927B21CB849C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000032
- Size 16KB
- SHA256 cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc
- MD5 9c6b5ce6b3452e98573e6409c34dd73c
- SHA1 de607fadef62e36945a409a838eb8fc36d819b42
- SHA512 4cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7
- SSDEEP 384:XQrDFyKFRXQQ5pGG913BahobGGOal+0HuXpAWBY:grxyUKQ53pdbGg47PY
- TLSH T11D72D0D62F2702F608F294202ECD392C679D7A25F77E6625F0659C860D58EB0D8F4F52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034
- Size 97KB
- SHA256 6e9619cbffb6bed8cd7172c3bfb896f170dd8aac932a3f1ff11bc035b9d53e6e
- MD5 7d4f7c31059a29d5ca4bcc8c3090edce
- SHA1 1ad0961998e6fd8a57ef2ef6ce4bdee9fbd555f5
- SHA512 c283558d93643e09adf26081eee657f56f1699ae7f25a26c25ac19bd6372744b983751ef58cb88f632c1b67394643fa2ef8e6f8d61bfa39887ccbd8ae2f951a2
- SSDEEP 1536:c1Ah0NShqi8NjZ+0sw9S54zgbiEvgZXRkSr/TSg:cvN19v+ZwY5liEyS6TSg
- TLSH T1C7A312EE8B71C246E90D57294D20724EBE7A834417C8AD26FBE1F713C6C4091CABD746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 2KB
- SHA256 678a77ac0c7e0704a2002679af38d45da1e8b03ab2d408b6ffd2caa1162794f9
- MD5 758e8f8f49aecb3f21de8a95363b74b6
- SHA1 957f43f14f969fb35a3e33f20011376adde2d3e0
- SHA512 48b828117e75895e06570432d700d1eeda6170c5ac9d1846895698aa356d40c6949bf20c5565eacfa36cbb02b135aa46fc1aa45493db89b88ea3a9f36cbcc759
- TLSH T18A41DD0115E0C576DF5F0B799AD59E3132A4879BC2020F8ED2E054B5BFC33E49A9838A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 1KB
- SHA256 995ee6eec5e894c41152b6ad62db287fd3639effca0b1b56139d26c2d886f6b8
- MD5 0dc4187c662b6ee8b53bd14af9fad3dd
- SHA1 e71b8d6d6071c0d14dec731da095a08474723993
- SHA512 8ed323224c4bd655df13b620b1be6511a389067d9206c1eaf79a4b9ef86ba0c18a8aef20025ccbd73bab6675e76fda12b2077a21a0793392a412d55f3110db2c
- TLSH T1BC31885145F45577CF190A3EEAE58E71326483DBC2021F8AD290087ABCD37E5928578E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
- Size 593B
- SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
- MD5 91f5bc87fd478a007ec68c4e8adf11ac
- SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
- SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
- TLSH T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
- Size 531KB
- SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
- MD5 6eebed29e6a6301e92a9b8b347807f5f
- SHA1 65dfb69b650560551110b33dcba50b25e5b876de
- SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
- SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
- TLSH T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\360895ea-0f58-40d3-abb9-2cf93a670ff8.tmp
- Size 41KB
- SHA256 2effdfabedfd70c3e8a8136598f2ae0084fe49495423e2cd2a8f2c51bf1a26db
- MD5 bd7958aa914d622f9f7768e489295bf8
- SHA1 d8faa24bfc93e4275d4170063729bd3c83740b50
- SHA512 8fe0e94f611cce80074b58562cef8416fd153e2bc08da26d80860d0cde95542772e8f79d075fc9afae4d756d5906ac459b2ae0533a3dd138a71005f9eee8cd82
- SSDEEP 768:XTP63bcN/LUk4pBYEKJq+4vAta3X8FZJx:Ne5vo3
- TLSH T1D313AEF793F089BDC91266F09A241E1BCF6D0459031C7C7B8AE4BE5753E6832E29160E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\55efc097-e39c-48a3-9a3a-91232bee173f.tmp
- Size 6KB
- SHA256 9381770a221e864a67fa9e8f45ff78cf772b71838ffab26f153b52e4c360efd7
- MD5 8549350b80bc12295b152d42ce2bfb02
- SHA1 462a9ef0a7bba3c0870c61f0b02623d13a5ab43c
- SHA512 d3e1f9be4239611b9a6dab916625e9b53a816862524b5ee241e5a79699c4d19b634e937aac3c2111763004efb8c16e117b9f60e3a557f03d1a64f173ef00129b
- SSDEEP 192:/UQUl4UXUbUeU7UwAUKUEU4U0UnUEURiUXUJUAU+UOUDUJUjU9UWKU3UPUtUuUUh:/lN8ajAZAhF77k9eiS4RPHo4asvKaoed
- TLSH T134D1CD63C27FB86B503D68AB1D18BC851EBBB432424164F8DB67C32D70C65F71A5A426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
- Size 120B
- SHA256 502c0f996e52c762d89ea988ce760740748b9b3aad631c7f2c212a5898632c9d
- MD5 b3b747510ffc442ba667b7752adef4ba
- SHA1 3691b4739adedb203d9acab4bd1df639165250e3
- SHA512 f56a8152be5184493813153ba9d660d4ab1537c661dac28b57bf722dab8b7a2426b601b61d6db723ad90732e0dd2e5c94f0fc6bdded3a67047d82e4cca11b453
- TLSH T182B0125470800660C83106B963D101C493003E604B02490240902A4758457864140601
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
- Size 72B
- SHA256 b1cd1af460333b4c0fbf9425454d399300aa7fdc680163549c18eddbcea17281
- MD5 75af92b25b483d0a5de996bf1048992d
- SHA1 e5870566b1851969d6cef6531bcfccaf562b07f6
- SHA512 391526f405ea136dc4ef1e76b63c5faf5f1cb16ddbc9ae5b0b857a58f86acd0ae41e64dd410f9de9a4c3298f310fdb38269ae9766d9ec63e39005eb4698124e1
- TLSH T1FBA0021049C00555DF024670B0A1066963565CA819655717DCB2457889DB3E34661350
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 3ba08f16025a80b2369d6271e0e5ca36febd3f3b066c17f665397dbc5c34a5db
- MD5 d34d94c433740080fab90ff84555ee29
- SHA1 f788d09862e0efff860ca4d0502d0617a97c85af
- SHA512 2c9c9839fd49ec879572efa57e92a89d4e5765e34d6d3e2e3f41993e1e0511f91b0585381d0c7ec4910a4db8c716244ec118f9a5ee2354e9cdcf66a7b8e8f42d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\d7b174c0-7fd3-489d-b272-75b7b0374ede.tmp
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c738b575-36cb-4776-a569-0fa88e7d51e5.tmp
- Size 12KB
- SHA256 615d6d935883ef3c6cb5c0009034c85a3dfb18a51abd022c289b96ece6b0cf0f
- MD5 865ceebbc651d8441918e8bdad192dc6
- SHA1 b9cc6a36692468e0dcabe21ed70dafaa28e53241
- SHA512 72f14e3be726394f870827cadf47d5de72f133a27b3395d95f307852a454bd69663f38165d857e58bd384c08eca94c85485650508dc70ceb43166af4705418c9
- SSDEEP 192:/RycBPaXcfQv7H1APRp2YLu/9OHsb+WNHErYEwn+1S2Y12+faXNzVyIsnAUgE:/RymPaXuMbAX+kwvPR242manE
- TLSH T1EF52D829AE647A3B5CDBC319F921B757E7F5102560E42E80E6FD893D24E75CC2217407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c7d2a501-9912-4ab0-9aa0-5272d08b1519.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cb39143f-49a9-4b64-93a1-faa8aa223523.tmp
- Size 13KB
- SHA256 ec4c79d2edd02872235889c59156ff5bf60a61b30d880252522221d8b4af1d48
- MD5 20f43511da65f5bd13b4d24b5184edf2
- SHA1 47243384fa3a6cf245ebb29a6ff339c4d05b8c5d
- SHA512 b6f480f8516e74fb72f136372b04274461b17382b4face3d00764dfca48192a3089b283ab94c979e90c2358a4b28560a4c85d987d562edbee997f97b24299e36
- SSDEEP 192:/RycBPaXcfzv7H1zPRpvYLuQ9OHsb+WNHErYELF+1S2gm12+faXNHVyIsnAUgE:/RymPaXuLbFXKkwvgR2D2maTE
- TLSH T19952D82AAD647A3B9CDBC319F921B757E2F5102560E42E84F6FD883D24E76CC2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f127dce2-6127-46da-a7c4-0f2d56656827.tmp
- Size 12KB
- SHA256 c5bb53289a819f95372194e65d5713d2615c304a4bfc2d0ab035c3185250a565
- MD5 28831adb02a7fb13007f932bb4293830
- SHA1 43ef418db6b49b7befc6c3b79bdce8a6dc4abd48
- SHA512 b4db877244b874c7cca709fe50cbed298cee562067157df1d7d5fb1388ab9a7aa022596f96a4ee436d282770638408dc3078a4150f411506fafc54c8d908a46d
- SSDEEP 192:/RycBPaXcfYv7H1APRp2YLu/9OHsb+WNHErYB1S2Y12+faXNQVyIsnAUge:/RymPaXuEbAX+kwv+242maae
- TLSH T1F342C82DAE647A3B9CDBC319F921B757E6F5102560E42E84EAFD883C24E75CC2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fec25f3f-b0d7-4a27-8d08-079f8746de8f.tmp
- Size 13KB
- SHA256 243d1aa1cb71fc9b840f159650444db08f84e06452b8958c5fac7597785eeb9f
- MD5 64f1e0390934bbbdbe3f540520564246
- SHA1 3d5cd7f7d2f6969b2f2f18bd32e06d16ada8f3c6
- SHA512 439291c3139279bab8abd997239f689bb4e07eb0f7aaf3aa7a5dbef6f21c10e73cb63a5a9a10f3bfad4183078f15ab8f0956886d633b640ab3d6ec7e87df5b18
- SSDEEP 384:QGjDC7KxkXqKf/pUZNCgVLH2HfgslDLXODgj+ErU3MGHGQYY3VGj4:QmDC7KxkXqKf/pUZNCgVLH2Hfgs1TOEw
- TLSH T17F52F927548D9A3F0FD8C68CDC17AF8FACB501566678092456FB9C0903A9BCF114A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 14KB
- SHA256 3c06362149392a5e75f343af74842523bffbd89014764d27852152f9731e7920
- MD5 d01424a27d57848799a10e6382468bdc
- SHA1 b115d19b8ef6c2584a0e17a5b8d88d1332abbc2a
- SHA512 427070f670db66ab5378806101cd0fd26e1001d15d09d22fec7cc7b52ccdf3d5448c73e5c08d42563d2e6e145be3a9bd06bed4d82fbc03e9d5d5a71a14e8af88
- SSDEEP 48:utzCax4A0v12DmqTxFMUuSVhpKqL30rvMB0a7V4I2kRj:utGtT2CixFMUTVVz+v0lR2mj
- TLSH T12962D616B459E952DC482C326F88DFDC0814FEC2CC69625737F0B34F89BB9E70828084
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 14KB
- SHA256 783a565ec41bd3345cac8498a214eb307a52ced12ed0a7c8177025fe97261d23
- MD5 2aefe52a0bc890622797905bf49d5b53
- SHA1 5098c36be1f0b0a94639a403d3661ae6e452b17f
- SHA512 871c88139d3e1ea7ba4af56f7e4f7b1c17cfe5cc6756409d5d3060d9405c3cc3fe41a98d2d3693879e07b09fe7ee1b0e4e9fe30738c4711fa765af0183f42403
- SSDEEP 48:YtzCax4A0v12DmqTxFMUuSm0dhpKqL30rvMB0a7V4I2kRj:YtGtT2CixFMUTmyVz+v0lR2mj
- TLSH T1E862D616B459EA52DC482C726F88DFDC0914FEC2CC69625737F4B34F89BB9E70868444
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 14KB
- SHA256 b62775e119a3cbb550ba6309adb830698bb124847c6bc8c7a823138651a3a24e
- MD5 7a6140b8eb0fc01b90e435833ad5f7a8
- SHA1 930d882f62d942c71f626bec32841673b772bf8f
- SHA512 9d4da0146a35432a7e340310148f4a2a575f28245953dd28c90a0248985986b01ff12c5c8e3304f4cf768220ff04c7f1b126047eb79d398339baa4aac9d7c406
- SSDEEP 96:ZAtW0T2Zg4uIs0MUTmNoqUAChIv1+mgc8adr3yxTLPp2mj:CQ00konhMcc8cypPp2y
- TLSH T15362B755B445DA46DC881C726F8DEFDD0A54FEC2CD6A125733F0B31F8ABBAA70954408
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 28KB
- SHA256 93e628e85823334b39bb65da60af0a4d6a4ba89b2198cb66852218613551bf39
- MD5 d72f8dbebe5f4c56d5e6f9dfb7b071a3
- SHA1 8e5e46e7c0917f26bb480d5f9bfff1d119f812a7
- SHA512 c3173ef49fcb3f334498b84036cc5ec97a51455600ae163c2836b1283321f56aa6093892c0d7ebcd2061573879f7f290d3f95b8f76f5f23b9a6df38d50f45d6c
- SSDEEP 96:Dto78ECdVncqU+kz/A8az1HvNt+1rAUQEHFTVKlc7NvAcIZWSrqLzX2XZ:o8Egcn/s8uorSCX+sNDJzX2XZ
- TLSH T154D29266B409E906DC981C326FA9EFDD1910FEC6CD5A121733F0B75F89BBAE30819448
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\settings.json
- Size 14KB
- SHA256 51de0bd7f8c1719857ad070c0438ee996fd45965445da556bbb17d69f381b179
- MD5 91aaa7d9648e31d8be0841e676541c2b
- SHA1 8cc789d73c3463a5e896d7bfdd95090bf37b3145
- SHA512 1d6a1477d5ba7ba4578a52b823ab77034a4110fd1a4771a36c501fde7128d4bf2759a2dd1a48b73ac589fdf596e5a30cc44d2236c5b408d1747f9313db8d83b3
- SSDEEP 384:ariol3FwaVp8lzrZZrzDqT5fERZW7j5U/qdc741ybad:oiol3FwaVp8lzrZlCT5fERZW7j5Uad
- TLSH T100627A29A465DE2C87A01ED03C3F294F5E963310BFE596F8E1FF4E0476818AD2326765
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia Studio\License\653e1cae842f77e41a.cache
- Size 5B
- SHA256 4df23ffdf2069ef14d0f024da02048dd223c3170ea54c4e2924b3cca4e4b759b
- MD5 0452af901efc9c167ea8fccf6ccc9d32
- SHA1 e820378299e3b991b0cd0c68d556dafa8085d1df
- SHA512 c8201e08f8792bc6f4ad1ce0eb95be09df98821661ae0972e6e5522eb88eca48167497a4c427cc253f1b19286e3160dec27f8a662a22c916320bad1cd8d08d31
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia Studio\License\653e1cae842f77e41a.lic
- Size 2KB
- SHA256 e47c7d70b30f4c622db012e4069f54766f47020950ad2bd056b73c8d237567c7
- MD5 dc68672513c76d3c2c5e8195b41b96e6
- SHA1 c6b95c4b34bf25c4def16151dfc2db77627eecf9
- SHA512 62779a1b55b1b4eb79e29e395ea04e1d0dfb1bb36b568fc0b51c8489b113fa4ffdeca1176d6674f7d864dd9a2313b5466a59a9a87c6b9ddbdccdb3211a0519dd
- TLSH T1D2412CFC2D6C19E2730A627A748EEDBC2BE12CA3B62DE856B27992472251244D408C74
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia Studio\License\653e1cae842f77e41a.lic
- Size 2KB
- SHA256 d18f0fd3d1da11ed3ee9673fef73cf0e5300ea667adcfa85c236bb59350aaae3
- MD5 6a6b9ece7c542fdb92a43eac8ce48a21
- SHA1 c071d373879b87274b54973298ec9a3da13d959e
- SHA512 8fa74b51d14dd26973c47b1cb5f1d93c3f2f144747f98da5c958c6e297ebc80d16867e1c951e9e5ab358d3c779a965166ad7151856f6e2218fc47492270020b8
- TLSH T1AF4108F524C754C0DC2A286F93B84988842A7D93EA9F27C780987FC1002966B6E24CC8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia Studio\License\653e1cae842f77e41a.lic
- Size 2KB
- SHA256 32c7d5c685a4b604eccf58feb35202fdc959b9ebef2a7b905b55a742f050116d
- MD5 207fa1418f9485cb9e9a076ef6c59cdc
- SHA1 c0180e45ab581b3338d29e9b44fabd49cf63d12c
- SHA512 b3cf4fd52f5422f96407875991866060c8d2b0e509aa14edd43887d5406b0bfbd4afc13a8fff227de3a1df78851fef4388a7865cbe7df20263dd18085d76482d
- TLSH T14241EA6E720ADAE3124F029FF25799F808531BF524C36A8E4EC426A504F2F59DF05E81
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia Studio\License\653e1cae842f77e41a.lic
- Size 2KB
- SHA256 51ada74a98387ca6c623f8d71a0793acf46c97d17160f703784764db9651b1e0
- MD5 9d02aad58c45bb8b02bd89a81eba64a0
- SHA1 3df470f97e6be9205e7b242701e5db2d6c336536
- SHA512 6f28d0ca5b1de52878658847fec5abd15084dd2c83ea4600bd44c4122a14568e1597b20c01e22707c4f87f3ec0b652f08e651fff6666b661e607584716df209f
- TLSH T1DF41EAB130A02CFFFF7E965FE591D0691A263A70DCA64046C82E65D31DE2129FE46C64
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia Studio\License\653e1cae842f77e41a.lic
- Size 2KB
- SHA256 847b02d7f883c15cc2e076186cf8ffc9d44d429b727065909f4fd02556954fb0
- MD5 ad490b6f268ffbc1543e99c4a77d5167
- SHA1 02c17cd2895f151a17479882bd493f6e545b16a6
- SHA512 d214daa0344df41074516fccfd00592b18427edc970479ca974b82c8ed52efcab006f3a8bf1aae6189859691c1b9c4099f4833176f46cce2fb8517b84f009b9d
- TLSH T123410AD935005CD99AB721BFCE13180DE6E9E1231FEF489C580C929B10F7B98FA62807
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia Studio\License\653e1cae842f77e41a.lic
- Size 2KB
- SHA256 0540ec769a15a45aa9233106985153cda77ee3f8c46dab0533708eec50341c49
- MD5 89aea5cd66dc586f9e3ac09b0f67d5f5
- SHA1 0c7a845660f4c47edc85367465ed4850bdc92d13
- SHA512 6558f6a5741ab78109764e3a6b2f04a2280443947dd8ab4755bcbd7200995bbd9209d92e14069c09f65f273989c37ae285b3d0736a8d456bf55194980057114e
- TLSH T19F411AB81341DDFA51AC120E6B5BADFC20AD8F72B916680C808218270D73D7FDE13952
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia Studio\License\653e1cae842f77e41a.lic
- Size 2KB
- SHA256 cc66871fdf4b434d5da7205d7896ba05d26ece7a4402ac4a3ab875ac4b68d4f2
- MD5 e72124faae1a9549d9058c3e6cf4879b
- SHA1 17d6fdc2f03a3c2d8a7b39f64cbca639ddcdc1e8
- SHA512 bcf7bcfc22b143296bd80d6c9dec516d05e3a99a3eefc9da67f80c80ff59e5268ec9fd9a254f2b8c67141048cd54851fe4f81e215c90afd03e7731985079d7e8
- TLSH T1F6416DB4B903045D753E473BE3152C0C33BB671394998CCE48281ACE0D37B6CA8B189B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia Studio\License\653e1cae842f77e41a.log
- Size 54KB
- SHA256 1723673e4e7dbd2db1e77e1cba29ebd962864cca41fc02baf1d1cd36cf783006
- MD5 c693eb7cf024ba54270e929c7be97189
- SHA1 847b7708eb808f04f54ce97367e902d358be61fb
- SHA512 30b794c148817e95fdd05e817da9623fc24be02958d0e70e9e9a1a17dd012e7c57dc43ec67bf4d94ab1a5c3f0d8d55069bbc55d395e9a7c0271d2cf6dcff3822
- SSDEEP 192:xex8x2Sg808IfQxaxHut8flOsuyruyruyruyruyruyruyr4uyrugruyruyr4uyrk:ky8zJt4EtOX4obnD1/JtVitiGI9P
- TLSH T1ED43A202B46C8D7D57663A59F927246333A58F9440057AF2ED2F83BEE32C6553C8A39C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia Studio\License\TSCLicensing-Error.log
- Size 10KB
- SHA256 17f8038f6b5aa099004738e4926a3a836ad80401fc99dc8b7eeb029d6308fae9
- MD5 93546419aee9e7b785890c590c463258
- SHA1 83da9f4038b2ec0bb4fc6c2e91016e10a75c1847
- SHA512 a4cf272b999cdae3aa7ac0bda954204fabbae81c3aa9e2cbaa4851af9d5b26e6f134e7baadf8a7a4d0b1390781f312bf755f661a60b7080c912152df7b7f3f5d
- SSDEEP 192:bVKuscKx0g6nCsOopVS8WCeikdgZm+UWCM6:bVKcKCg6xOopVDqamvI6
- TLSH T1CA22371A3D9D323B5BCA070ABF0E1D6E7339D3632B994A779F6CC5001169E2439E7A44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia Studio\License\TSCLicensing-Info.log
- Size 20KB
- SHA256 15ef474884ab21b6b9c609f9f473f3888a5f93adaf20260c19f0498647c7efd4
- MD5 394d3823f5e88ec87109a463d8ca966b
- SHA1 3fc59608e759f6e7b309b80bdd921d50c901279a
- SHA512 b0a228173af2ceddd955663cd1c164db713fda816d3cbb6c8dd5c6071edd89faa2e9eecde68f56472d00dbb550ba4db17c924db468fff1f5d6d5439290db288b
- SSDEEP 384:qdh3/+dP3u0V1cK4M6kOoqxgb3iN36naLJi3RGWVjOjqj+wg:M3y3hV1cK4MxOoq43i3JihS2ywg
- TLSH T1419277063C5C32375AC94706BE4B0DAE7335E3672BC94E7B9F6C85102169E2939F7A84
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\CrashReportingNative\settings.dat
- Size 40B
- SHA256 b5b99114ee4e29b8d5f5353ecf56bdb308e74b6cce29019a95f9cbc129002c3b
- MD5 b1de995100c406726a8924e15dce2fe4
- SHA1 5a036be5b845e9d69c8cace590ef785ec74ea02f
- SHA512 a2a7074f729e12ed96dc4036f5aab12cf23891ca3d34d9046803409fdcd3dd409d10115b859b373eaf15e421344eed96bb825da68120838a11bd399e3af8b757
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\Features\Templates\05e47892-deab-431b-be15-a7ca8e748e67\templateInfo.json
- Size 158B
- SHA256 5f0c13ebe83b9e8b6a03f73b1df845c63dfab21f17b1a483861fe646fe68a791
- MD5 b22b79f244d89ea6446cd1865d9d48b4
- SHA1 8c49760b3a4fcf89e78ac98e580344c0f72ea19c
- SHA512 796bec6cf0f76f0717dc6a9c8ba9c8519f6e424d38b834dbfd01f0813392e3dddaa4bcea6ceced49e830e249221e5408baf91ffff71d0aeb10404b2057bf0515
- TLSH T184C08C960745842380324B60093E264666E06FDF7A70CC8B25771AE0029372A91C0B14
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\Features\Templates\156c688d-9628-4b13-b789-96863ca63003\templateInfo.json
- Size 152B
- SHA256 52dd7525e925741cd376cfb573defb25d3fc6acd40d396b9a30798bd14cb5877
- MD5 ed723ff0ddcb8f5bfc31f743b607b433
- SHA1 6d8ae8bea5a091a20e630333902629eb0fe1e9d9
- SHA512 35c23024353661065bffc35437d7952ced6631dc516d278d132f60c60ab51a3e96e0748e5e2a666c7830e382ed6625636a492a0f88e3505c185d91aa044a34d7
- TLSH T1CFC08C220404690305A243A004780903A6A87EDF18689D8EA67ABA2001B5A64A6C5710
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\Features\Templates\2cc71da2-a166-4d80-8d0f-116072d2e902\templateInfo.json
- Size 158B
- SHA256 e32c18d06cea025968415f18f0b32398c324e89a0375dc10cfc4f030d5885f68
- MD5 04a35baf47eb93dc7b2552106695489e
- SHA1 bdee0597dd84998a4f2b27c4ed27f53648abd95e
- SHA512 0c3bdbe8c345edb078548569ad3d60292e25ff035d9ef3d0ccef1b4051a8e3d4f1ede8dd4dfb9037d2ad964515d096e8101c80633c15ae6709aeed7f8825f3b6
- TLSH T132C08C13072A604211308AE004391763BA212F9F9024EC8D3AFB29800C86F6862C1B00
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\Features\Templates\3972687b-7599-4189-a6cd-5660b3a08029\templateInfo.json
- Size 157B
- SHA256 0db19fe04566e3f3b7db29149d0d1431444e1c8f276db693710b08a37c9acb65
- MD5 adb6b1a5ef2046ff7f535d510115d67d
- SHA1 1def3c7f8900f25833ef2c933483bfd3ac376900
- SHA512 6a52500704ec30c91a2bba42825cdade422182e670295c4ebb34392385607141215f850579225dc954d66a1e608a8deb18213da1299592e5a3d058a14d28492b
- TLSH T172C08C420A9A405245350FA0023A4247F5126FEF70B09C8AB5BE2200C4B7E515882720
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\Features\Templates\43164729-fee7-4ac3-ab6a-a9a65524b630\templateInfo.json
- Size 153B
- SHA256 a0e1a4ba0db85892dd13d0f130403998ad3945ab11ceddf4db067828b57d4eea
- MD5 72457c776ea96f83ef67f0115111af16
- SHA1 c1a6bc7be3e5f0d72c8bb4773cd87c0558fc25ab
- SHA512 e086db94a56986558bacf79556a1ebb1d504ef281d6b22ee6aba80d9de508cf233e7442b7d3e77a28478cf8c4651026c3f2150e9ff8a36b5f607ede83adb8d76
- TLSH T1A1C02B270112529382350FF2013C1603F9102FBF0131CCDEE97F2B1000F6D2904C4761
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\Features\Templates\5c26c478-db94-484c-b501-5cff82462e22\templateInfo.json
- Size 157B
- SHA256 b0cf9ba2577a500385355d1244d437ff946f27a3879aec628fa29e2622d6fef9
- MD5 c75607b7ed3c2e8b238eea87d4d7930e
- SHA1 b511ee48d9f9beaf566a0ec8f4467cb78a4dddd4
- SHA512 1d5414a5f59f202fc771a0068c072fb812b1a0795bfd0df2efa913116fab31529e585e3f7c767b989b88222191882a0570475525fe1d606be9212162c8c88462
- TLSH T1CFC08C331611E4AB06200B61803A020776222FEFA130CC8A79B792A005475580385B31
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\Features\Templates\7a3c275d-d6a3-4362-82bf-6050b6fe53ab\templateInfo.json
- Size 159B
- SHA256 cbd71fd9f30e275728d2ff9ecbd90102c3ba64aefb3826b267226be35292491b
- MD5 3d73f9cc98ab82c4313bc1c9f7c98e81
- SHA1 9ee21c81a776a23bc7d6664b2bb009a52cd14907
- SHA512 8459d7c21aa48d039a6baac5bdf5b31a271b9816a98f4af6cb39e2a4526e0cd5fc9aa9bc747c93db4311e41deccf39e6df8f4f804a931b60f0b52dcc59d686a9
- TLSH T185C08C220688956302710FA00039A20222A41F9FD2A0ECCF3EB777A001929601181318
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\Features\Templates\7d23c4fd-2923-47b2-889b-cee2ff951780\templateInfo.json
- Size 159B
- SHA256 e8a017ec8f05e039899381420e9cf8f0cb114414672731b739cc70e5760c2ce2
- MD5 8cd54e529ef97e04cdd95c86f622e3aa
- SHA1 4729752d18c9e2f541a75342fde2a4d029a63694
- SHA512 b7dbd3528f25ed2dffb4abf166f771ce273c302fa265fd4b4c3c8fd8eb67edfc7387ffd626858c411967f72f9f9fb6340994c350ad7dfcde0d760098c63003bb
- TLSH T10DC08C2203A9213382321A7200386113B2206B9F90605DCE35BB32908545A2310C3B14
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\Features\Templates\cd2c9f07-a917-48ee-b7ed-f2ecd49cb622\templateInfo.json
- Size 158B
- SHA256 f996c0e7c8791e35bc3febe3e4ef33c303ddf3149db6a3ec4dc54c88aed3325c
- MD5 f7246e60c09bcac2e8502c8a85b76170
- SHA1 cd08c5dd79a974762a49824cd7e536c28c5d2c6f
- SHA512 0b0e64fb8bd13be61a50aa63b45edc308ded291f95c4ac63db8621f40d3c8ae14f3ddb6537755604e880fb9e81840c2bb0308f05057a15866834c58847733d5c
- TLSH T145C08C270606501704A10AB08AB8150EB5A01F9FD423CCADA4BB646022B79B51AC2B20
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\Features\Templates\d0ebdebb-6cdd-451e-b916-f126f97b4d0f\templateInfo.json
- Size 168B
- SHA256 9ee16db503ee568bfcee60735d1ac365703c49261d0d0aa1ae7a2cb2598c22bd
- MD5 fc8619852ad1b73e2b472c90654576a0
- SHA1 d1bb40d7731c46db68a8d19ed5713abe00ae6b8b
- SHA512 56b4b02ab170c2dfdbc0ec011c03fdfb7209e41023e900f7a6514da06a7f8fcf09b50697b33fec63304e30da1d40134968eeabc0f712f9ae14812a7823919f72
- TLSH T10BC080174F562413413003A0003C65532D102FBFA13C5CCD357B1730D1F0DA411D5710
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\Features\Templates\ec1c625b-6326-446a-8217-34f7f5b9d871\templateInfo.json
- Size 157B
- SHA256 b6b067636ad2448e9da5d730eb4a2887fac6e887ca6a7702f4d1f7024d271525
- MD5 bf5bc8398b2518354bbafbad746548bc
- SHA1 3fdab38fc71af98d6750b2d1854f2c794451ca54
- SHA512 1f0aec272792260159213b4ff6086141cbf77c6a95f1d20df9dfc4e611a623ce360374bdc3a2583e624c6e8da56153e5471830dafa4d0a1d3d3b52974c76585c
- TLSH T195C08C13450A606704740B720434D103AEA4AFEF82A0AC8D32B33E1009C6A2D18A6700
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\Features\Templates\f466a932-af45-4a61-9f8f-f703590002bd\templateInfo.json
- Size 164B
- SHA256 67d9dfdb2c0749ba50ddc40343d90c5d4ac34a2e58e3f5ff4c3c4878758872c2
- MD5 7d9a0b4031e4f005b5ef51a38c0a81ee
- SHA1 ac3efe751ee55e60e5b4e0b3e5cc51ca75d8ed92
- SHA512 64bc342cc1a130436638347ce986e66ba3ea98afad19dbb843cb3f38b6de6633234a57dd2952f6efa63088f1762d04324cb2d666f490e5e92555bc311fa32ee7
- TLSH T141C08C2329611023822007F4167AA5536E603FFF8224ACCE39BBA95061B26BB26C9700
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\RevulyticsFiles\ruiconfigV5_amyrttbmei_Camtasia_001IUGIDGQ54V.cfgtmp
- Size 36KB
- SHA256 98ff949298d3d2cbbc2d9762ca3359318155d7e0e75001180f129d73d647152e
- MD5 64192d53fdec334acccd3f84e38a0d23
- SHA1 7a2d0608becbbe12759ef6c8c1f3362ca9ec26ef
- SHA512 9f9572c713574f824e5cb89a235ab572b7e33126b9015952dd7d8b31865ade53f6c7620e4219e816fef6e389ee501615743ebd4fb186689f33eac783adc7deb0
- SSDEEP 768:rCSQNQzaxhmbzOVY4c5TjY/Hsvz8jQNQzaxhmbzOVY4c5TjY/Hsvz8I:rCHIdT64NIdT64n
- TLSH T18C0342F339074B5B2FF1897A67273E6537E2861CAF4898A2C46A50BD73705217B2E431
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\RevulyticsFiles\ruilogV5_E111B0F52F1749D6_amyrttbmei_Camtasia_001IUGI1TRO6V.logtmp
- Size 806B
- SHA256 27e9b92e6784a8a664d198da8c3666501bcb797ba92283afba3c4dbacb848b84
- MD5 23502210b8ec4bc1157141ab9d5f7df2
- SHA1 18e19d5a093097d99d5ee9a94b2ae3aaf5ec8ad4
- SHA512 e7d5c8087facc5b0abeed63721ecfff340abf83b4d64c6065823b1f2ca438ba4abc18056b3ea76ae64c74fca7b489577685b2bfb164dc3cd7a49190b96a36959
- TLSH T1740126249076846C07400390D45C9D1266797BAC76EFB8D1B2E24BD398FB04BCC1D4E9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\RevulyticsFiles\ruilogV5_E111B0F52F1749D6_amyrttbmei_Camtasia_001IUGID86AIL.log
- Size 252B
- SHA256 f8b59ad21c6cd31779f4a980e3c638fb77a6167f19deff98cc19e03d76f494e4
- MD5 a161be4674fc50b8998272f4463a8cdc
- SHA1 5731799ac5db409242126f15079002f8fc2a3913
- SHA512 f365d42c74c1f257acfe95cf763a4c61ed64d613e2110b1f93423e23aeca765d139d2004e6519b7c64cc662818fb63e0ee45d380d0f7c9a6f8ce91330c51b193
- TLSH T1B0D09E54F8F56CC36818AEC097084D46843279716B8AF4C416DE7A69358A3300E4F791
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\RevulyticsFiles\ruilogV5_E111B0F52F1749D6_amyrttbmei_Camtasia_001IUGIDGQH0A.log
- Size 908B
- SHA256 eb87b1056fad0253623be1ba5560aa9e0fc2447bc4cd58329adddc6c9ba7c86e
- MD5 6f44c0b8d8ca0856ae957c6b5b732b52
- SHA1 a6ca348c0d2a22e65226267ab2bffc9d834411ea
- SHA512 c3cbedf27f8d6d1b9ffeead3136eb40a4f7a6c0e27f20b5d451c06c571148ace23e22773af3e438fbe850c3ebfb75ad4eba69a90fc01aa509b001585689ca97b
- TLSH T1A1110620F0A7ECF2A8646EC4DA0C0F52493662211B4BB0D069EC766A66A62348D0F7D2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\RevulyticsFiles\ruilogV5_E111B0F52F1749D6_amyrttbmei_Camtasia_001IUGIDGQH0A.logtmp
- Size 790B
- SHA256 8678e65af51ef80517485786c5e82077f46af6232a22510ec08c43843425135c
- MD5 a19887246347f212b258480030881c41
- SHA1 dbb6d7f915d21faf6ba25b5fbc4a3784de851ca4
- SHA512 d6d74922ecfcc02eab8d7c1ae5f787ba4258a331f862f4a8c32f295cad57611f246f14b36eaa740b375d7a3cd2dcf173d6a28e0514b259c9acca6fd0749be48e
- TLSH T135014914F067EDF269646E84DA0C0F510A3213201B4BB0D058EC761965A62349D0F7D3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\RevulyticsFiles\ruilogV5_E111B0F52F1749D6_amyrttbmei_Camtasia_001IUGIO7IFV3.log
- Size 649B
- SHA256 8e81b33a532235e42bba3c00385cd3908ddfee461e7ceecae92ae83661c33e1e
- MD5 41bce09590697bbff6daf1ccb2923eb4
- SHA1 7055cba111aa1c3d309edfa27cf6b0aca948a0b7
- SHA512 b6a4fc0ee43f7d46c0cbfdca5ce297c4fab3ec787b784c48a8234c47834ea9a7351e59159e755e10d286ec9ebde69432e953000ae7163a247018dbde4cd287ff
- TLSH T157F01DECE43FC53922360EC0053409141C2BA6581E4FABD563AAD39284B448FCF6A4ED
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\RevulyticsFiles\ruilogV5_E111B0F52F1749D6_amyrttbmei_Camtasia_001IUGIQK4JJ7.log
- Size 252B
- SHA256 ab2275eae35f7e61bc7cc42df748246edac0d6dd9026200e6a77a2b4ea777602
- MD5 c31e551dca3d73bb4da732e1412aa798
- SHA1 7cb3672d54b07950ed37911713d9eb360c8d639f
- SHA512 9bd290bbb1d43f220b0f12b10ea953f985f5ffc15f07830ac4964d0e24d4fd28c5f29037e1b303849bd1e3dd0a933ddcd9e4e39533a677b877d72b2625f9a4bc
- TLSH T178D02E3084DFC868813C18A101FBBF4F203C3020C5590FC22BBC00412C2C0292F20A33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 2ea9e3700ff6a1721ccd7b521c405ebf3baf2c767063ee6b86317e3ccc505fbd
- MD5 19c8acf55ca9e3f3fed64108ff94a405
- SHA1 20661c599895b4560e184cb549ef4dd01d2147dd
- SHA512 3f344ce9517df2a765d97fdc6cba3253b814f0e5e46be32adc15cfc73809232c3d1502b66cf1ce0472ef826244d7a4749a0f9dc8e4f7d3ec78f8a330405a1ce5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 8b9519a178014795eb1eba489922c743594f9c06ba94de7c4ee7ff28cb6e30da
- MD5 80f430440b7192b7aa41560409d25604
- SHA1 3fed291537522da45904758212d656b37853d25e
- SHA512 9593e507523392cc0fc6a116289e2851b0cd530821f3d271f59304c3754efdc6d0466372a8ccff8c91130295ad651f30af68594a6f8c6746bf3baeb632160aac
- TLSH T1E4D0121733016235C42025334012B6890401C22B444940006828852F1A484600D12481
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 c3152644c5a52fa06fbd94c57a44f54700d0f5a274bf5a3adde3e310a9fc36f7
- MD5 751f35f9b9855dbecccd887609ae87d3
- SHA1 2fd7d8b6153ce0aa73743f48a0b62d294595c70f
- SHA512 46f5e5efbfb5e18bdc6871f2a8cc6b8cbd3cd0ddc0474e7f5f43651f3688db8aef070b751d829b684c720689939712de4c2e576421fa1a589f65c7394786d273
- TLSH T1A7D02B1223005B74C5311D330242E6461981F22B8405D028B818C43E1D084E00E514C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 110c8c47e6d708f8f6a46656889f25f925f827ea2733813719461453ad014a8a
- MD5 c10f76795972cf703b74aadda47dbfb3
- SHA1 3045a48017f34341b7d6d80a18cf4158ea443e16
- SHA512 f6a748aea1ba8d0d22daed089b77f91b8b6006789ab1d4848c9849cc950ad057ac9d47d64b770f231d78d9e57ba5b26c8760c3185761ebd40d8a2d924f268580
- TLSH T15CD0C00F32444B38CF31A9321345DAC61BC1F21B9883C178A45CC83F380C0B40E414C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 62a26daa635e5e17c6d6156661219c4bae5d41c99638baa24df4176056ca7dab
- MD5 5e0c459647eb8378c54693a7026c306b
- SHA1 10f8643226a0a1fbb44090be6587a0d5954b52f1
- SHA512 2a802bbed70fadb7db8d9da393d55d2f9b6e0215b78013d6ccfbe863f6698942ec59dd8fb9153abf597d8549b91079ea995a262a8355edccd693151cc1f76b93
- TLSH T1B5D0C00F32445738CF31AA311304DAC61BC1F11B9883C278A45CC83F3C0C0B40E814C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 915a4811f86aea257a2a7d715709e60a791806209f887a90fcab72a5114d68c7
- MD5 48c5149b32a92288e7d2e5ba193c5ea4
- SHA1 069f62b8538d40678895d2d5850184af94894cde
- SHA512 6f61509f5897712838fdd5cf48558caaf6a56dbdc5134ad4f2aaf4602795bfef8f3f6600f6ad66dc70f80582052209fa711d13417105d7da691f9cc8a1916f0c
- TLSH T1FBD0C00F32444738CF31A9311304DAC62BC1F11B9C83C178A45CC83F380C0B40E414C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 8a3f9fb37474ff155d20249231aad6b8d1582aeafc772cfa6cfe4738ca918615
- MD5 5096494ab038be788bc8a07af9f4ee9a
- SHA1 804129d3411f3f0ae2922474fb747bc6b56ee89d
- SHA512 a4cd7115c196d069759320ccf5dbecc0430305ed08c0fe3f873bab4c1a3843f59d1c2259e2362966b2e8c9f525ed52e914a23c12fccf34f0f27be7b549644a60
- TLSH T11DD0C00F32444738CF31A9311304EAC71BC1F11B9883C179A45CC93F380C0B40E414C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 0958c32bcb03bd2455c768be72e4e2f3d785732dd43a80836725fee9ac52a2ad
- MD5 29ffacea69590eea5236fda3d55a0e75
- SHA1 cf925efa493f53583ef5ef5be72eb87f4bd7d42c
- SHA512 a6929336add4c64ca162d84fe9b2d350940af1e37212c0ac798ebd476cfcfb51c843316717cc362e8cbcf0f2b0563706f74135b62beb8c8ff9e1bcd8ab289e43
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 e236228cb14e0cb513d946562fa28555a9d503d5009b2a71ad89dda187547544
- MD5 f574443550fe61a09de8a6022bff5c38
- SHA1 e4e6524fc12f8c589cc32e76c79d02e14296daeb
- SHA512 5b6fecda7c074b1e65f5d90f6a3519a67248caabe8749c59778bb8e0106728d089a0713424d2ca0ca73818febc056f0791920a2537478970d9bd55aac2d29697
- TLSH T1F6D0112B3A028A38C020203300A2B20C0808C2AF800A8000A82A8BAE3E0C0A80A22883
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\07580043-9417-4693-ae7f-cc22361db3c9.tmp
- Size 7KB
- SHA256 c086c69515dbfe25e51b44dffbf8842bf6bbdae7293f40243038be930e6ecf3a
- MD5 6185ead82a6f7582f19e509b7008238c
- SHA1 330f003c15fa709b6d1db160961759c361db098d
- SHA512 e128993f85d4be8897885abc8c1434a8ca35801d893e8b6b0fa0298164f0ccca973284f5cffb2710a1a64aac226deb465dd05c871a0da98597a1452b9f17c2e2
- SSDEEP 192:stegF0omQsV+FNAu2+Iu0gIyMm5IVI8I8DRJKZg6K:stegF/sGH2+pB6VL4K
- TLSH T109F1B7126D7869BF0CCAE125F664F72BE2EA502265E15E94E7FC892C04D76DC6203C47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\089c878d-a582-440b-ac10-e4d63815d994.tmp
- Size 8KB
- SHA256 fe76f442747373c20e18dd04fbd7d44901c84a934a3f8f99f78a2f6dd1a1546b
- MD5 e4634bf2b38dd62f5a82efb40b182c57
- SHA1 07a1ea0ada0ea7dd24a5ddcc1b15207563d12114
- SHA512 471f0b720d0d5e8b4412c96625b534cf197868cfbc6e9abd5be469a7737c4c60befb9f689805f67fd2011265526b959b74dc63471a4791ad4cbe63c8891d4b55
- SSDEEP 192:stegT4/om6sV+FN5GO+I2haI84Jlao5SVIiiNzkGRJ/pg6K:stegT4YsGiO+wsEVGXK
- TLSH T1B30283536C78697F0CCAE428F525F72AE2E61023A4F15E85E7FD892C04DB6EDA106C47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\1544980b-f972-4d92-8e98-9bac72cf9564.tmp
- Size 8KB
- SHA256 72d9c2bbe89341c0586f2af1ada01cd169b08f00281e80bf93813a9d69c176ca
- MD5 4c866db860fa65f3351fdb68438cf49a
- SHA1 76c8c37cd264c7f871380f6c72d3df4284ccba97
- SHA512 e51ad08799a3545db6008f141fd29ecd4bc5aeaffb6d72fc19cd3fd236c6cc9a5ca2a49272fb124d03b51f69d23e658548d46b59fbb8c0b6cf9a13c48a2737f2
- SSDEEP 192:steg9FomVsV+FNHUO+IrrpIn4JlUF5ZnVIiiNXFpRJRkg6K:steg9psG6O+Q8LnVMaK
- TLSH T1900294576DA8697F0CCAE124F525F72AE3E61022B8F14E85E7FC8A2C14D76ED6102C47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\6700b07a-b057-4752-8798-8a8f55dc7f6a.tmp
- Size 8KB
- SHA256 bf6917d5e07cab7ec2124e5f4f291c33e929c0046ca41f7af886160df91a9a8b
- MD5 4005344c21e9adf904f156f4ab9c9b4d
- SHA1 d82bbb349e624e173b2c971daecb915a05f11f3c
- SHA512 26fabf71c986aeb880119c3cce05b342e1d0fd6938b2f8d42e2eae08f3e6a2299f60f169feb85f3082d7002e6ab9fa54dead3f9b6826d7e99f23b68ffab2eaf5
- SSDEEP 192:stegLoomcsV+FNlJm+IdsDK1IHCZo4Jlj4D5sDVIiiNNkxlwRJzRg6K:stegLbsGpm+Fm13IDWDVOAkTK
- TLSH T1660294526D78297B0DCAE125F924F73AE2EA112264F15F85E7FD892C00D7ADD7102C47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\793fcd1e-f063-4c01-b6db-44572d78a35e.tmp
- Size 8KB
- SHA256 60cc92547057129a1e2b3acd65d7ee051b83cfe2f92ce60062ec00b3f4bf9c11
- MD5 048bfe3d39dc099a361764494ea6cf31
- SHA1 a3d2217d16363acbbb90f3faf21638f05e19557c
- SHA512 345adb79453d9c0761f9c79fd936a8c3c4394fc5b2bcc33bb6a9f6eb9ce6af51e451033145606a1e68a93e2693e9dfc82ea11814ce57959b9cfc642e93a39aa2
- SSDEEP 192:stejL/omcsV+FNlJm+IdsDK1IHCZo6sQj4D5sDVIiCiNkxlwRJN5G6K:stejL6sGpm+Fm13EDWDVPAkrK
- TLSH T16D02A5926D78297B0DCAE525F928F73AD2EA1122A4F10F85EBFD892C00D76DD7102C47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Cache\Cache_Data\f_000024
- Size 105KB
- SHA256 1a9bbfb448923e8e3afb42018f246480212cd0e3af131398a6091f3b0614019d
- MD5 fdf65f2542ba212ba51ca4be8f154852
- SHA1 9a2f2a70b9c32f325957409b4d2fa90c44b848e3
- SHA512 9b75931e664f6819f0b76f0b5d6689f9ea61b4dd15958d351d9d886059ec8750b305755ce2572a570e62f2d07899dbf2f19da14fc3f68b0391f86db90afbc81a
- SSDEEP 3072:OWSMcOR9sWyWdJT6AWMnEmy8iuhj7YPC6ixtcH8Vde:0McOLhdUzcE/8iUYPdF8Vde
- TLSH T1A6B3021A8746BF7416A273C82ED1FFBB3479B23E27BA2A4C552070F1596EF358214706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Cache\Cache_Data\f_000029
- Size 49KB
- SHA256 ae1f58bf2c19439a1298d9ca9ed72dec9906f93aea70dc5d7054c5724adfc6c4
- MD5 31819f62c45aa8abb7669799561f3f08
- SHA1 134c72a04a9676356ee3dca4ea00df769fc0123d
- SHA512 f3c606c5e6972694b39cf6c9ae428d6b7b81d7df21d24622ed9755b4add296ec3eb26fc65a2f1c799cdd6730ab07f709a1742c570274299e27ff104da18d3a38
- SSDEEP 768:RcsUImsgMVTfZQeVudIOkyozSxH1lZX6f3SVAPoYMlpkySKylqNlQ6:qNxsVQ7LoexxX0jMl+svQ6
- TLSH T1AD33F1D5B1630532170BD5FA5AF8E95046B8BE897100F2368FB1F0463A26B54CEF5289
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Cache\Cache_Data\f_00002b
- Size 80KB
- SHA256 7912fe8dc67d3c99d3be2a98ce076a2795159541fd3b478786722d807fa4c22c
- MD5 a18323679e9adc4293d905b42e3c0aeb
- SHA1 5419d636b09bdf490921f4526d9efd9aa4c20004
- SHA512 eb79ea822bd379d870c86df2d7d3302683357c72bd752094849fdea058ecb4603dd18a3cc0abb79e6e1888c27de6bdcabdcf4ea0d5cd5e81117375a315d74edd
- SSDEEP 1536:eHHCtVHmtIBiPSet5/N+jPInubywyx61IHqh6qrDc9IqFkHN1T6iC2I:CCOwiPB/UPPyrxFKwwDc9IN1FC2I
- TLSH T1708302438D1556EE3AC1F83AB44A42D891E3D93BB0EBAD5AD4211F33CD26DC7F252099
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Cache\Cache_Data\f_00002c
- Size 25KB
- SHA256 3f7586ef46e5bc3b86bcf921744c8cffc5967167d497fcfc3aad6a43350a6081
- MD5 88144e84e744f1904ce7a28728741bfc
- SHA1 e75dc22d147c01c0ff191e4ce5b2f229fb1ef734
- SHA512 a82d63cd70a9c6a64e0a84eeb48009ad49d20a7187623ad48a655d958b4138ee1649e8ea09415ee2da56646f948d4fb3e3ec44ffe8620bf0aa4f662fc8d8dd2a
- SSDEEP 768:0rMppLzzQqCP6WKX/n52Kn75hzaq3xgt4:MMpNzQa3ngKtJhgO
- TLSH T191C2E111987044F1C89908803D6EB1387793D99557CE1C4171A37DB6AAE4F3E67542BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Code Cache\js\index-dir\temp-index
- Size 744B
- SHA256 6225e9d3edf0f32df15b3fa3eb2df594803ad82a804aac62748b390d5be36e70
- MD5 0a095e519c4642b66a996a89e926357a
- SHA1 a760302273c145201798ce1cb8adf90a11628cbe
- SHA512 bbb91eb0e40907513f4b1545adbb728aae8a783c2486ad0aad1f9a7612ce7c97215b56fbbd79fe21efd1070229fccdfe82c1ba17d0172ad1338725db9d2ebe3a
- TLSH T1EE015282FF892006E3C4D47A1EC44C4CB27248214EB30D8374AF4C7878A33DBE60A21D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Code Cache\js\index-dir\temp-index
- Size 1KB
- SHA256 907d4322a99872abc893b1d28d82123046636867fee395404c73e2389a97c9f4
- MD5 880d2da20cf006c1128dc6a4bef8c745
- SHA1 c7987ee3bc59ff9bb40185155abc2960f2d28a6e
- SHA512 2d6a16bd3a85c73347913b71e03d3f82b55c51ad3dbbedf59de56532e23cb7295dfcd4c4ba482810d559143a4f11f94e55929b9175c216b268ca4fef317e0e45
- TLSH T1AF31B680B6053117F7CCB2B809E98E1AA231D45904733F22742E8839FC5F79BE604A0E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Code Cache\js\index-dir\temp-index
- Size 1KB
- SHA256 39699b7ccc21b0d25c4770da5c46957ed45bad0165f159eba7875dd580b11067
- MD5 47ff6804c5aa6592e3e72f7821f2fa6c
- SHA1 d27f1cbf18ebceda59bf4c5766964ab33910dad2
- SHA512 7ce96fa07f773bc79448b0e840493f3c01e07d0452cc6141d9d4039b8b4a43ede2f8e1e693f019cb4287001ed91ab6f1cba8b83194d7adbc5fdbdd0e3ec3cc86
- TLSH T1BD314845B644111BF7C08D7C9BDD8879B231A94109735E02B02F48F4FC7F797A60495E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Code Cache\js\index-dir\temp-index
- Size 1KB
- SHA256 b306ef0e9dc1d2bc5984a9e8ab2828c7b8b31b10b7bc0bec064d9aef792b83b4
- MD5 f0e0ef31eef068a385eb9f8f39953bb1
- SHA1 a3ce9e424a499915ee95fd66e59cf601a1cea95b
- SHA512 ee19653f9d73257dd0d8d662578dcf7cdef5d6f48b5c6c172c88ad59b521e97ffd33a09d79287f9e1917649b5e039f8b03fd755b787e07c80be8236940135995
- TLSH T1D2315783BE499137F7C4867839CA48E97271D9500DB31F867C2E4C76ED4B7D66E4012A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 5f984211254e9df5072b8b292ab3f8d6f980e0a76b3b63e6afec7821808e794c
- MD5 1a7c94ef214a94a948515d3b5920b07f
- SHA1 a2a8fe7f44f61a290d62115a3ec3ec2d36f48f23
- SHA512 09598fdeefe378133ed0bd6089cf628dc47100ff8ddf1521b5310bda254d0cfc4ffbcdf53fa453b94ded2090ec72adae856cd7f882c845de0515030b4d41cdb6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\ExtensionActivityComp
- Size 4KB
- SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
- MD5 9088df5de5b8306c52e744141a100532
- SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
- SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
- TLSH T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Network\2f4bbc37-4d91-4afb-9b14-b8f2ec8e284c.tmp
- Size 11KB
- SHA256 82da0fe59efd3d9601500f1a80b89655f3533d670923ec97a4cfcc25ae647853
- MD5 4b5bdc31e5ff6ec1306b095352fbcc03
- SHA1 d4c392db81210a24cfaa373cef17aa33f834c683
- SHA512 a39e34233c6db6d7c0bb71e1f22eaaec552509b7429b23e98e6f2ad7492b3ec225b5fdcfadcac19df5bfc969e86fbc1765a63e359837c6523929d7e288d23a2b
- SSDEEP 192:DhAeerwQnhi8VXge+aBFnnolEjuspHisfa1lD7Qqs4fQCaijOzkfBsVXDU0wPLOG:DhAeerwQnhi8VXge+aBFnolEjuspHism
- TLSH T12A329DBB82D45A5DC8315AF81B24BE1ADF5C0D2C461C2D59CCD4BFA7A7D2472E221A0F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Network\34070537-d474-4e5f-a752-fe0bff247ead.tmp
- Size 3KB
- SHA256 d917775a12d1454f9d57a1d7e903e0e25c1e59f4353fca25f7ad664c65afda63
- MD5 c1af194a0161e4f7634b6cab83c9b36f
- SHA1 1c1573fc7170611b1ea673151be7f25467498b8d
- SHA512 2e0794ed7e7de4e42eeb2adefb5b80a4a6fa2ccb73fb521394b6f05930f0f9bdcd61dac08c2081fba5179f5a59f8c389bfad9f73a6e0de4e0b2cf2f5b2a2d511
- TLSH T1B1616D9781BEB82B103D98A71D09BD496DFAF436019274F9DE77827D70824F72B12072
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Network\3b3229c9-47a6-42be-ad30-6ef74b02310e.tmp
- Size 13KB
- SHA256 26998afe68bf4c55604ac83551cd8ef96c5b9bdbe0f80556a62873247ac6470d
- MD5 1be3402de5f813d5ae715e9dbe98d3c7
- SHA1 a5b414b0a2282eea41e456de14743fd53905b9bf
- SHA512 f92bfd5a6f1bfdb072cecefb2076bb0cbd65ea17ccd3aefc0f1d014ed999c4daf3b37a280ca6dda543ac692613fa88fa52a391d1d37b21fa8459fa63f9dc681a
- SSDEEP 384:Dx1xVtqDNyQemOXqBJgeooPaBqwQjEsVRa9/l5ispkjqa0SsGiDflQ9aeSMeDiU3:5wjadF
- TLSH T17052AFBB82E45A5DC8215AF81725BE1BDF5C0D2C461C2D59CCD0BFA7E7D2432E32164A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Network\5d4a30fe-69f4-4e0c-a7e4-0569593b4036.tmp
- Size 3KB
- SHA256 08ed46fa10ad2e05c5e23e8a12fb5b53692b6aa6fa60a505fabd1b17e06592a1
- MD5 77c3b39ae9493932ede1c44382a41f43
- SHA1 9af9b88e319feaacabd057b998020d1fcede5db6
- SHA512 b2a0931d19732312410eb94cc66e2611bbe913742f714d9411628520de54112f868ed5f9e6614b39e0edf176a227259fbb7a39c80daebab593d2b41caf34797d
- TLSH T104617D97817FA86B203D59B71D09FC452DBAF836029274F8DFA7826D70818F71A53472
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Network\61d91d55-103c-420c-a7d3-0bbff173f517.tmp
- Size 12KB
- SHA256 80944a31e76b6058bc17799eab26863c82b31bdde53dec62c223e4e037dc6812
- MD5 1517f4b83fe2cdd00d8642b15e9ab4d4
- SHA1 6573268a47b4c83131650ce118c603ac6ba22dbb
- SHA512 8e29cea69f1f67196fbf255bc7fcf52fbfbd65e1448d8d32c45b775068d5553111b031b2adbbcd121f98f300a55258d2a9ccb015ad9dea34b816a532e6ce51e8
- SSDEEP 384:Dx1xVtqDNyQemOXqBJgeooPaBgQjEsVRa9/l5ispkjqa0SsGiDflQ9aeSMeDiUiI:5njadl
- TLSH T13742AFBB82E45A5DC8215AF81B25BE1BDF5C0D2C461C2D59CCD0BFA7E7D2432E32164A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Network\78b5d66f-839a-41da-8a58-93a74d37057d.tmp
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Network\79a764c7-25e2-4835-9580-9f508b46c9f2.tmp
- Size 3KB
- SHA256 f424d1284c84dda2a75a75a7d88da08f6b9324a6676479808b119e38c5573382
- MD5 937d0d1d47c148152c2faefe1a0e3553
- SHA1 2b3ad63e920d4ff8021f920e875956b2de106c82
- SHA512 dcf68356c04c7887c79ba032d726c08b039864a5ace818fc606d0f9e5ca4c49c5a3177c9abc4441b76421635c35fc4084a4ebcb2a0ebb4f6d21c077d3c6e6e7c
- TLSH T190616EA781BEB82B603D99A71D09BD456DFAF436019270F5DE67427D70C24F36B12072
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Network\7a0f822f-b60f-42e0-8967-3c5561451bdf.tmp
- Size 3KB
- SHA256 26d097c832b78c66173402b7ceb678a5102e6ac8da1ecf7790aa4432ced8f31b
- MD5 091544015c379609b063cca2e1b52255
- SHA1 b2961930f1c2659cbc840dead76efab835d8e53f
- SHA512 01d8072cf2324df9230551a4ac119256d688a97e487c8b36f4c5ebc7205fef4570c62e938963c622189c5dcc4843ac2fc183d78be657595229d6c192ddd40fc5
- TLSH T134616CA3C17EF86B20395DBB1D19BC451EBAF4360192A4F4EBF7826D71818F35A12472
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Network\9dc23954-95bf-42e6-8a23-0386572b606f.tmp
- Size 3KB
- SHA256 0eba0a95593fe4204b288ea46376a9dff5372a8ceba59850dbe33d3bf35b7750
- MD5 4dd1f76bae91aad8d4e8d66f0dcfd2c0
- SHA1 5f35c64e889038dee0264c139660d2bc228c4027
- SHA512 f525f524ad002694eb52141171f0814cb0257292b9d711f52816947f5149519eb8674ee9dd23b8e77871881058be7412b0bb92fe1dd25c00d030be87743b0d37
- TLSH T1BD616DA781BEB82B203D98A71D19BD456DFAF436019274F9DE77827D70824F72B12072
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Network\Network Persistent State
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Network\d85c6447-23f2-4e83-8807-f9daebd73a94.tmp
- Size 3KB
- SHA256 947e24dac2a094b6e6a71174e13d6f638b27d980d8aaabab6c6bf04b2443f63b
- MD5 b75914b83f0fa42b6bb1f2841f7ee08a
- SHA1 af7e4bed860d503d369de4f146203205bfb83ae8
- SHA512 718d89aacc3d1719a63d077d272ede8b3be01d0154fdad330c33d08707fa28deb57ee4c7618995c5383455a9818c7be1d30d13d2ffb5cc5a634304c0db5959c6
- TLSH T1BC615E9781BEB82F503D99A71D09BD456DBAF436019270F9DE67427D70C24F72B12072
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Network\ed9f8a41-55c3-4f45-a2dd-12f21d8fee45.tmp
- Size 12KB
- SHA256 fc15a0f77a14d907a551abcac4d2f96e43ecb5c8b7df60d28b0eddf7c72525ad
- MD5 2781013fc448ad8d64d26172381d234a
- SHA1 4743689fd0d58279d9ca71d3b835ffb10e30388d
- SHA512 203a8073ba03822de6b7bba229583c5bfc95896e49a569b710eb051a25e16142d43719b6bf6769e9dcaa9aee3f934ed627a77a3aa314f1ea57c3e50e9df8f998
- SSDEEP 384:Dx1xVtQemOXqBgeooPhMemqNDNIQjEsVRaeFN/6KS9/l5isHjiqa0SisGYl36IKv:5+jko6
- TLSH T17E429EBB83E45A5DC8215AF81715BE1ADF5C1D2C461C2E69CCD0BFA7E7D2072E32160A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Network\fa5a7447-4e6e-4585-a265-37b49dcae3ef.tmp
- Size 12KB
- SHA256 3c2dd03855cde56131d35f417a5b6f3c8aff239c4fc6ef0460c485ded04f4b6b
- MD5 c1665f39a6f01f6e1a9d5c808c401aad
- SHA1 31d384b01b6d3ad3597bbdc6a44cdf91ecda1a0c
- SHA512 2ceb7aeaea164fd55c9d0053da04c6712c3f1475df71b56a4fd3e47add266ec444378b248d716ee4ead543b63f0d52e326591e14bfd1338dbdc8e1b341b3171a
- SSDEEP 384:Dx1xVtQemOXqBgeooPhMemNqNDIQjEsVRaeFN/6KS9/l5ispkjqa0468asGi7clG:5QjkiZ
- TLSH T10F428EBB83E45A5DC8215AF81715BE1BDF5C1D28461C2E69CCD0BFA7E7D2032E62160A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Service Worker\ScriptCache\index
- Size 24B
- SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
- MD5 54cb446f628b2ea4a5bce5769910512e
- SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
- SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 72B
- SHA256 b66ad2d285d90ca0a3354a0d90dc55b70980d242d85ca95e2054d8043a602a3b
- MD5 cbeb1849ad2894a1b10e7baaad979914
- SHA1 81f003b159ea852b45cb70c38503d4eeb9151fbf
- SHA512 8977f8716005466022c5b6219de1acd76763793ea220f76eb95ac4036561beb9fa297f63b7fd750628457171df9d2e290ba94ea8b56e99a8e98dd485b665e107
- TLSH T132A002A502868121E54016B81C8516DD637099365111120192D803F69D512718121540
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 48B
- SHA256 7e900da62ee3778ea05d414535c5d711e1e6861565294bad533917f780ca267f
- MD5 814b51f6b18eacfdb801f67d9706c5a8
- SHA1 adcd83a5623c6c7872df025d38bc79419623b59c
- SHA512 dc599713f8fdcab190f383293b8f09b3ba28c7f90a9addfa755eeca8a660ca623d58e735f347ee8a02c70331f6ef29a615511c68cc6276264624e89ff49efa14
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Default\d62e7b31-48cd-481c-9f89-b04c6eaf4c54.tmp
- Size 7KB
- SHA256 cfb95018a00a171c567998373138bd7e2d3089a0b134ea08f56fefc287bc640f
- MD5 1d4d62ebbd6db358ffde9d699f46ee95
- SHA1 f63e3dfcca1612e3c16dc689ed718f5fc392ebf7
- SHA512 378c4ee48bbf2c057c78ee771d13cc5f0b243191e391cefd9e88317f874eb2788ff76f4fc63e94811bbc3eec221a5ae78634dfd902f64fec893fb8993a885a0c
- SSDEEP 192:stejFiomQsV+FNAu2+Iu0gIyMm5IVI8I8DRJKqG6K:stejFJsGH2+pB6VLVK
- TLSH T191E1A7136D7869BF0CCAE125F664F72BE2EA502265E10E95E7FC892C04DB6DC6203C47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\GrShaderCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\GrShaderCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\GrShaderCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\GraphiteDawnCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Last Version
- Size 14B
- SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
- MD5 3b746b6e8b8e101ee7cd41df1bb565d0
- SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
- SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Local State
- Size 1KB
- SHA256 8ea043455cfcdd10f90d410d989781adfeeb5c44588ab1a637697c723aa318ab
- MD5 36c6c3259adce58b15c9cb0999e8cded
- SHA1 6cff7b3ca8fe4fe2dbe336f7d8f2d811cb78ab9b
- SHA512 0d079ec6b40f02dc2a8e1442d3897a39891fa15fe01b59399f3a29f21e03360e3cf6f6aeedde52a6e4fbe3346c245e2c3b761258ce176b98867d366789208fec
- TLSH T1BE2165B3E4645732DC976356A143BF1B9EA111A692618E0090EE4B3C01D315D92FAC32
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Local State
- Size 1KB
- SHA256 17f0e11a9081ec50223dfdc15d026c99fb12f508abb430fff0306e57e80eb7c2
- MD5 b2c93aa219454aeb7c060e7e69b0ed7c
- SHA1 e0334ff2c91c00903a015282936b5a08eaf6544a
- SHA512 660cb6eac676ddf121ad121ab54c300d6ac4029d4cbb679eca211daca19731450a49168b013625af7256160b099f1e235f6e8f6c4370a4f655d130fef6c83aea
- TLSH T13D2195B2A9645F32EC61E75A22157A879E7100D7C2625E0062DF0B1D01E344DD272C3A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Variations
- Size 86B
- SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
- MD5 961e3604f228b0d10541ebf921500c86
- SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
- SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
- TLSH T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\Variations
- Size 85B
- SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
- MD5 bc6142469cd7dadf107be9ad87ea4753
- SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
- SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
- TLSH T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\bb30aa77-20f9-4427-b6b2-5d3ba9f12b48.tmp
- Size 2KB
- SHA256 68e1d306c79d1a1cb5b380c7b2bfa3f3d2870040e329d2f749463a98864778e7
- MD5 0e703dea9f6b8395b6f591ad298c7704
- SHA1 029eb18422cbbc15bfb02083548ea51e6b2f8e25
- SHA512 f4ef33635f94caf59932330dd8dd46c3127aaffc1390f78395e4768af0db6a442f6b34b0858cf023126c191611d2a73f10a29d394b0265ac71d394cbef90f662
- TLSH T1B451A5336C18AE37C9B2D608791A3F53DA795192AAB32F1196DE0B0C01D794C1382C3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\c6edebd7-33b9-4022-afd7-7468e22df0eb.tmp
- Size 3KB
- SHA256 ba3418eeabef911d3f455f155e5196c526c193c725b7b515e6e617aa326059e9
- MD5 4a55e3ebb45d7c9d96b69217dd833a82
- SHA1 6ac298064a53be001d50cc94e4ae7ca65a7e6f09
- SHA512 6ba49a84e47b819093e5f1d0b5bb365e1758690353927f10246da757e4a02e66575016b4fe3f9ecb4881909252820df1d5d47d195b59f4ddced7b37ac6770a3c
- TLSH T1B56194376964A93B8EB2DA04B8863B07E7A55063E5A23F95D6ED0F0C01D768C1382C1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\cdbc2e90-2c38-44c8-8fbd-a2337e8f7809.tmp
- Size 2KB
- SHA256 14671a679a23f82e845cbcf7738ea9ca7ff2e5b7372efcaf3fa75de393c7fb5f
- MD5 f9bf4c9a6d5ec98140e99d754cc905ca
- SHA1 49da20ee42135e8e95963376bc584f23e8527393
- SHA512 844da75ac9f6489653edb14ca363b4cd0233daa54744d6e0f9fa85490ee04fd2fcf1fc312fd3b00c3a49bd5e08397d30f6b5dfbd4f26eccc215e1967f6461f80
- TLSH T11C519433AC14AA37C9E39B14B9463F17CABA51A5AA622F50D5ED0B2C01C715C1381C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\e3df965b-c82a-48cf-8096-2f43258b5080.tmp
- Size 3KB
- SHA256 88fe3e19dca47bc18f013f02fd8bdc51586fc0f242b73fce1a9948f44449a0e3
- MD5 21c00a5874f34950a3a2e07bb1c3b590
- SHA1 b287ba0a077f5a23ab827c56d19bac7346837847
- SHA512 390053c4f3a2bc5d7fdeed5bf06043ee2841e38a7421c22675585afa0dc62eaf4fdc6fbe038206f658cbe7c6d31fa79f3769700399afd0dde1bcce2ff5d86b35
- TLSH T1DE619333A964A93B8DF3DA05B8863B07E7A55167E5967F94C5FC0F1C01C72981391C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\TechSmith\Camtasia\WebView2Cache\EBWebView\ec2ddbc4-ffe8-4ec5-b290-2ef9d3cae6c6.tmp
- Size 15KB
- SHA256 7ebdc3e23900d68381728059b193b40eebe57469d08c40e135a92d25b0be9893
- MD5 88193222d5c7dd12306cbfc44f00eba0
- SHA1 b272f8994b185e99f3e7acc4931ccb2f172989c5
- SHA512 fbedcf3f0d00246175f16141f34b888cbab48ac816a47b60e0ac24a842ce5231f1c212db72c77c94b374a26c435f879b3b74bc5aab51761423a38c74611219a3
- SSDEEP 384:P+OBqImmJvGBLx3NaFMJFNNBSiIIi2Mkyg6r/:OcvGtlNhP2kUT
- TLSH T16272AD771C656A272CEBC60ABA8E770B8B656293C4D17BD4DCEC9F0F116B0941392826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\176620e4-1b38-4ac6-936f-34e779d061f9.tmp
- Size 242KB
- SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
- MD5 541f52e24fe1ef9f8e12377a6ccae0c0
- SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
- SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
- SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
- TLSH T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\220066df-b5ff-485a-88b3-5de338399072\f466a932-af45-4a61-9f8f-f703590002bd.tsctemplate
- Size 1.4MB
- SHA256 96fe540b699415fff0bbd302e828015c41bcb9b614c129b077a81f166d76cc96
- MD5 322eae74da167c8f35c728fb3bb17c00
- SHA1 869d96c80bae3b72ac32187bf12ede15f8c78cf2
- SHA512 216d40fa822627a724d03ab8d9470efa1743c15cf1b060a0e3aadea716faf55738561ea0eb6505b3061bd3650a0238703264ece34e8befe0b831d66525b2d168
- SSDEEP 6144:6Wry4ejPJi8aYIaB1Agaw7wJ1HLWoFTPxMOenUqIjYB/8dKTgzuNdYDHuXMR2f:iPsaBeQY5NPYYzuwDEWw
- TLSH T16B65A564D0540D2780B3D33E6BA05E4AF6B76F1B65871D04BA8D4A9C3F3F424948BFA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\220066df-b5ff-485a-88b3-5de338399072\f466a932-af45-4a61-9f8f-f703590002bd_Template_Preview.png
- Size 1.9MB
- SHA256 c4f3cac2d3b2f2c4771ba4d7ac984e5ba94098473033f66aa0a518870978df83
- MD5 7421dc6531c8c6275d69e99c2b02c7a5
- SHA1 705674f48c44ef9bf04badb44cdd12c47f9f3d99
- SHA512 7e6167a62bdf82478d8cda583cdd1a46f9f0c655cc9db667a47aa7949ff7297bbf436712e6d067cc596def94a14cc94deae7a9e6351773d25038c0cd9fa9021d
- SSDEEP 49152:uUfG/LqY1WqbvwwBJkJOIGZvJWxjDQFDmWmADs3:ueDqbHJWOlZvJW5qDmJAe
- TLSH T15895335398F672622F39F3488A06AB73ED21113177CD1DC788A4EF2112586E1395FAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\220066df-b5ff-485a-88b3-5de338399072\laptop-stroke-16x9.pdf
- Size 4KB
- SHA256 eba6f2597d2471364eeefdbbdf3ac97021e283f4e69af26778eeafc7e05c2d1b
- MD5 327cf4941ed27c6a8073df192ef13554
- SHA1 c00c7b5ca07e4baa2450c4785c7223c2950eafac
- SHA512 925d05c48c385ec3461de70548f2ada1f84bb8add1e50ed4da6ea151be6f2943811069cc6a70224274c5dd6dc08d31a851efa7b9599cc39d98756a94d3afea5d
- SSDEEP 96:PJHA+nFrNZLahw144GRocIhp5VV8xRL4n5h+:Pu+nFrbaa144GRa/dcR0Q
- TLSH T194A1AAF2234206D4FC16CC47D636BD2C669C30BEDDEF00D4D6F2575A2A926A8FB09564
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\220066df-b5ff-485a-88b3-5de338399072\replace_this_clip_wide.png
- Size 794KB
- SHA256 8f76ff6176e7838c53a317e9f8b1121eadebf13af4fac760d7710bd5f7871316
- MD5 1782a4fa422821d3bc09c47873c338c9
- SHA1 9e04ceb6a01c1fc9ea4716296074732539455c9c
- SHA512 e5ca95996213ab8cb7b260a6417b02ec4a143956506f08699727521b13e2eb4ca8e0f87578adc67d93821ec5419c8381d838c28b637ebe21255deb2365a99d2a
- SSDEEP 24576:lPdAQi0qWkGuVnLEKtaTg7EixF041Arg+Vde:7DrqzLL7tR79xFUg+VQ
- TLSH T14705334458B427D31CF1148F7151A2F6E237EE692E5683F8EA972D74E188839C923FE4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\220066df-b5ff-485a-88b3-5de338399072\replace_this_clip_wide1.png
- Size 817KB
- SHA256 364355667ae832dbddc89dbb3eef2b9d4c89363923815dff01e6e841c166ce8a
- MD5 76ccf00471afe9e3ee02fc605ec2c25b
- SHA1 a1470bb74c2c8be4a32947c8d741a59c419ad0d1
- SHA512 7eb3da0ebade61321856de7f262dfdddd204b23d9063da390f4caa835f61caae271f70d232bb6492eff8cb06672bb3e77859316652cb3b90f0bf829e1c7fd813
- SSDEEP 24576:hihrzpN73+JCQexx0xFf18aLzj8FAF7+Vbnh9Q6:hy7Ovexm7dF/jpyTB
- TLSH T1C405330C184FE6FEFEEF1B88705656DB303654B26551A5BDF102D43D2BC0269A26932F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\220066df-b5ff-485a-88b3-5de338399072\replace_this_clip_wide2.png
- Size 770KB
- SHA256 46f7967da2b02057eea0b337bf3de0bbee0cf9252b8c1a205b15aa756ecb4967
- MD5 8708411132f9fd2ff825938d540e666a
- SHA1 4098948e0791e09787cf38115fee10d7d22fb0ed
- SHA512 c5d6a6a49d9fc47625cc2e64d14c654a5da4355092850afc035caaf2c2206c99348d104f22c62082c858a1dee691db5e4abbb9eeac037ace6c5c0a41b7fc88a8
- SSDEEP 24576:c5dTxIlrFaXx0h43nRtu+htTc28YeKcH2:UTxIlp8Q4ho+zTcmec
- TLSH T175F433079AEFB85897CA76ADFD68934E45EED88622759430B40CD3847DA38F8CDC5305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\220066df-b5ff-485a-88b3-5de338399072\templateInfo.json
- Size 164B
- SHA256 2a4905ec5f14892a0c2f5f6297a49409faaf38b4410a03977f588c87d5412358
- MD5 d837eb2829e8090ad6e5225c1133a091
- SHA1 ebd9c5bc139f7902769cd1b2d85de3fe57801cf6
- SHA512 bcc42e2880f46fd045b4874d54469d0f3c5a3781cbd1fbe7561390670a633680e83962e9dde0e0b940a7a6c637174cdb88f06e1f5d4acca4f6da0f2e08cf88b9
- TLSH T152C08C2318602013822407F111B9E252AF705FFF5220ACEE38B7985061B26BB16CA300
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\23534fba-c208-4865-b45c-4b453470642d\Placeholder-888x1920.pdf
- Size 54KB
- SHA256 065717de4875bc24bbf766925eb025fd95a1a1eabe227d364cf268103d6e9a7f
- MD5 44d513f81050e55e800ab7c29ab3ccd3
- SHA1 39ded18fdce4672a00af67d621d322f70300a273
- SHA512 5081c0f877c6c841b7577eca66a17ac828e987a09e556c49e26e4fb761a45621e4b4a19f3062951382f9905c39fa56a2d04d1892e4d21aa1bfd7930114e68749
- SSDEEP 768:j9zxJ7IXAIZxgomYuyS6A3vD/4IoBDSgjMRcyYdsS7307hngbg2FbdoVs88r9ANf:j5oxgowKcrJo1m07McgwZl9ANf
- TLSH T18943AD50E1998C5CF852C240D53F7EDE4BECB17762C824C19C3C23A2681BA9DE5A7AD7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\23534fba-c208-4865-b45c-4b453470642d\ec1c625b-6326-446a-8217-34f7f5b9d871.tsctemplate
- Size 181KB
- SHA256 79d61848fdd10919d04b6b8c98fa71c95b44a091d0cd8db76aa77754477f7127
- MD5 2f7cff8e49447611c99c05ed82fa7e15
- SHA1 a47c2f40d70f0bc87449ef64ed8450e21440ffc2
- SHA512 6e2e4b4bd246e4efe052ede223069f630c99280797ba1dcafeb974c36eeb23bb186e26cd5378936c960c6cc8804d129f1e3ce24b778926a143d06cdf413aa810
- SSDEEP 1536:EbX1/vNWo/NljiKRXPyERNCFbIT/HJ0hqd/cUHqqCL:Eb/BNx/HJ0kd/c/qCL
- TLSH T12704E729D0540D2780B3D33E97609E46E6BBAF2765471C04BA8D8B9D3F3F521848BFA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\23534fba-c208-4865-b45c-4b453470642d\ec1c625b-6326-446a-8217-34f7f5b9d871_Template_Preview.png
- Size 337KB
- SHA256 f1b4670f5bf052e03c0c4f9a41140714117a3a5e39db13a91dfe7d30f977c70d
- MD5 eeab1a9fe92dd0e5c3b48674e421a57b
- SHA1 b30e633210da1b882e70777d62f7bbb1881c3490
- SHA512 b675a7069ed7bde13222a7309efca85a396f5353e99d6009be5b85906cc44e94384872555f3a3187c7638d5bd869673d9938b4d0fd2f2dcdc72788dac5d3c5f4
- SSDEEP 6144:6XJXiQHspz2ibKBEXiqIX/9TRXXmyX9vh+1GFqokQb3BZHBaCIvb8wlz:Mcb3k/FXFqTQ7HYt8Q
- TLSH T1CE74F077D8381B27C4BA337245811B9A46317EED017D70291AD57FB02B3C9EE39265AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\23534fba-c208-4865-b45c-4b453470642d\templateInfo.json
- Size 157B
- SHA256 9f58ad90d1caf98bfcdd2231206be778c3294d79b8a93501a3c26eba8c950928
- MD5 7e38300a09f82e681549362de606b4b3
- SHA1 7cb6e93f9de37361ce204fcd8a2a5e8ab46400bf
- SHA512 21511b96242683b65a489e69f254105d05d999d38188d6069bcd80c8c50b92706b5fa019350c70a2bba12b903ef282f888d0e0b738545ebff7b1a2512024b70c
- TLSH T139C08C134119102708780B710435E24669A5DFEF42A0FC4A21736DA80AC2E3D50C3308
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\70c55acf-713b-41be-930a-6cd70f116001\cd2c9f07-a917-48ee-b7ed-f2ecd49cb622.tsctemplate
- Size 976KB
- SHA256 05306ff5b6493f1067593be271ba79a754e758a3a70bd8a690d09198279e5f0c
- MD5 a2a67464497a1cd7bed8049fc1927b7e
- SHA1 f1ee9664de8146b88af42e87afd4e2aa80a6b912
- SHA512 35b1fbce06ac1fd5b208a25d433054f3e98aeebe8676716a0cf4e30ea6ceb81aefeb0d291078fad7254eeb80450bd166bfca48b26e1b116a358f9ba63c9d92da
- SSDEEP 6144:C9zLIpT9rf4hd6DPRtJJoL4VHu7m/R9M9B2Ke4XDvfN+kzH:EI9hssCUVOapMjkk7
- TLSH T12725B429D1140D3780B3D33E57A08E4AE6BBAF1B25471D047A8D4AAC7F3E521858FF66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\70c55acf-713b-41be-930a-6cd70f116001\cd2c9f07-a917-48ee-b7ed-f2ecd49cb622_Template_Preview.png
- Size 698KB
- SHA256 32069b1e5626a42851c02144642692517fde2240550155d33490f41a16b0bd24
- MD5 903bf911f7a3ee01275ac985c26212ba
- SHA1 d12a2bb8196ee49117fbc563dbbe0655927fe4cb
- SHA512 252054d29701257bca467a4b351b0cf703480b03c3c0a96f301bb71a10b08e6e88a4d1018db48ccf73dbd4d66efdc1b7181135e0d50cdca34a3dcb1b32a504dd
- SSDEEP 12288:wrxyY65KQ5bpUMyxEvmlAqsngbwo2UFdgs9sFEjx/XgltUFXixUMrzAdG0QhQCZp:wD64Q5SMyxemlFbp2UFv9MEBQYabra1Y
- TLSH T105E423120AF6FCABB996386BA956D3D531060E34F7EB58FD478D366907DCA727270200
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\70c55acf-713b-41be-930a-6cd70f116001\stars.tscshadervid
- Size 8KB
- SHA256 fdd58951e704ea47fd717ebb2772b7d3cf452befb407d9d36fd95b935deb4f01
- MD5 e3311763ce28b238477d0287a320798c
- SHA1 95d062cf1814c406b156b3f57b2acab9d1240790
- SHA512 b30177396ac1c807704997715ecf28a0e21fd95066309ab7eef95a545e4781d0b24ea4bde54d1548bf972dd0b4cd67d1635a23f3594ee74b4b67ccb307650b13
- SSDEEP 96:iLQxwt+M0y9mzt2mSi+iKJvdJ9owyg0aDwx5:Uyby9mkbBXJvnKz5aDwH
- TLSH T1BB02E05BF1944DB26E467A643AF60102726C30A78C297D463F4C852DAF0DF1DE5B07DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\70c55acf-713b-41be-930a-6cd70f116001\templateInfo.json
- Size 158B
- SHA256 c338abdf60c701d2323bf20467059167db0c0e4cc50799f7560a74e58862363b
- MD5 b2e262a8ac2d26009b25353cc36fff3c
- SHA1 d46e8796cf5facaa45350a03114b42f00d90d01e
- SHA512 ca6f5c429b96e56def0b92199430e38ee67adce29487c75bb48d9fe53617886617aa9c6858092460c1f03275837971d23ff79f50c61c7610cc87693eb56f5be4
- TLSH T133C08C270104505B0CA40AB08ABC620DB5A14F4FA1A3CCADA1B7A46112B2AB90AC2B24
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7130e848-a3be-44ca-81f6-1acec637fa29\05e47892-deab-431b-be15-a7ca8e748e67.tsctemplate
- Size 321KB
- SHA256 38f25f06cbc3469d34a25e252d7a4c16250a08d2232c9ec1d816bdffcf40afed
- MD5 6e1318427e2af76b4fd9f7f80ffdeb99
- SHA1 08f3acfec19aaf93ef762fdf0ab08ee1d17f779a
- SHA512 24c4d7acb332ef8b2d6c12b7763b9ce45c72d9ada3427141276a83652fba9add30388a846ccda55cbee8b113c9d023550d73309b8166df387d6d6c23dc2656f8
- SSDEEP 1536:Eb/0zjWsL6IwslaIoYubDQssbh/wzIc82/aD/CtQkOgdlMvc2ISDbi+YybKmZN5B:Eb4HcebCtxldVgbEybhIq
- TLSH T1ED645029D0144D3780B3D33E5BA09E46F6A76F1B65871C047A8D4AAC3F3E824D58BFA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7130e848-a3be-44ca-81f6-1acec637fa29\05e47892-deab-431b-be15-a7ca8e748e67_Template_Preview.png
- Size 493KB
- SHA256 0dfbe0b7b2fbd5607a9d6a9d0e8816a02ac5044fad3fad2bb890f9cb3fbfddef
- MD5 db530634c16a8dc50d7f87299a11d7d1
- SHA1 f32d8f6d84b687146457f052ebed47fe7d706eb0
- SHA512 80933eea3ee459650dd5061b92b0c1c5620669bc315d7b979fc9c63b0602e308d3ff7abb3223eed8dcb932d40155b64aa8efe929af730ab529d57e3246c2667e
- SSDEEP 6144:wFnPT9bNUOfLSfHt+n+Wz17Y4C7cQ9LomUdtGuzH7XqWVdTaqeZKyAuFVRtWrlno:iqOzag+Wz1s4CLoGuxVdTaqeAyIqz/t
- TLSH T153B4231EA4CB2D9CD4F25F10B474075264923B3B7A40AA7C9AB58C28BB3F0553F94BB5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7130e848-a3be-44ca-81f6-1acec637fa29\IMG_05121FC74754-1.jpeg
- Size 967KB
- SHA256 8960ed7026c077ace6564d19c3de1f5393a6082f6e45a8f92b5d5da55820da14
- MD5 1022483ff690019d5a9c0baf6cc6ff9a
- SHA1 f12814cd46cdcd4db2bb038c87314ce3b36ce5c7
- SHA512 92f59afd58503b505703601da139d50250635c1a0df224e914d37a9b818bbb1f670d450d47cecf45f50ff1e214c15e37541832c372c95ec47e9d467d4344bd54
- SSDEEP 24576:fotpC3aw2JU7kyxtpCpEGbxNqVzgXkxwT329tpALlIKmwQR:fSpC3awsaXtpePowTG9tpwIKTQR
- TLSH T12F250262EFD3F3521B2F52B8846E3E17038417D940EAAA89011B1E993AD5F935E53C7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7130e848-a3be-44ca-81f6-1acec637fa29\radialgradient.tscshadervid
- Size 2KB
- SHA256 7f6b2bada54425b1cc008f2949664616c24a97da3a127e1e13533c2d1900fb31
- MD5 94fc071428953946fe7f70cd25b2514c
- SHA1 d6c32523fd95b79fe664a88ebb4a813966bbd1de
- SHA512 3e9034212b9a5cd5d97d4c4ec0697bc1e0fce7f8a4db9c2a96f116a7c867f42cd27f16de1ff589edd3a3f118228f8a6ea95358f0a1ed66197aa418cc9cb63051
- TLSH T11F41DF6BF1945D729905A81E29B730122265B1A38CE17C017B4CC25EDF0DF0EE97978F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7130e848-a3be-44ca-81f6-1acec637fa29\templateInfo.json
- Size 158B
- SHA256 a5eeecf0a7ec919c7160989af40dd18aa282a9613e3269b68e15bfaa3fb36ed6
- MD5 ca20040aee8fbf067c64398443244abf
- SHA1 6e3f338a30e0265fdc5c67fd7c8635cda7e76978
- SHA512 48d52aa00e3b36c204936ce4da0ed8ab0c37992959bfe2f136313b68624a5516944bc2828bc061e0af7b80fd4b326ba8e29ec831d0ba2cc05419786d7fe76903
- TLSH T18DC02BEB434440A3883147B02A3E734575F44FDF28708CEB223316D0539273682D5319
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\73c63c27-04cb-45a3-a59d-bfe8b8c09615\43164729-fee7-4ac3-ab6a-a9a65524b630.tsctemplate
- Size 558KB
- SHA256 3db7639471333ff208a73f955513883e6ee8e3540beda8935b98ea58563d591a
- MD5 3c3b191cb7bc38ccd3113f8103f641b0
- SHA1 28fed083fad40c166008df8bca3f1b333a017a2f
- SHA512 bd109e9b59d74600f42b4e7e7f0d31bfcd138882f358b7375091379701da40fd6b18af53983236095ae5df56e3d4880c7708b2b268856fd6e2ff2d8dffb881e5
- SSDEEP 3072:EbgXZRLs8/lqK//TKGeH847q3iTx74s6qzPLv12Jj4YnuQJDQuyHDC0y8oA:bXTLsKnaF7q3iTx74ZsEvnuQJd3A
- TLSH T136C4C429D1140D3380B3D33E57A08E46F6AB5F1B26471D04768D8AAD3F3E925D48BFA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\73c63c27-04cb-45a3-a59d-bfe8b8c09615\43164729-fee7-4ac3-ab6a-a9a65524b630_Template_Preview.png
- Size 388KB
- SHA256 bfdbb0923eaeb69b5a105738b6ed3ea3be6016334bb3b6fb8f957a3be2b246ba
- MD5 3644eedd2f9666c862babe709a4b058b
- SHA1 95440b518bf948ed7b7d35c2dff0acff1203d282
- SHA512 843ce65820b161f10cccfac570615a22785b203aead0be6553f84a324d4b380e4b69970f89cfce3e6073826144f609c7a5c2b6d0ae9be615ce543d4059f43ee6
- SSDEEP 6144:laBkjemevDl2YU0cavPA7Jw2Oh7qimUqZyC5jJHP0o/31mT6Tp6nd+JFhhl2UQ:8geme7LVEwFg46jJcomTwpAYHzl6
- TLSH T13B842280BD5887F1EFD36B1A0DC3A8466C8DE1E53D4D981EA3439FE1F66268786814CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\73c63c27-04cb-45a3-a59d-bfe8b8c09615\radiallights.tscshadervid
- Size 5KB
- SHA256 226f8e50de310d745cbb6308a756acb4ccd8ee03e10a66d3de89d5e45c42b5a1
- MD5 e3109b99f5c4a6422fae5aa24598c58f
- SHA1 50556a926498afa8773ee55ca81255b61ec51b36
- SHA512 b3484893302982bb857c77bcec05a4598b1dc55627e8fce16b19580b6d5dcebb84326b2822e328f190cbb0d6e5c6b507e3258e30856dac08135603347269a896
- SSDEEP 48:4gPgkKkOA3OKwbrLWPi/3yNDHO0fMIvDoYl+Pwl0iZSZ0vbHvaniY1oWoZIMGZH:pYFnWPw3uTOEDoYaiZSavrvaD9XH
- TLSH T19DC11217E1A01971DE8BB9646AA6210223A930E34CA87C5A3B0C956D5F0CF1E9CB57CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\73c63c27-04cb-45a3-a59d-bfe8b8c09615\templateInfo.json
- Size 152B
- SHA256 a514f60d0f0625a6af50bed6b9b9683b56373541c5625117b0a050d050106df6
- MD5 590f130da94ce16c35632f7c22d91a29
- SHA1 089ee5fb6d2c021c05116fd39f1a8850c5824ce4
- SHA512 77b1dd6e056e0ccd5208169c09aa9ac9aa0f0881c9c11e02097c5e327db10bae9e80e220c029025a1e673956d8ec84d36a41315cd44b77b3fe61994e84bb679c
- TLSH T15EC08C2A014411A399280AB1043C5302B4204B6E11208CEAA83B6A1042BAD3A05C0320
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\78d74522-9d71-4c55-be6b-c612c81e8537\Templates\Elevated App Demo Vertical.camtemplate
- Size 15.1MB
- SHA256 9a1c62cabeb14a82bd0acc0edd0be1977a792025db365753d6d01d443bd6710a
- MD5 9c1e8d846d8d32bc4b9a71004645c49a
- SHA1 17b6b61ad62f1d31c2cc0bd4543015701789660d
- SHA512 130dde68915d8689d089049772f30c8f4ed3363e008babf330eb11d7e88443cabeaaeef0af5278faf43c474c06473655a4ae0140c5eadc9c97e37f7a34b93780
- SSDEEP 196608:Ff1dK8iCwnUuLdGDGeYmzM1dPUraS9ako00XnK/LKLv1Z9hTSh1e3UOYydjp4e1b:F6CwnUUdrmkPmwk7aAKDrTSuEO/p4GQM
- TLSH T175F61265E0940D26C07BD3397750DE4AE667EF1B258A0C44BACD465C3F3B428D68AFB2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\78d74522-9d71-4c55-be6b-c612c81e8537\Templates\Elevated App Demo Wide.camtemplate
- Size 14.2MB
- SHA256 ede027524972f34cba2c9186a6675b592b0305c4bb9a80cd47aa379d38f00411
- MD5 8772429013937ab806efc8f50dd59c4d
- SHA1 b0a1f53ac808dfe18971a6b474dd0176e800c3f9
- SHA512 bf62b7dbbc8411882105194339ee06eae93d043d39b6db6d8115a93ce7ac6de65969ac5af5f8c520e791cd39dbba891563b9f083c6e77758e8d9c6c194b36ccb
- SSDEEP 196608:xnUuLdGDGeYmzM1dPUraS9akTcYdZOAqM/00XnK/LKLvUZ9hTXF9Z29/A1:xnUUdrmkPmwkTc0Q/aAKDQT13j1
- TLSH T116E61225E0941D22C0BAD3397751DE4EE667EF1B258A0D44B9CD464C3F3A428D68AFF2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\78d74522-9d71-4c55-be6b-c612c81e8537\Templates\EmphasisFX.camtemplate
- Size 9.5MB
- SHA256 e20259670bbfc9c3dcbe1363c70084bcc83987fba87a64784603fb00bc6a4c2e
- MD5 e864041d18d8d23c7ebbf999d3544b0c
- SHA1 a953a9062b2a796576409fe72ccc474d73ce6034
- SHA512 ccc30e5ef3bf1c4fe2284e4b3cb5191361528a8c23f98120ae5a2a7dde34e894d90e00191cce322b761c447309bac109b9557209cf2069c44f1a66d236c1c46c
- SSDEEP 49152://w1AyUq+XXXcHupaRvB82MgWb3QRrsnScwvS20:w1RupaRvB89R4rsSe
- TLSH T108A6B429D0140D3780B3D33E5B909E4AF6AB6F1B25871D047A5C4AAC3F3F525C58AFA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\78d74522-9d71-4c55-be6b-c612c81e8537\Templates\Floating Screen.camtemplate
- Size 500KB
- SHA256 0ebe3758c7c1f3c4e145b38e8cdbc70f4511613d8f531618d9feed9d14e2db29
- MD5 a9e4511deec3ea543dd3acfee0679f4b
- SHA1 bd42bac94add7ab8fd6da4eb01ad5ca07fe00b73
- SHA512 f6c4716bb747e41a3546860d2fb67d2efc0dad2aba8df981e85e8c8069125cad95c9c5000e3fa825c827d4cac92b32620607e3147377a7772b5a74417ff240e7
- SSDEEP 12288:cspDOH3jBm+/+lWCSZvUnRYAIQ9Cd7KTq3t:csYHYFfG8VSwq3t
- TLSH T1C7B4015BE1890D239076A3245B328F86E6774F17954B0C1C7B9DC28E7F7F464888AF1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\78d74522-9d71-4c55-be6b-c612c81e8537\Templates\Mobile App Promo.camtemplate
- Size 1.7MB
- SHA256 b72e91d1f187be6db58bd7e255c2a4a04d766bcc0c20da142de04c404cf73bd0
- MD5 ef740c8e1b3255679d9296b5687e9a2b
- SHA1 224d98881120545d73e1674101e6fb27baebc0a1
- SHA512 2c22d58a966ad5302ce0691ea6094c61effe8b04dac9648b7f50767870d0d975b06a591dafcbe2c011d33aeee60ba3215e4ab2f1b338c4b109492bc9cc8d2906
- SSDEEP 24576:eaVx1oaQulr5pGAMFpy3agCJsLkExlHEpaG/znqDRsHkxwd329tpAlVIKGwQm:ea9lyAKpy3agoo3lHAZ4wdG9tpSIKzQm
- TLSH T10385E025E6D3DD2283779239576C2E06E2A71FDB50861C04364E0E9C3F7AE11998BF78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\78d74522-9d71-4c55-be6b-c612c81e8537\Templates\Mobile Background.camtemplate
- Size 234KB
- SHA256 2287700123d9a9f4b3f4734dfb3d4421cce03c916a59149a2191d11b05ac796d
- MD5 b685d516a23c74975d016e699893d639
- SHA1 8a41f4c1ffb00d267cf169060eac39c278b02f99
- SHA512 dd8b1d9b7333b36de2651face138fc3ea504acbf48553bd5a58f799bd6a9b89885088a610ab616984a5766f21e4b1670704d61dc6dbb661121eeb4d95ad04d8f
- SSDEEP 6144:wItGl1V8VpNn9W9tUcll0IQ/vK5kjYMUwjJW:UuXF+Ucll0IQ/vK5kjYMUwjJW
- TLSH T158348051C6104D7BB2214158E2532886DA928E377A81CC58BAFF790E6F3BFB95E31F05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\78d74522-9d71-4c55-be6b-c612c81e8537\Templates\Mobile Showcase.camtemplate
- Size 577KB
- SHA256 dc86dd462c5649178062c6a2d97ec95e2111eda1dc9d700ab380593cf2fd63a4
- MD5 b990ff1d1262a15aa7d47243b991285d
- SHA1 6a893384ef97147eebfa7596c7af43944581bfda
- SHA512 7753ab08905485511657e5ca3b5f0835eedcbc8022a01bcc61dcb51754048b2603a35c3b61eb502afb80426629a8916a480684222c852b43a25d6115b4b22ca3
- SSDEEP 6144:mJXmhXJXiQHs5z2sbyBaXiqmX/9TRX1myX9vP+1GF+zokQb3BZhBaCIvg8wl9CZA:vj0bza//lF+zTQ7HO+8cCA
- TLSH T1B7C4CF36C0240E2BC072A33947505F46D67B7F6B11AE2C04798C6EAC3F3E5E9A45AF65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\78d74522-9d71-4c55-be6b-c612c81e8537\Templates\Tablet App Promo.camtemplate
- Size 988KB
- SHA256 e892c35fc5cded2bb8ab748f2ff0ddac10a67fccffdfd6a7c21b6387864da527
- MD5 a6c882b40e897cbdb339b8f08b416f93
- SHA1 c935097c25340804b063c7340e348e909a529425
- SHA512 711f7633ed7787e23ab1de634f13c58cf53a89abaa27ebe8f910fa7ed3f0097689c0083cdbb811580f053e2070b27c93c6755e0abf061d1d55d6c600ebb377e4
- SSDEEP 12288:E5p2YYbUBrSQ8aJHxWPOovZOhTPiXozAiLDHFwK6RaeCuUcll0IQ/vK5kjY8pIqK:qwYY88aJHxQOyZOTRFlwK6Ydk
- TLSH T1AE25BE92C0200E6AD2729268D7433D85DBD76F276EC20C98BABD5D4C7F7E8695342F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\78d74522-9d71-4c55-be6b-c612c81e8537\Templates\Tablet Background.camtemplate
- Size 729KB
- SHA256 bbbf6256b9a517cc2ed7d825ce5005da65585988fdab9f7ec60dfd248843fbe5
- MD5 af48fec2fee01bc6cd33bcd1fe9a2429
- SHA1 230f73f9187a6d983c1c5231ea4d725f3b88500f
- SHA512 9b8ff7e33967c59dc5b85740c22be9667b5885fb97d218a835d8bafc50c0c62419ac8ead9b5fdfca5fbe6b6857675d52a52e678970c9226bfe0f50328b76cbe6
- SSDEEP 12288:PB6+Em1FAetacC/Ouf6CajFulRbk2B3jUcll0IQ/vK5kjYTpIq61KUgBKXZDfkRw:Pg+VacC/xf65jFMb9BK
- TLSH T1DBF48C91C1204EADE63292A8C7537D89DBD78F176EC10C98BABD5E0C6F7A56D1302F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\78d74522-9d71-4c55-be6b-c612c81e8537\Templates\Vibrant Mac.camtemplate
- Size 956KB
- SHA256 d39d5f29d2990b8ab262066f7a4fa15558043b40a28f73842fa903545d8d1384
- MD5 635cb84b38be51ac9d4ed24afe2c6d3b
- SHA1 20a73584387ec291ea9725e61c0c740d28a94873
- SHA512 d213ef2a6025b17503380354f95fd2da8176aa9df8e1da87dfc0904ad33315083bacde125d3eecd08396a2296ec9bd6d1ba9876e1186b42c782402bab7cce4fb
- SSDEEP 12288:QsDhEex74ZlvninEemu7Lx2wF4KwjJcWmTwpwYHzlQ:QsDhEex+lf2Dmu7LxnqHjJctTwlzlQ
- TLSH T129259D25D1140E3380B3D33E5B908E46F6AB6F1B25471D04768D8AAC7F3E925C58BFA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\78d74522-9d71-4c55-be6b-c612c81e8537\Templates\Vibrant Notebook.camtemplate
- Size 1.7MB
- SHA256 7f3d71d08e7ddf32ff1eb5d8280e0c59b67e76d7dae4802dca56206464305a1f
- MD5 dc959aec34046c40dd21bfe987f8a799
- SHA1 84b2b60e0ccb77b63e2e3cd2e69518d13cd276d0
- SHA512 841dc123cd8a1123283d8b6878b728023d1fc9ce258f7ca60cc3b93e01e953396f40b1814bbf83ad1cbf9fd19adc57011d7815eb6b24e71cdbc74befea6e674a
- SSDEEP 24576:OGRlZklH6OQjksyxeglXbp2AFflE6BycOlrQ1u8ML:nOFfmbDglXbtdLByc6cuN
- TLSH T10A859D29D1140D3780B3E33E57A08E46F27B6F2B25871D047A8D4AAC3F3E525859EF66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\78d74522-9d71-4c55-be6b-c612c81e8537\Templates\Vibrant Windows.camtemplate
- Size 1.2MB
- SHA256 b9309a24db4755a3c1e1f80b0476a6debe71a1d9bb54745560475e3853de2090
- MD5 192d0ac283ad88a45f89641f7bcab9bd
- SHA1 389f04d0882307b986f7644edfb44f12f50996b8
- SHA512 307a6184009a03c50c949edfeeb4e9a9cae6afb229c23087b1810269f5981ef685f84eef2ba297759baf89e8827118bf63e68a96c778864794b174fccca8a7c1
- SSDEEP 12288:Yzu41RiznUs3jH5DfcQ2EemRVDJJIkarl/hFzDTXkAO8+G:yRizUs37aNDmn2lJRDTrx
- TLSH T13F456B26D1140D378073D33E67D08E46F2BB6F2B26471C047A8D4AAC7F3E925958AF66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\80ce3217-e9fe-414d-a5ac-8f5018530f80\7d23c4fd-2923-47b2-889b-cee2ff951780.tsctemplate
- Size 322KB
- SHA256 18e1bf9513d4c5e32be469cd864e4ba5483d85b6eebc9fb4a9865d093e070d0c
- MD5 1c33fa4a99ef62d751dfe9656c795d91
- SHA1 410d8dcdf25a7a64e6c8a5060ff0ab3cd3bd98e4
- SHA512 daa9f5ba050a759f4eeab5aad588137b42700ce491b81005bd5f81455c5c0b3b71e85f5594935517a77a3810b6c63216256652d79ba609f2876886bd3080330d
- SSDEEP 3072:EbnjvsmR8yNqnit9uMaV+65uQtiDeur0BARV7BB4ECcGYfhI0AqSX+pGzg:sjvf5h6tiDEmJB8c15I0AqShU
- TLSH T19C644A65D0148D2744B3D33E57604E0AF6A76F2BA9472C48768D8B9C7F3F428948BF62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\80ce3217-e9fe-414d-a5ac-8f5018530f80\7d23c4fd-2923-47b2-889b-cee2ff951780_Template_Preview.png
- Size 320KB
- SHA256 e28b41fec9609668dbec6e0a4022d9c1b3236e2a8d060f121785a9e6c4b80306
- MD5 d7c9e376b41492ef483ce523b53d42e0
- SHA1 b0a81c535b39a603e6410f44d4580445bb86ae90
- SHA512 bbf52208f451040abff5571fb0aaae07da7ff6a71d33fe76cb3a9ab3a1a2d59954fd194ac2d8976e27fe74a7dd56b5d1fb6e34773fe9e16172ff39aa0feb0bba
- SSDEEP 6144:Rftacqx5VOp3jN8bwF86CuKchjGF6yWSln4/w9AKr28s+RBg7EoDN:JtacqpOuv6CSjrulNNbBpo
- TLSH T1BA642313093E87F8D04BC17425D3722CDA67DB9057947C979EFAEF814B7231642AB82A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\80ce3217-e9fe-414d-a5ac-8f5018530f80\templateInfo.json
- Size 159B
- SHA256 b0f94c654ab974db11d009b489df5e95855c2f7e5ee2810bb152cc4bb1c470da
- MD5 08825151e0b4813cf22da8b6041850bd
- SHA1 2fbb7baa86e4cb8f012dd7adb1e78dfea4a9c5b6
- SHA512 1834bcc092043c1e4e7fbcc7782ed88e6202da45c31c93bcfd80dfaed0a33c1ec5a8c0719d7b0efadc93730cf50b7351142d5336f6b8e24560eea8715cf6e26b
- TLSH T178C08C62136810738A3207750038A263F12A8B8FA1606D9E38BB36504940A2700C3B18
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\93be51d1-ba26-4a07-af66-ae983eb20e7e\Burst 5.json
- Size 2KB
- SHA256 361d556cc2c41ad91407bc0efade049b8b284151690648c2b48dd44eee16bb1d
- MD5 b7e100bfc85a97110ba6b435c169a224
- SHA1 e8e8304eb71817dd6803c3a5cbdc149936fec8aa
- SHA512 83abbe90f04c5c6d2620c1027ad8446138ea42b330c1c8d3d2ae759dd858fa7b832f1ad58f7fb43ba77c11d8fe4eaefc12569771bc4de33f06e20a1afcc51154
- TLSH T17C514BC6057103ECE61521A0CB4374E6DFC58899BFC905E6DEB64C2C8FA969E2702F57
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\93be51d1-ba26-4a07-af66-ae983eb20e7e\Burst 6.json
- Size 2KB
- SHA256 0a21442c4bf008612f1c8266e23774b42fc664cd66e8da37e052c126ab90d953
- MD5 572a6047b2364d291e32327989c26ed1
- SHA1 87dea9b2e6fe24c9730f4482e2cfb0eff495eb4b
- SHA512 bde60121e253aefb33d682c692d681c5eb78e1c82c9edb747e075ee065a1afb83d533e49027ac5f067529a80a71a5a8b6ba626e5ce6b2a1511af4ecbb71fc56d
- TLSH T19341E4C2057143EDEB162494CB4374D5DFC88C897FC405ABEEB61C199BAAAAD2302F17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\93be51d1-ba26-4a07-af66-ae983eb20e7e\d0ebdebb-6cdd-451e-b916-f126f97b4d0f.tsctemplate
- Size 1.3MB
- SHA256 ad572f0cf635a5c14b5ccc351e06b65af43a277d5f64edb94e2d40214a91abd6
- MD5 2f142ad1a1fb1b0c28fac6a570807181
- SHA1 8b9c7d137b6ca5d7a2529c2d7ff8ebc18671604b
- SHA512 97e877247bdd408f55fef295faf7d70eb64f5c0da7353a6af3250dca2d41346110adce6c3d37862b3090f936e0843e591ce57b1a62f3edc539df3d2c89c11b87
- SSDEEP 3072:EbDyHsbO7vF3BCaSptW7EBV1UrLT7ekTYP5AtyHhdlzjOthhLx:+yHsbO7HCntLB7I7xTe5TLlzjOr3
- TLSH T1EF551F65D0550D2780B3D33E67A09E4AF6B76F1B65870D04BA8D4A9C3F3F420858BFA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\93be51d1-ba26-4a07-af66-ae983eb20e7e\d0ebdebb-6cdd-451e-b916-f126f97b4d0f_Template_Preview.png
- Size 2.1MB
- SHA256 aff8fea0360047ad5cd5af0610cfed6a23c8f338cd59cb3912e884b886596c44
- MD5 4e57db1e1386bbc831d90b162600930b
- SHA1 c311b95d9cdf65961e0ffe660f4057bbf57e141b
- SHA512 32c152019ee20469c76f1e4d68793d9c23474958a6617256a39adb558adc6839484b51701715c33b72442fe5539c6dcbac1fe394287e6d28ba373d6cff7a02a5
- SSDEEP 49152:cKLMmnivq/i1eeoy+NsYrjWuMWYtPBWh4ai+pP/PGqJ:c3mlT1y+yy1MdClmA
- TLSH T1BEA5338D05EC29FAF44FD5A84E0A968B28A25AC4B4F64D8FDD2DC2253C7F47E5C76048
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\93be51d1-ba26-4a07-af66-ae983eb20e7e\electric-throne.mp3
- Size 5.8MB
- SHA256 a60bafbb3941ce1e9004270e427cdd8f880bb426b2c1d288063733dfe6fd8c22
- MD5 bd6cd67ba006b930db2a783deaf26a2b
- SHA1 0c1194d1801d224162d484e686222780e4e7132e
- SHA512 c2aaaa258be439db8f556a2759a23510796fae73d5751016d3132f0b49648c560835c554d8be6a5c4821fd35ad49972e28a05409cf2b2f57dfe59a24e0d44760
- SSDEEP 98304:r9MlE5/jlDAQp7Wr8mfohzEzIAGNPgiCN4c9UhGmJotaLrO:r96Uxp6r8qyEvGNPDO5cotaO
- TLSH T17756335B78C4A664E08ED670B587ED0EEC5BDC6A3D1E9069F6D903032071A2DF7846F2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\93be51d1-ba26-4a07-af66-ae983eb20e7e\fourcornergradient.tscshadervid
- Size 2KB
- SHA256 d3679f66b4c941e674aa732d0cb9b89aecdb8de14a3f2400b0c949b755705f51
- MD5 97164941fd4f55c0a38352b2d2e64a5e
- SHA1 8af8aaf4accaf701f12a87e7302148542444c9d0
- SHA512 7772c2ba851e8c1743a95576d193dc99b676c9780b4398a9b85dbe20706013378385eae5d72729423f05074f3d8acaf0b62ff819dbd5d11822e262271b96bb76
- TLSH T1C0518953F0A41E71C601692E29B63516226631A7CDE03C45BF4CC26DAF4CE1FAA747CE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\93be51d1-ba26-4a07-af66-ae983eb20e7e\jd_clouds.mp4
- Size 2.2MB
- SHA256 91b49ba64d94ee0ddd7cca6bc58ef1f7cb360c93a6847a28efab4b5e058c89fa
- MD5 b7a57dfa92337fa1ff9ec2d0fe04e26b
- SHA1 f6e9c7719f5cdd74d7650eba049745a7440e1d0b
- SHA512 00b77a4412151fcf68d6ab44f05eb7b4cf971e4c57d46e06513e9ea5e337e5b4699557a5923e4163c40f3c9a07a0fa961eff3d75f86a1dc741f8d89d042869fd
- SSDEEP 49152:ECc7m0NaZplKeQsJj4wjSnLoO0+yGZxVCEHl3UNLWS9GXMl3nE:ND0cfjJ8weLOiHmN6S/W
- TLSH T1ABB533DB9BE15E1FDD7960B600CEB76193A1E00EB3CE97DB1CA524980DE9B4C5C06326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\93be51d1-ba26-4a07-af66-ae983eb20e7e\mac_pointinghand.pdf
- Size 10KB
- SHA256 81d81cddc7b9a4091390d7f512137219565371bd4c9938d2706f8af74d2dcb32
- MD5 3d81f9be5c4e1e0782079a89a329bf21
- SHA1 18712df7e9e06de6cc5982beed64f143ab9a63a9
- SHA512 29a31405b7b1cb05346b22bafb7bfa0d9220d1808c4060de9292fccc75a6f3c159558f96fff1c9ac9116136379a1aaea514312aca1bde0be28125dc3bc3c0934
- SSDEEP 192:NOYi85zR8kl7H4+awLoZc7HsfMFTTDBf01rRLQHdZd10NaZNYaomgRSfbTddzQ1:NOkL8kl7YLCoZffMBTDS4d79ZNYwldU1
- TLSH T103229F29E964DC4CE5019454AD2FB7AE9BDC304357D8A0C2003C9B5F764EC58BA967F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\93be51d1-ba26-4a07-af66-ae983eb20e7e\replace-this-logo.png
- Size 562KB
- SHA256 a7b9382d59d8714c64fbb82a27c64651e7f9003767e90b3adf503680f8c540ae
- MD5 425cc781fa02955839bbba79a2b7838b
- SHA1 ec1c8e863ebb6c23e6f34604ce1421dc405e4174
- SHA512 3895feebf4cd26379f273eb76d16826fa4ef6f7e092a9ac9ab4494a020ffa4d0236c53e7f9fc32a5af3c4dc8db620250535e22197ed2243319bcddce571ea9b9
- SSDEEP 12288:/7fftdqovNWgs2EuyP7EifpcCLPch9R3tN2+H/rJOf5r5:/TPqovhsUy9R9LQ9BtgY1q15
- TLSH T187C42385520B27E572B3FCEAF43E74E130429D05DD76A9572225A82ED152DB830EE23B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\93be51d1-ba26-4a07-af66-ae983eb20e7e\replace_this_clip_vertical 2.png
- Size 832KB
- SHA256 129f7dd4ec193110ffe2b3f3a51f1528655bd5472c358857c0e97eecf45060aa
- MD5 12fc2c4601955b391d2dcd5b749532fe
- SHA1 f389da998f65e65637f530816f87293c7385ce6f
- SHA512 7211a6180e083ab5372180c5cf8f57691839e1f2967a1596ff9c3c61b51e678964218548aadfcc6fdad2a5cf17ebc7555053a57f5d1b7b6144f393e59fb41a83
- SSDEEP 24576:YtLYuYtz/OvAB9DPBtA436EPxq7K1yyQEsh6KJn:STYtzBB9Btt6gxqm15JerF
- TLSH T1B40533B3C68065A13055F6907D3DE5DF2F02B37AE646D0880BDA6E85643E5CA2DAFC43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\93be51d1-ba26-4a07-af66-ae983eb20e7e\replace_this_clip_vertical.png
- Size 818KB
- SHA256 2b0a69227ce1ff21f3af7956ca9360b22ca1071da0c9958a8990828086ddb2c1
- MD5 85b61f28dc5997039e6f7ed5d515f64e
- SHA1 629290e21331b14a0e135d793d70db6b1760054f
- SHA512 001a7f409c91755d530cd2f438be16d888ae48a8e1801361fba0a2e7f2c7cef5ef0869e7fc9d351e3108a3e9f4425a13ee1a26d4d2cc810aeb7f3b405488afae
- SSDEEP 24576:83fgFMWc6mImL8eW1Fv66gXP1I3bEab/aa:Qf8pmX2Fv66gXNI3bd+a
- TLSH T13A0533B4CBB530D29F9BE89BAC305B9E59904F1E9E86891FB5AE04CC4D5D4123180DBF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\93be51d1-ba26-4a07-af66-ae983eb20e7e\replace_this_clip_vertical1.png
- Size 791KB
- SHA256 f1617e538c25a4ef19b19bd3f9a147265d6a71215bee23d323ccd12286a31f8b
- MD5 5999f607b841c7df050807707dd20130
- SHA1 362c819e00fd38753a9a1520ac327d4a9cfbcd57
- SHA512 e22eab2cc26b7373d82b9a1069b4567d0ed758f6b05ccda196f34a61313efe7a8e3be11e4791472181c0327e9c44ab03f2477fcade039f8358f65e89a7f15cc9
- SSDEEP 24576:UujZChNbojG/3G8+K7UundKUgz96J4Vb15nIVF4R:BCDb7SKgPUWh15cF4R
- TLSH T17C053384189DCCEE13BE399BFC2614E731A657EF4EBB454C6A68897C749F3D23214848
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\93be51d1-ba26-4a07-af66-ae983eb20e7e\replace_this_clip_vertical2.png
- Size 757KB
- SHA256 b0c856bd6f224e617babb1893e3aec689e9da663eb34bc4a8e99f0cebd04ce1e
- MD5 3169d0f6f7737c0e11047348932fe719
- SHA1 8b3126a637afa5ee7e06e9135fc76ba7e8aa83fd
- SHA512 174ba43636866d6e99d535fb46c8745161e2f74744ac1439c9fb98f0eb0106d3b276590fccd3732de1da43eca3a5189c775347a5b36f8fabd005499a5012154e
- SSDEEP 12288:RNXoLt0iA9wLV8u4M8CYXhHcc45wZugZHsI0Apz3WCT+frhDBq7rDp1zkBA3uy3b:RNYLt0RiV8Vhh8c3ZM4xT8hDB8t53BCO
- TLSH T17CF4234544B10AECAC8B4018A11E7BB60F53E35AFBEB4E9CD6125CD10717A82F37687E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\93be51d1-ba26-4a07-af66-ae983eb20e7e\templateInfo.json
- Size 168B
- SHA256 c46cfc884ddf5e4e2ecddce60213f4c661de5dcff4acfe3ca9baf25f32dcca1f
- MD5 871c7514dfae45cbedb8588615ab70f9
- SHA1 df48a2d73c7bd45dea9d2c8928e4138b834bbe38
- SHA512 9bc3f6915b1e76b3a8cd4d0df0b4862df8872cf12986e1320ad2bca5123be6b823c038fa4cb01cb883c45119dd65f01ef59eaf79977826270f508aa750df3afc
- TLSH T1CDC0805789751C53C53043B41038F7532A204FBF61345CC936375674D1B0D7815CA314
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\156c688d-9628-4b13-b789-96863ca63003.tsctemplate
- Size 7.7MB
- SHA256 3a9cbd50f170e61f8243d5556597ebd7b22ab7a6ecc670ccc48d297feabc0abe
- MD5 898178d6ad06c8333d5aee41d60ae8a0
- SHA1 77c8963354d65f63f92918619117a65e7f711903
- SHA512 68c67e33dc33084b7425f0494b0cd97c9426d8b81b7536ac3a9cb5003712c38e8da746e6f7b14d3b626cfcb64c711d943c9239dc5e24c0d98382cdbe6b73b4ff
- SSDEEP 6144:qkuHDdh070Q4TYRmrvfLpolj1BWIZ4rqFNKgb1aGSKH7i7M:qkuxvf9SQWzdno7M
- TLSH T1F886A829D1140D3780B3D33E5B908E4AF6AB6F1B25871D047A4D4AAC3F3F525C58AFA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\156c688d-9628-4b13-b789-96863ca63003_Template_Preview.png
- Size 452KB
- SHA256 fb5d59f2a509af2dc43745d5f83ea7e930bbd7df38f302d3487b885e3335d1ca
- MD5 56788787bd9f30447f1d2a924cd3f61e
- SHA1 4a14298c3e67e11995e90a43ab63f80eb1278a3b
- SHA512 2f4cc8999fa8b40cd9dba5b16e98de93cb74405f7dec80569e0191dd716b4dac66636f648b55a4653873b04db972731d7c505959ad32c8944b91a5efcd085898
- SSDEEP 12288:8iRkIhafSy2wUvdnEftkKl+hYQUajhplbG/gcBZl:tkoTRwU1OtruYrajhnQh
- TLSH T1EEA423B2D455B3F38827CFB450C6698496A941432C2BDA9EC4B6530E2CF8EEE1FB145C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\A-Rotation-Into-Place-Up-Mac.json
- Size 3KB
- SHA256 e35fd50a1dc3c812a3ac459b54a09c041c3988c5eae0e5eb6cf3670079960246
- MD5 03ab58c97db02a31ba3f6956940e6983
- SHA1 49202272027088743d47ccfa4648a9f9e86f9ecf
- SHA512 e8df3a18f9ceb85afab9385573409614772195370bd355e895fc13b2e5433c25ea0cc9cdb3a5ef77c1fda680c0023633522935eba527ff2a4f844e45ab4fcb94
- TLSH T192710285866442BCEB0528C4CB8334D58FC4C8672EC50DBDDAB67D185BB99EF2304B17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\A-Sticky-Exit-Mac.json
- Size 5KB
- SHA256 85436da40a67b05d0c472e5eb3623c1a7c8e3e86ad3db833919985c87e8371e1
- MD5 7be46b4852628d8ebbd0d131f6fec769
- SHA1 f45f1aaedc652734893391d8147c321dfe21d595
- SHA512 2ac78d1017a9d7979c127066fe251907015d68463fa1c087215309074266fa01e3517e0e2b2fcee50657f9196770e03eb86e1b2bf889596ed3f8a0df23730c43
- SSDEEP 96:4K7hFGUm+ptDuJYinWaOnPVn5wY9VfF5kf:NVH/ptcYiUn9neYLfF5kf
- TLSH T118B13285C6600ABCDB2519C5CE8735D18EC4C4771EC28DBEDAB63D289B745EF2320B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\An-EmphaticSlide-Left-Mac.json
- Size 5KB
- SHA256 2d498c4572338973e3ffbae5e1f4ba4376fd6bc969ea190b470d53c9d93d4c1e
- MD5 c2bc6d761805b0050a3852e1f91d5ad4
- SHA1 680591111700fc3df2cad8f017b5aed554c07aaa
- SHA512 8f7465c6b4865f9fc5b6ed5c12cf8fb49c1ffa24877d8bb54db17ea47cdeb3d1d2482ee7671b10ee272539e66b34dfe9a809c44f7559df0a19c432aa4be95ef0
- SSDEEP 48:YLjzmkbmFzHM2R4wZUJ9Lx1I39rVwhnFuHsnDYBuYYE7htoXU6WaOD7oLHhDYFfS:4/mkSLEV1I3shFYYinGWaOn6F5k9Gx
- TLSH T14DB1238A867642BCEB1528C0CB8374E08FD5C4976FC60DBD9AB66C245B756DF2301F26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\Arrow-Envelopment-Mac.json
- Size 5KB
- SHA256 babce9e04768beb2da9e5657a66e81cd50262b37be0226f8d391a63c1cc1f330
- MD5 23de765e1ee89b619a81b193b95acc96
- SHA1 d3b7d0fc3d357e5baa5bb835e6e8d17fd2acc731
- SHA512 9ebd6153815a34d77e988f7f1839ed0fa84fe3a18be3511ae168691e6e63a1e0defa312c62a70be102b1bc4af6a192e03ada0deb9ada2181c2950c8e5381d4e0
- SSDEEP 96:4dLqB1YiE5OnIF5kJpMB1YiE5OnIF5uD9K7:aLi1Yi1nIF5kJpo1Yi1nIF5E9c
- TLSH T1C1C144C5467502BCEB0A25C0CB4374D5CFC498666FC509BEEAB66C289BB56AE2301F17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\BFX-001-Yellow.json
- Size 5KB
- SHA256 f60fbfc796001fbe70025da82d377afd5c900b32589ee08cfa83bf39b2e1afad
- MD5 acd1902233ed72ab9c5af731c07cd5a9
- SHA1 a30a2dc6766282b9bc670e44d78d67e5518e58a1
- SHA512 93ba5d33fc8eb12b87f6a88b7c66bc4902b06563ca1f950559107bc9b86628d24172368e702d981a2ea37671a255c0bee7f441d4b3aa72918d1f6ea5993f9141
- SSDEEP 48:YLRjdEoyCoYl7nNDjfYFrYFfuYYW9WEfC7XgiYYANYBEaxL9xxfQnuFYYqesr2MG:4ROkvzE49OshwDgulhdMfzZ49Os7
- TLSH T150B115C6057543DCEB0A2450CB4374D9DFC89C99BFC505A6EEF61C299BAA66D2302F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\BFX-002-Yellow.json
- Size 4KB
- SHA256 ea9d12eba374aedbcc2cfc6beeef49c33bfe8bd0e2e3fd1c4587beca6ceb8af6
- MD5 fc0800c444885a30f3f91d85635f211e
- SHA1 f5233887ff555c6aaad510fd248b65ba6afe6bfb
- SHA512 5f89d21626c846113e13e65efb43231912cc7aa4ef3d66c587f915cb4ec4372b389cfbe2bde5a70a4ff13e7b87acc745629fb9a193dea33338e6c255785129c3
- SSDEEP 48:YLRy2XRgWJ2LJvHYIYQSmbRYAvnBZ9CEfv7zYYB1GPg+J2UJvHYIY2AwcRYAvxBx:4RbDJyJPZNZ9rz1GXJVJPZTaZ9rK1W
- TLSH T1FA912AC1457543ECEB092490CB0374D6DFC898966FC945BAEEF62C289FA669D2341F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\BFX-003-Yellow.json
- Size 4KB
- SHA256 7795d7202ad6a2bb4bc73a2a433180ca72f389c6d196ab72b88df8b8e5a4c7f3
- MD5 8d82007c1b41c1a06c167bb8488b839a
- SHA1 ad0e2f5f2f4e7ff28491a8ce53adaa1acff906b0
- SHA512 d4da41f0d7894744b81109acd48a0c9ae5a7c2dc1a0619d1ce4a2c99ae253ba752205a3488d20c7475f93e70c1e3f46f3a583595682383f853088d4f81909a8f
- SSDEEP 48:YLRlwMFYIYQV6AIoCKYAMDUF9fEfb7h+EaxLqTfIcgYYqe3WuJcJJbQYfcB0jYLt:4RJZfv4Ts9yLwFGuoJFU2UQA9yU
- TLSH T1D7A118C6057542ECFB057490DB4374D9CFC488966FC905AAEEF61D189BA676E2302F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\BFX-004-Yellow.json
- Size 4KB
- SHA256 0d3b337683d87d29f38e85194c0bb9ea005a9f09d511fda3a2c388dd6017de75
- MD5 03dc5bc41834cd7f5c01f54606e3e347
- SHA1 674bf461b2020b2b7de14395496b837780405bce
- SHA512 6890688189a61638d4fc47115b2a652e794551950b021cd9c47eb42ded07050d736033335293cd3fbf64b02c04f3298b757c8a696e97fd057796754b757c5c94
- SSDEEP 48:YLRl3lWUTJRe5LWkfqYYBZ5FMFYIYQV6AIo4YAMDUF9fEfb7p9JJbQYfcB0jYLBL:4RfvJRe50ZwZfvHs9ypzJFU2UQA9yU
- TLSH T1E4A13AC6057542ECFB056490CB4374E6CFC488966FC805BAEEF61D188BA679E2302F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\BFX-005-Yellow.json
- Size 2KB
- SHA256 64db4a9e8a7e21cbd5b3bb68a9f1f5b4c1e0824b0a787f412f37a5bb0e43b2ca
- MD5 3eb1678a8540f57f62cbe9e14a63401f
- SHA1 6af4754ace8a512e3b738924b1632056cd17b0e5
- SHA512 a50cf254e876abcac8925f8127b4700a252fdb0bb4335b8a5450a41686f2ba434aa2b7ac0954db66119b36b2c0b3ae69455c475a14fe1fa12d6bfe284af5fe3f
- TLSH T1D35127C6057502ECEA0575A08B0374E6CFC94895BFC905AADEF64C1C8FA9B9E2702F57
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\BFX-007-Yellow.json
- Size 6KB
- SHA256 778bf3eba1350df87c4d4358d672bb5d7f6f39a36cc60e0f91a5b4eb3231b406
- MD5 bd63a7ac573d5ffd5e73b4c8b47dceda
- SHA1 71328237cf27d39e45acfe817d82067b27e4e67f
- SHA512 fe28e9df5da69e32f6cb095424dd0dc40b2fe9a162ef290af70ebdd37b9b780e9f4067ffd0a7f77a51ba9f458879bd37cefeadea3c0834387cac52034a2b2cc1
- SSDEEP 192:TVJDJgZKDZ9H1k6JkJgZV5Z9H1lUJ9JgZfeZ9H1f:HVgUF9VdAgfj9Vyrgdm9Vf
- TLSH T195D13AC6057543ECEB052490CB4374D5DFC898966FC509BAEEF62C298BA665E3342F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\BFX-008-Yellow.json
- Size 4KB
- SHA256 b39f05e3f73698dd83f0d6015ebc0b5feb9e9c81a0b11265d759a7882ed6a9bd
- MD5 6bc2dfbbccd88c1520affd4ed6f6327f
- SHA1 944dee68eb93a6ee6c0e3251bf6f08aed857abf9
- SHA512 682f847b8554e89f4610c3af8fff0c5ebdc8ee8f7c8613b52f56b43c7819e8df21acbad833e0b646f1622e0a216a417819c60f89cab4cb8ef10002f6e851c012
- SSDEEP 48:YLRjxLkgmJvpJ2HYIYkvUCqRYAWiBZ9CEfv7zYYB1srzyVJvmJ2HYIYFBZ3RYA4z:4RtLUJRJgZFyZ9rz1wkJeJgZpZ9rK16
- TLSH T1B29128C645B542ECEB052490CB4374D5DFC898967FC505BAEEF62C288FA669D2342F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\BFX-009-Yellow.json
- Size 3KB
- SHA256 4f5340e4569255b9e89d7ff1d22a6aac8e53cc7175a79420bee62dc751056bb1
- MD5 d33b9127c890c55862ffcb6bc1c8276c
- SHA1 f09284f65944477f5c23493efa094582cf1de163
- SHA512 77ff00d56fec3f1abc4ab1742e8af25875cf1ddf8edbdfb05c7fa58e13ebe54fc161bc0f5fd4122c97d173dadc67c29f6b4515c2499adcf4190ddecc0390faad
- TLSH T1EF71E8C6097502DCEB1535A0CB0374EADFC84895AFC90596DEB64D1C8FE565D2342F53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\BFX-011-Yellow.json
- Size 2KB
- SHA256 b07a89140b2b02035bf0e6f51918e288d6ca1f8babf5c883b41ee644b3447523
- MD5 0da7cfa5cba148a1b1b87fe3ba79c80f
- SHA1 b3812cf3f852bd06b7bad4a19852d6a5ef42974b
- SHA512 bcbadbc016b568a017af20dc62473e293008c94118b72e5bb0f15f3a90084da61c226e41f8ba1903aa67531c8a43227909d49f8b3db7ecef918aa7cdb2a78ca0
- TLSH T136516DC6057542ECEB193490CB4370D5CFC498966FC909FAEAF62C299FA669D2301F17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\BFX-012-Yellow.json
- Size 4KB
- SHA256 b6d55c98078e920cdb3e24da438c0c6171cdd0524b489685a5050c4c013285a9
- MD5 fe8c2767a9232bd87ad26575beee5a22
- SHA1 ecb4bacc5c3dfef40071b09db11bf0ab6a63b7d2
- SHA512 0ecf161026a0bd350f8c61d3d67cd117e2c3371de722424ce28a12256964d686f2fc5205b8dee6335af77dc1dc4ac90453a11ab2184c28770dc2678efd376387
- SSDEEP 48:YLRjMkgmJvpJ2HYIYkvUCquYAWiBZ9CEfv7zYYB1srzyVJvmJ2HYIYFBZ3uYA43D:4RwUJRJgZFVZ9rz1wkJeJgZ8Z9rK16
- TLSH T1189128C605B542ECEB052490CB4374D5DFC898967FC505FAEEF62C289BA669D2342F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\BFX-013-Yellow.json
- Size 6KB
- SHA256 64ac8ee0101af0e8a907b4c70416492039531568785ed335f1a91b4ce33bfd1c
- MD5 28db01ad9fbf766e89a45f1a48c8ac22
- SHA1 20d9824070bdefd5f8832d2e9718d244367d66bb
- SHA512 c2915fd2738302b010c15d68676ea7777f91762f85526b7e11de46b545019e02b56126a135133a3cf42dbc11ef1964c5c05368fff0eade232ecb53fb0b127899
- SSDEEP 192:YVJDJgZKWZ9H1k6JkJgZVaZ9H1lUJ9JgZfRZ9H1f:wVgU+9VdAgfy9Vyrgd79Vf
- TLSH T110D139C6057543ECEB052890CB4374D5DFC898966FC505BAEEF62C298BA665E3342F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\BFX-014-Yellow.json
- Size 6KB
- SHA256 98c9b53ed2a8832c597cf30c1e102964ead15658b88fc5c4264e64d3b3fd3a7e
- MD5 d791e73df2f293a30f49c3569d25ddab
- SHA1 50bdd906b6d700bac3f5bdb9c227b5d73a5d4bb1
- SHA512 d2704ce05748094b2db2c33ea7bcb752e202a2c0d99ef7116297b70b3c775217c1c16b2c3f5e727a4a8eb749b89a1f2e3d4ee616194b5b82c88a1aa2026ba80e
- SSDEEP 192:nUJRJgZFVZ9H1wkJeJgZ8Z9W14AJXJgZwZ9W19E:Qvgjf9VHWgG9g7Zgu9g+
- TLSH T1BCD128C605B542ECEB052490CB4374D5DFC898967FC505BAEEF62C298BA669D3342F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\CG-003-Yellow.json
- Size 3KB
- SHA256 aba40f9ed0ea516ed25b4fda155fa5f4507238cec3f1e9c380b3555ebb81d61f
- MD5 791c167deca482d1c715270f0c7d9882
- SHA1 007e5a05cefdec2e155ff4e573c427ae4bf83201
- SHA512 645e1c640053b6b002892b9ea936dc742d138b122237458cad5f247c0ec54fe081836229a5239ab57b1c0d76637c97d1ef171dc76f0810af60c4fbf211227c48
- TLSH T1D3810682097503DCEA052590DB4374DADFC9889A7FC905AAEEB74C188FE675D2302F17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\Camtasia-mac.pdf
- Size 1.2MB
- SHA256 88253ffc3f605d485a81847d940a07651c650515df1389cecbc63cdfdf538b12
- MD5 a76a8bd9013cd5a03fe9fe1b6c8247d9
- SHA1 38abbb012adda4c81e9b0c9b78a57c28b62520b1
- SHA512 8a8272bbbe60dc0920de6d2d68a016e3c94719e726a370fa49fcf505e09923555467246eb95162a9875212d347e4160372b49b26ee948f8b312930c9990c8dc4
- SSDEEP 24576:PXXXzI7upV0RvLHz8M7opeeeetFZM94tP2mbOTCrslRrKBdl3xSc+NvJw:PXXXE7upiRvL0SGImbDiRr+LScow
- TLSH T170451212215D9CDCE427644820523CE93DCE3821D5DFDEE9B8E9FE72C55B92D1AC8788
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\Click 1.json
- Size 3KB
- SHA256 f6c1752933abd8be10b667909668c12e74cffff4eb179a765c522a7765a81a5e
- MD5 db59ec52c1dc58e68a24301b87e0f477
- SHA1 eaba6a1500373bde2f18d476c0b107f6a1e68642
- SHA512 09f5bae98aecab2f4a24a15032e66da5df4812898b3f736446071e86c5f09a8b1e90ea0ad9ff275d33fd4caec0fa4b81e33093e6b8535a7db212922083e1c539
- TLSH T121614A8B0A7242ADE50534A08B8370F58FD58986AFCD0567AEB64C294FD575F3305F27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\Click 2.json
- Size 4KB
- SHA256 a160b9220612470593fdd5c3214bcc0a12725f3cc841a5658766a3dea53af066
- MD5 9fd1a0c892dc3138509d1d0b044dbc4f
- SHA1 77c85ace0df5ee474a34fa012bddd291a1570ebb
- SHA512 5598d7d0e08797f44b6d55c4823dd3ed8c9a92a930d724a60f77910c997fb389c549fe1b6e82cf23bc438e419931636facd77407c49173c0b7732ec44b6707ea
- SSDEEP 48:YL50gBEU5Y+TOw0bH2jYSCfI+/hYYOr65Ylgje8BjYSCfuYY/GUihIY3fjVfI+/e:4SpaUVCrboUkGxawtto33/l
- TLSH T14A812AC60A7142ACEA1574A0CB8374D5CFC988857FC904ABEEB74C289FE675D2701E23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\Click 4.json
- Size 2KB
- SHA256 a1a023479693fcfa12f4e87375923b9454ad2a1a07a0a42501088cab8692edb2
- MD5 f2f0535ebf30c50d96acb3235fa435ed
- SHA1 dfb0fd6c44be9aac4f1a08814873d543a5f50a78
- SHA512 2fdbb0e30d6a272c96074023293880eb1c7b17adb19a472b6a477304d36ecaea515a515ee8a8d32525c61c04685168eea602ac044ca422d3e19f6cd390d07c96
- TLSH T1924107C6097503ECE61525A0CB0374E6DFC548957FC909A6EEB64C2C8FA9A5E2302F17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\Collapse 4.json
- Size 2KB
- SHA256 cb35cfb35890ef495d118c8584fa431f01556a4fb589dc7ee06f9e3eb11c1946
- MD5 8d4203a74132fb95a76c7fc42c61585a
- SHA1 97d6ec32c0508ed08fca06c1551a141efcc1f10d
- SHA512 a5951b428809263fd2afdf394f5c686f30d21773087b5578ab3b685c217c46ee81297fd6a133e6b92022624c063a55f1e6f394ca5a7a0e1ad191e01c3901d0cf
- TLSH T1C65127C609B103EDE6053590CB0374D6CFC84895AFC905A6EEB64C2C8FE5AAE2302F53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\Flappy-Pointer-001.json
- Size 8KB
- SHA256 6f332f85efe798c510ef7f07f139b0fd0bf626360712c3864bae3ec09576cb7b
- MD5 3d49d2edb009b89a316a2f1b439a786b
- SHA1 10849a478c149910f8dd17176224c301e22cc062
- SHA512 6ab76eb5d532c8c1ac355292acd66e2e39bceedb88f282157ac3e9bee0f99508f0b34318654e7b3678d7ea86a18db9f290cad785570a64843848e5ee85efff43
- SSDEEP 192:72Lkemx+m+BE+YiYwndnHXYnZXDnBJnVF5i:ykeY+HBE+flaVni
- TLSH T128022495CB1905BD970469C4CEA739A04ED0C0771EE38EFC8BB67E251B74AEB2314B16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\Hand-Open-Wave-Close-Win-B.json
- Size 22KB
- SHA256 3135f2454d098ba1139e612d782d9a055269fc11b26f33c141251e43700f717f
- MD5 a2f0af2d8825919198616eab3a754c55
- SHA1 1f52561b0904c1337e1c27fd98a2e677c45dc203
- SHA512 14374a84ce25c9e6172efb8fd279ba0d6261fda61e730787aa61eddd6ec3da49d6d11f22be7a9458e2605b44ac83b027451f843e9ca678dd8eabf1b1a15d3ce7
- SSDEEP 384:FnB37FqoFqunB3vmu6VfAbu6VfApwh33dhv8JmyaC:FhD1Nmi0wh33dhvMmyT
- TLSH T1C5A27859C78100BCAB986AC4C9D3A4E84FE0C1136DE78DBC977A365053F4ADF2214F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\Hand-Wave-Mac.json
- Size 4KB
- SHA256 3a6fdee462ab83e80461424da32b8cc03570e97f528b639ef5a75f3d95af1a6e
- MD5 45247497785f38a3c749f87869309177
- SHA1 5be91bf6fbe615ad60d3ddd7735950a3d79d1c6d
- SHA512 21126f02e11e40d9a0334503c6bbdbbab674105a8af5b917eeb277d40ac222b3ddb2d8c61bde8dc1ebc8152ef70f9ce3f40a57f4c662c0494ac5319be1fecc87
- SSDEEP 48:YLZwuKgCgSngp3EBWaRDt9IOss1uYY3F6v5aqHk5isWXSbsLgkh74qssshDYFfut:4igmBLDt+OYF6vM/5sL3NQFft
- TLSH T1D291D1E50A7105ACEB486E848F83B4D5CFD448267FC700ADD9BA1D259F95BAD2305E13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\Hand-Wave-Win-B.json
- Size 7KB
- SHA256 59695f5d820acce373607a0c35223192ca4efe3bd6b26a1590e9ab2d097d77b5
- MD5 428b9dc0d1c1f7851144e81feb1cf9de
- SHA1 ccf0a6029d2d9bfe7bb52d9a39d05fd0d341e14a
- SHA512 ee74ac6752db7a0f4f12d822b58f36b9b739dd552fd3b4a7567024516d980c90bf03501bda8b5cfa4a057e0b27e1ef3f32f6e83b194f40e46dd32157ea804504
- SSDEEP 192:1g093OTaBu3ZbW5TAu6VfAuAaXYXOCfyC:4Fq+u6VfAR68/aC
- TLSH T184E15299C36105BCAB886AC0C9D3B4E88FD0C0136ED74DBD9A7A3D5057B4ADB2314B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\Pointing-Hand-Tap-Win-B-009.json
- Size 18KB
- SHA256 593de0891a7608ab31f89a875b106b7627f2b2b764bbe1ca93a04aea17cb8c93
- MD5 77e4f3ca7ccfb9eed621b8633ec224ba
- SHA1 4e7460a05d192a0cbc605d1dd135313995263c65
- SHA512 deaf8e0b90d155ef844aa2f82b3900b8ec01beea4f9c96aaf921c2e82b62008738b1a5c2e7733ddbbd62eb66f93f4cef1d20a66870a93502ed4dd635d5dcdce4
- SSDEEP 192:c0vzE49dhwfEfzZ49df93OTaBu3Z+5f93OTZBu3Z+5F93OTaBu3Z+5zAOoActg6p:cEL9dhwfkC9deF+A0+2F+WYh68Iyah
- TLSH T186823389C36102BCEB896AC0C68374E98FD4C4176EC64DBD967A3D1457B5AEF2300F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\camtasia-loading-glyph.pdf
- Size 4KB
- SHA256 f90f8704c525557bd378c9f28d82793018761267fab3578de40a417242c16e99
- MD5 ff44569860dabc1daef306e8073fa125
- SHA1 3083a40b5fb7e7b946f74354bf283a27c10280f4
- SHA512 9331b70f2466867e62af4c5d6ff8ccac84a2fe6d96eb8d615d4277f24e6ef9f7f3df4eaf66cad9994ca4d05db3b02cd781e331fb47aec4c2caebc4a96a1d0455
- SSDEEP 96:Ufr7b6gY6MC1mfxQGFRS5VXbT/yeTjpChp9:MLYaomgRSfbTdhCb9
- TLSH T1EF911988B4A8190CE842C491C96FFFCD8DEC3017D7DA74410538176D7A4B999B64B7F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\techsmith-logo-large.png
- Size 42KB
- SHA256 1003fdd3c34b794daaeeff5f03283a605bff7b863e2d55e842e1cca92c1843da
- MD5 f70fef3fb7eed6c840f361c03f06d32a
- SHA1 9eaa460ce49d2c4aadabc9b11679e4441f329c1e
- SHA512 787d3aee7802a48bd72b82d2a7829378ac7b80af0f81a1684222642fa3dbc2a842b4f10104917b81dc9cd8c7b5dd0c8e7c3f4c067a1c0c6e12d34c4ae0affda1
- SSDEEP 768:ohkeD2O755Aq0KwgxtZBIpB/lsibJJZhaArdu5SphqmPxpeEGr5:oJt7BwgBBIpBTjhNu5SphqmPxpHC
- TLSH T1881302F27A6BD9EAF758A4208F69C1C5A0FCC3C45870506E1F012736A3291C5BE43ED6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9472e3b0-b562-4c87-ae2c-6f0e04df4cac\templateInfo.json
- Size 152B
- SHA256 ccd8d42044204b4c27c227881347db162789239906a6851256dc77ffe4071ef6
- MD5 6a57c274251303b52e9a570452e66ad1
- SHA1 fe2f505bdd5ee4c51058ccdebd585769808e50f6
- SHA512 80fbfe3903802135feb23d8a438a1b1ea384e2cb60f56e2bab69335cd14fa19597598bdb209700bc5f260a976afb3471ad3a3358e24d7fee10ee9465294afac9
- TLSH T1ABC02B33000434130AB103F004385607A2BC8FCF10744CDE757BB86002E5A78E7C6B21
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\988e8ad6-d669-42ab-9537-225b387cfbec\3972687b-7599-4189-a6cd-5660b3a08029.tsctemplate
- Size 860KB
- SHA256 94c68ad0e7a7ed72f058a6c6f8a68102d90acb3a4fa7f30f9dc494cf8cfb60f9
- MD5 33d98c70d1ab5d0e9a0d2a592b8bb2d1
- SHA1 ba0ef790601b336f0c0cba7165efa0890ad9173a
- SHA512 473bb84abbdfd22ff42bb23f62c8e5b093973d2b677c7cca3341dbe4eec57d1c8df80b1ff01273d124cfcb7b850ce4a6118c54882673c0ce1c35687595082180
- SSDEEP 6144:jK6Fzu41RiznvKn5byHAujccnL9l0fzAQdqK:rzu41RiznAm3jj5mfcQJ
- TLSH T1BB158229D1140D3780B3D33E57A08E4AF6BB6F2B25471D04768D4AAC7F3E521858BFA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\988e8ad6-d669-42ab-9537-225b387cfbec\templateInfo.json
- Size 157B
- SHA256 2d05cc91e07e40ca55b1d470173738ba8ec7120f98d17909953faf36403240d3
- MD5 090fd10e7896bdc2bdc49bc32edb3268
- SHA1 263420f4cb72ca336062e8f3494a4d08553775d8
- SHA512 52118dae3bb01187746bce0793357efe33ea64ea5b5a888c823d88dc07822a854de67fcd99b0a438923a597d918c1359078fd257210025dc158fe653d86c086c
- TLSH T1E5C08C860B9640934D380BA0053E924BF1639FDB31B09C8AB6BA204095A1D644886320
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Camtasia_20261023172836_001_CamtasiaStudioInstallerx64.log
- Size 1KB
- SHA256 18bfa1be3319fff75c4dd29018f101c3eadc3db96d64bf8d24dd959d9f4559f1
- MD5 95bab865c9a45ac7cae831cbc12ef5e7
- SHA1 7330a245dc50f23399ee1fb702936a2b19f62532
- SHA512 378c99065eda5491e400743d36630d769f55c3e51af90f22ff33da4b6d769dd78efaa9225d4b83aa2128013a23c792e863d04a24f8943982c6a4fb2b3935c560
- TLSH T1DD411E5A5EE40815B1F797877EB3C0621B33FCD67830CB4D2284431942BBD05ADA87A6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIb41b9.LOG
- Size 4KB
- SHA256 60894b18873573e47a6a63de556605f138ba38d5fe97884e6be457fe120e50a4
- MD5 507c61207b50599e72ebd4a844261471
- SHA1 2e4872a35be52f032c478d2b7047b4fcdcbdae23
- SHA512 8448fb6f47ed105ae3ad876083864f1de070d3f22096d8d2a0715f55f6669e3100abaaed99c8bdd83fc4e4c65a3325485d462a825c495051e28121f774bdeffa
- SSDEEP 96:Y6bDbmbRHhOd6aLVLQoOONMz3sffotJteC81ch1ctfBeOEedgtJkz36:HbPLVL9OP8zC7O/dXO
- TLSH T1CE9124195FE40019B2B79B87AEF385215E33FCA6A834CA4C21C1830E4566D05AD7C3BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIb41ba.LOG
- Size 3KB
- SHA256 f01bbfb60f917da5a4907d1b231a8899658a4cb883d6e971eb05330612d1f57d
- MD5 5ad025b8b9efbc5b4e7ba670e0c564fd
- SHA1 1e70e318073097189c2cf0b28a2d272e3ae72829
- SHA512 b85161852a267a990a661a429d41e962e17894fa40cd177ba7515a9ee767f7ef6cd454dd70b22e4e17635c1d9d8634559a75bcd4c6f69ec7c6e4ad49254da45c
- TLSH T15E71EA3A5AD80816B2B39687AEB3C4215B33FCD56834C70C23C9421D466BD01B9E87B6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ab0247ad-6c09-4af1-bccd-5a06699626fe\7a3c275d-d6a3-4362-82bf-6050b6fe53ab.tsctemplate
- Size 94KB
- SHA256 70fbe4b4fc882cf243976f77badf8a6fd8416bf015af8cd83a6f37bbc498bb9d
- MD5 df3d0e320817601b86fb9996a77b9999
- SHA1 8e9d4a79c49d95d832d435a9ac8eade480a6b6ab
- SHA512 100f3f014b09762542857e089f760fd81e3b8ee521f6249b61770df149e1f2bf427f8e93af578a9dff72b376dc9f4342f1e520d73b21c2fcf4e183f2cb148d9a
- SSDEEP 768:gZbm/B2wN7iqz2UznDni5mPdx7AGvYu+DxkJSEK1R7ZZQRVEMj:Ebm/B2wkqz2UznfZvYukWwEK1R7cRVxj
- TLSH T18B93A365D549CD2740B3D32D17700D0AE6B75F2BAA472C887A8D8B9C7F3E4289487F26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ab0247ad-6c09-4af1-bccd-5a06699626fe\7a3c275d-d6a3-4362-82bf-6050b6fe53ab_Template_Preview.png
- Size 102KB
- SHA256 de0cedd0d9a047275fb56c1a9925bd731b920c2e7bde2871600d4c30421fb82c
- MD5 ebf83c7bcd2a0b84fc98053e8d383713
- SHA1 9674490addd5d4d5925a33b1a2285f52f89ea361
- SHA512 97d5a059241cc21195cbb3573c4d61e1bf4f6242fef71d8d649f583ef0b6f82768dfd2acf23d9331f0aa5e5184d7919cb636c9506256511ad694846cde3dcf63
- SSDEEP 1536:JwHhG6Th7oO7SZ1hnnpct6bPhxjV5wfAKHs5l9i9VLSUwsiHtv6T3:o1V8OuZ/pc2Ph9V5wDMD9wVLTiH98
- TLSH T1C9A38A56DF22213BB1090018B6A769D390245CB77681CE5A8BDBB42F6B4BFF4EC36C45
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ab0247ad-6c09-4af1-bccd-5a06699626fe\Mountain-Background-1920x1440-01.json
- Size 25KB
- SHA256 eef32e227afa74778c1442b0c16611e505423051b941caf2aefc9772d3abf9d2
- MD5 81f4bd589cdea47e7f2797084e1b1376
- SHA1 5911f3ee88013702e13eb9c69b6c706ab3e5d1fe
- SHA512 0b84f0e975b1a2f2c762c1bba03ee8d4eb058d039cec0c88c974ad0046951a28d45134349d97309fd534ec9e4e9499d1765ed2ee4a660fbbb324d076b2d215bb
- SSDEEP 384:djFiRg9cqe2/HZhVPb4+2lYLzh9qqfcYv1BA36qSWJA8Rqda:dU69cm57z52GLdQ/vK5kjYQ
- TLSH T1F6C2DB86C16002FCEB0959C0D64375D99FC8D857AEC50DBDDAB67C188BB96EF2301B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ab0247ad-6c09-4af1-bccd-5a06699626fe\Phone-App-Bar-Tiles.json
- Size 5KB
- SHA256 cdda7dd65060195310c8e2006a61cfbbab5bf8f14d3c4e099d5d07f5855fa7b6
- MD5 e0c87ee9d74ad7e1020df2d24a3e7cfb
- SHA1 a4038cf0b8da55a08ffc56cd193a125326f9cf9c
- SHA512 8ad639749e9981c08f5dd62df974fd4f15b699be6bf84c123f26a158668d93efe13928d9d4f46538e0292f2888a2552947b9451410179703d99886d39c8e10c7
- SSDEEP 48:YLBMTvtWbDYFfuYYTM0tvtWR1DYFfuYYTM8bvvtWhDYFfuYYTMP26vtWAVDYFfuO:4cQ/NThQRRN9nQFNc2KQYN9PXyBNwMB
- TLSH T139B1C2C2057543DCFB0A61A0DB0379CADFC49C59BFC501A6EEF65C188BA9A6D2342E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ab0247ad-6c09-4af1-bccd-5a06699626fe\templateInfo.json
- Size 159B
- SHA256 660cf51dcc4765dcd172e2946cdb4fc7a819480da4d60a05e2b58d0e8b2dd1ee
- MD5 7de464b51ea22f39658f1c576e9b499f
- SHA1 dfe531989cce7541752c0f45e96c07b6fa7dd816
- SHA512 005c6e817ad4e1bac7c77a5b1dc8e6a873726bae37a8d482415d82ababf65f017b1cce0552ffd07e048e360e7dc6d251bbc3a1af694f5685eef9f60284fa47dd
- TLSH T192C08C230204A2631A740F701134B342A2B54F8F92A0AC9B3AB3B7D002819680282308
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\b2823f40-39c2-437f-8188-035f2d5f2613\5c26c478-db94-484c-b501-5cff82462e22.tsctemplate
- Size 149KB
- SHA256 e3a6cc174bc97cf9e17d2acd50fe1b58b5773c33197a1829c2829114c1ca0b06
- MD5 6cc2e62c2045728f405a53744af2bcdd
- SHA1 64926a19ff5f8a3632e69e60376852b4f2e722e0
- SHA512 b6db23d83a3c538062240e031771014d84cba479528ec90714d21eee24f64552f4fbc61803f0e89d6749de031834677ddef3c5dad80c07d327b29b77e0431140
- SSDEEP 3072:Ebo4g2avm30PpR1LOeBoQetCchOOPvQC+hj8dyuF0W/rsx00UTVT6lsHo9:l9UspDOeSQM9EMvQP8dZaUTVT+f
- TLSH T19BE3CF65D1584D3780B2D3395B654E06E7774F2BA04B1D487A8E4BCCBF3F420988AF6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\b2823f40-39c2-437f-8188-035f2d5f2613\5c26c478-db94-484c-b501-5cff82462e22_Template_Preview.png
- Size 343KB
- SHA256 819a6cee000903e209c1c1e6481328f0e5044bc5c9e2923fdeab921899a8c719
- MD5 546c3c1072d7f10e778938d1653f8fe0
- SHA1 828c2d0a2ec6ee77637dc515f5596857fc2d4758
- SHA512 91907de062dfd42837e33d8a77e854623c4c619ffc7f077f1ee560ce964d0df45b299000df7e817a76dbeb65e596e7c3e0943908f8870d6a00e933c4f846e319
- SSDEEP 6144:9+lQw72A7GagdDvUnRwRA303+19AzfdLXx/t6D7dd+FWP0l00Y9z:9+lQeoZvUnRYAYQ9Cd1KTJ3z
- TLSH T1DA74234FB6CE0012F14A26904B33DBDA597A8817DB6B403D3BB8D14F35FB595889E24A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\b2823f40-39c2-437f-8188-035f2d5f2613\sunburst.tscshadervid
- Size 3KB
- SHA256 35fc99f5f34d73258912500714456bfae55e212b905d84f8e7cafbdae626b589
- MD5 a17ea8f2639208c985ed7af66e8e66c8
- SHA1 3674502928942b7e8fa9dbfbcf9d8d9a70a5fab8
- SHA512 56a7a757d86cfdb9a6396812f63004f01b4656d2a68f98cc945208dfd7c5a8a162afd6822cf9139436b336e3a1209a2c571413ad278782b5c6f3eef980058dbd
- TLSH T1EC518697E2604E711A07B92D26F60105726231E35D35B8443F8CC21BAF0DE2DD6B478B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\b2823f40-39c2-437f-8188-035f2d5f2613\templateInfo.json
- Size 157B
- SHA256 a17a2ddb3b9dc201ef68914124c626b88f90e5f26125ff95e9eacd37b5cdbe5e
- MD5 9b7de0abe0a0a6a69316eb775c8a0263
- SHA1 374fffee8b1e0010cab318c695c2e1c70fb43159
- SHA512 696494d1b6d7aa72d02ab6017969be810e50b131c9dd437fc9ce178a65582524cff23ea4f1a1a5f941cb1b361a68d3515610c9c45e4769e49d861e92559b559e
- TLSH T1D3C08C231210A1E71A2007618031030676334F9F90308C9A3A72C1E4264B6280382724
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bebb6646-8e27-4a45-b3e6-774797f5bed9\2cc71da2-a166-4d80-8d0f-116072d2e902.tsctemplate
- Size 407KB
- SHA256 b14ded55a3e356673ca5933bcc75de13cd4270a3989e31669501fa6d4a7c8321
- MD5 3c3d5275aab913fd42c67cabe2ba06bb
- SHA1 f5bd2afdb022674a9ea9a89e042705cfbca68a28
- SHA512 7a442cc6424dc60e8edcfa6cde7daa9e895858370bc9fbe9042e203890a70ec2c8fef0b60ce6e67e1d3aff784dad41e9e41c7c7e887732fbdf5eb69acd66cacc
- SSDEEP 3072:EbLJfHA5C57SB29ULPH3kb2g1pnJFMdWeohnWIpYKgY27Bo:kfnVb2gTJ+dZohWIpnUBo
- TLSH T19F941765D0548D2380B3D33D1B604E4AE2A76F2BA5872D44768D4BAC7F3F824D48BF66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bebb6646-8e27-4a45-b3e6-774797f5bed9\2cc71da2-a166-4d80-8d0f-116072d2e902_Template_Preview.png
- Size 482KB
- SHA256 435093fc1bb55d5bc57136b238fdd5447c2458f85dd13e80e93f3b91b9bf5545
- MD5 2be8499b92ec7d81e1aa8afdc3d1a4f8
- SHA1 a9c1c928c3677be7ad4cff9bcc2070508b9329d2
- SHA512 d51128688b30efbeea02b67bfaeafd70bab1e4f501a50478ac846de4771ff1d9a89e1984e2b130979451f8515abb4f096a8e09bf49057bf837932b8a59ec4aa9
- SSDEEP 12288:tSuoaBH/WPOenZOhTtiXkBAixDHBw46RueZt:XoaBH/QOeZOTZD3w46AUt
- TLSH T121B4234B31608E61E0BB65933CC7BA74471F65744B7BCCAEAC6A84DDFACEC113192161
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bebb6646-8e27-4a45-b3e6-774797f5bed9\Tablet-App-Bar.json
- Size 56KB
- SHA256 c8c99a9dcb883f62b7f945fd4bd01db9500d1411a395d96d1697871a5050c1f5
- MD5 632c52f949f879424e87746fa2022de8
- SHA1 48a2637cdff6c418da9b299f929c5302e8af9878
- SHA512 d0a8939fafb69e72d8789ad03f46c142f029c61e778bd545c89f4ab28b475300437b88ff54f3265ab02eb2cbeadf7191a8057bdf8d275dfa929240c43389c9db
- SSDEEP 1536:GpIq61KUgBKXZDfkRlQZd7bjMrG0SnvGXHYb0qToxlB0AJQpy:GpIq61KUgBKXZDfkRlQZBbjMrG0SnyHP
- TLSH T1A44323C6467503DCFB0A6580CB4375D9DFC48C56BFC505ADEABA6C188BA9AAD2701F03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bebb6646-8e27-4a45-b3e6-774797f5bed9\logo-placeholder.pdf
- Size 8KB
- SHA256 ad4291db9df3462f0325e0345ae84503b615d03822e517293cc73f56d051e86b
- MD5 7e5c846942c4f6fd57f4af85e74e4814
- SHA1 a0adc26030085efd08f4b0d5f0f8e69c098ee76b
- SHA512 cf068112159bbe8328e0e750a5b20abd375a37fe008d13fd138a81d24c41c936ce1564f87f6ff297f633b989a674ce0a44effb21f49e659b15e477117390523d
- SSDEEP 96:k8shLDhrImkZPZlC4Y4oOz7Zw9spSQESk6vecqUJa9+l+vwv1L5P/xGZrNKpsH97:enchl2BQ1d2cqYaoz5Cd1
- TLSH T1D20210F222841AE8F006CE94DA1B385D25BE307FAEE185D9B5EDE735AB3119C59D4CC0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bebb6646-8e27-4a45-b3e6-774797f5bed9\templateInfo.json
- Size 158B
- SHA256 f403c3b1560ac6d01bb6123695c5ada745e80394b5b6cebe5bd21b7a56a11aaf
- MD5 ce90808290106d5332246db1a2ebb4c1
- SHA1 42466de030d200ca9142776da9bc79033e32929b
- SHA512 bd2cc45292f62157159605e438906039f921c3d974949f9cac5d7441092f04bcdc68db3503f27c878a12b7bee0f8632831467969ba275a5af4dce62596cd1846
- TLSH T1CBC08C6303291083293087E0143A239239315F8B1020EC9926BA68955D82F7852C2700
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261023172926_000_vcRuntimeMinimum_x64.log
- Size 4KB
- SHA256 56f774f8363eacb1007a2f4d125986654cc77fd753a9b06965a021ed4e0363d8
- MD5 5ec2ec823747cb2c936968b4573a63e4
- SHA1 4f4411f8efcde88fcbdee1e14f18426a7b6dfefc
- SHA512 974b918d05db8e285dbc203d434b01748422896262edfcefee065e6882261789098d261fbdc64b3077a3192271fd102da102905a9d09bf1880c4316de8db4718
- SSDEEP 96:Y60+OgIisyD8OhO7N+gUMfqi8ru6VKY8GPkNLdKFMw3:H0mVRThO7N+gU7bICsBdKFL3
- TLSH T14391011A5EE50816B2F79647AEF3C0214A33FCD69834874D23C5835A46A7C01BDAC7FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261023172926_001_vcRuntimeAdditional_x64.log
- Size 4KB
- SHA256 bd54f4d171a9d2b5948a8069c79a554247851ddd5b23a84e93386d770a8175c6
- MD5 a8212f41f865332e117ca3b6e53720bd
- SHA1 ded9110c0e43546329993559915bd3bcd25753b3
- SHA512 c30eb17951e648c48501fadca14c26b020f22931a7f3dd1cc2a790cef8569323673f4be46fb04ea873accf780b2b28a36b3e04b7485804a9440e90a2c7148a97
- SSDEEP 96:Y6g+OzO5aJFd6aLVLQ3Ouudwvbfwid6aLVL9Zcd6aLVLrBEKFME:HgFmiBLVLQ3OuudwvZLVLGLVLCKFN
- TLSH T1859109755EE80815F2B75647EEF3C0221A33FDD6A830CB4C2389831D466BD0599AC7BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5948_1848779502\CRX_INSTALL\_locales\en\messages.json
- Size 450B
- SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
- MD5 dbedf86fa9afb3a23dbb126674f166d2
- SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
- SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
- TLSH T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DE4C5D77-6A48-4B36-A5BE-DFEF1F615B8F}\MSVCRedist_x64Setup
- Size 17.9MB
- SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
- MD5 8da7373f3ec287fe1c3ad72a7b2922f0
- SHA1 46adcdfbe9aebe767657b7a802cc366f827ced77
- SHA512 c42c82cfd5eaa2165b600f6109cb14ff4308cdf4cff656a1375b4a933f1630bfe54c99c4d0fb9ed3bea4dc4e4fdaa3db8e7c58356cca07c2954f4c297757d62d
- SSDEEP 393216:rCpQ/hbBWGW1tkWSz61gUM0SOm53TgypRvlxoMtBpMw4OrW:rCpQpbQ1tBj1gR0SP53tRvlLpM2K
- TLSH T133173332A4742132F6F16437F968F1307E3CA72863D09D99D3C8AD99396488267F725B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{DE4C5D77-6A48-4B36-A5BE-DFEF1F615B8F}\WebView2Setup
- Size 1.7MB
- SHA256 0fb8d635f489d5c31f958508b4c6bb60f58eeeeedb3fd2b5e4e0eb6d45c1b57d
- MD5 6f6fc281ad1ac802463739eaf7d1da28
- SHA1 149228486812a6157138bd310b2388c2b51e5f74
- SHA512 84586f7bab544dc938c669cd4e72739f3e709f20bbe5866cea596f51d285cc3974b31947ab03cad92f5c089fa948b27312c501f39d2a5979fc4ed855b99b21b0
- SSDEEP 49152:nS43CXzADVF1FayRYOEslAGhYrXlohLoUfEubGmI6Z:nShADBFRzXAGhYrXlo9o2EVZW
- TLSH T1E6852210B2E18431E1B36C7149F0ABB28E7EFD714E64895B13856B2E1F31AA2D735367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Techsmith\features.json
- Size 317B
- SHA256 a6fb4f9a76588ff2157a0708d2b04e00425bef936266f32ae11257d9c48af290
- MD5 af7fa7142f21045bce7a16fcbb817f45
- SHA1 ae4be42c5bef0142ecc1fa0f74075d89021ca9f3
- SHA512 9c8967ffc8dc7c08ec074ff9359d242d805aa75584e66ae8b0794c26b29dc54fd697ce0be44b3f0d468b5fe75359247286cebe43a6c88d68637104d401c37aa0
- TLSH T190E0C257385205BC954B8B1DC03AC4040F930F9B38A37D84ECAE497830B2C304202ACD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\Camtasia.lnk
- Size 1KB
- SHA256 f670efea4851c756db2e4ff95225809485f77feaee73d997c61d887221b1e9c2
- MD5 c442e8076495e3912e0aa506e8462397
- SHA1 9a4ee2505dc9e5a5153fea463949af8b63774370
- SHA512 2a65ede1fcfdd14e7acd29b2c00fc51eabd1f6392a1d012d459a35333c250715f12d4cf3a72fdf4f931ce68f8b76674030f2112288a78bc8c2443075cf44cc12
- TLSH T19021BA108ED60B51E3F38D762A6757318272F805EA29D73A408D82091DB9270E928F17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\~amtasia.tmp
- Size 1KB
- SHA256 e33e3b77e7d921f411c0f26186bea435ffb4f9eeeaf4c2328c131f0ce07eb7e1
- MD5 c8c8c0a4562c4a5401b8209a546ef798
- SHA1 f45e1501caaf9103cbc6d43fd15392a4cf4fe848
- SHA512 eac11e1edc6773390e9db0723666dc709170117e5b44b574ca4eb9cfd0dd98acb88c71888c0da1506c71b6dfa8efaddf023e0352eeb94e447ac273c83e19ea70
- TLSH T1A021AB008EDA0B51E3F38D762B6757328272F845EA29D73A408D825D1D7D260DD38F17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\~amtasia.tmp
- Size 1KB
- SHA256 2bbb363d1abb2e80421c60503d913e37a6652b3f4ef636555eb49d9b36407403
- MD5 29ef8651562254e8ea3ef9fb39f86a9c
- SHA1 98f6aaf2e1c6b6725c16905fcfd7bd55076f2d05
- SHA512 002f19d81c2b2cd059b04111fa0243cfe7286eec5eea9760cb42d9853411ad0891fbae15653d88c6b79598bd9df0abfdc40eb61e34b9396e42b12c76f5c0b124
- TLSH T14421C9008EDA0B61E3F38C362B6757328272F806EA29D73A408D825C1D7D260DA38F13
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\TechSmith\Camtasia\License\653e1cae842f77e41a.lic
- Size 2KB
- SHA256 77fffc8fa39fb3d31d550eb08c67d5776e6652e6d73025bcf1107e02b678aa6b
- MD5 d74ba9e7cba3c3c58fa939e49892a606
- SHA1 47c757af5489ce2af5d3464319406d8289d7b3dc
- SHA512 7bf7f736cf3dc219eb5ca0230b8ff3775817f0351f1e150e77c9a1487c735d35d9cb2a2106441a43231d19bce8c2a53ec6426537ff8da76cdc35bf465a45a405
- TLSH T11341FA5F000CAD9883AF5227D44EE9AA271F63D483EED69E4996734609E217B8D09452
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\TechSmith\Camtasia\License\653e1cae842f77e41a.lic
- Size 2KB
- SHA256 724ac3c808186c2c0a87477d164a96501dcdb36f0f68b8869fa87c4a7695e337
- MD5 7623d3e27be878f5757f4003cacc7e53
- SHA1 3050ca9e5cf90eb5771f2a852cfd3b3ddb9d9d4e
- SHA512 fe1851183f94b1a53a8b526b0e326845a069b5880a479f25980ad03d174d9c96a241a38df24e8f4cbb3f7c559f5b4edf8ac7a8d48f3b2e43705c3b415b8b43b3
- TLSH T142413BACFC042C231E5B631AEFC8ECF3DF111192479134EAA37121811442B3CD727990
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\TechSmith\Camtasia\License\653e1cae842f77e41a.lic
- Size 2KB
- SHA256 a04bbb0f65fbafa8b1b91296ff3253847ab229e095573b044e7500f4acc9d3fe
- MD5 87fcc7fd87516553f3b8dc21e06d707d
- SHA1 e9d6daa2c46947075bb45d8feb51e55a6a40775b
- SHA512 8ff23f3c3dd5a3a8d8bcd19bf40a053e90fb69da0bd60d5d5d326a8301b58acee05af2ccd722b3663c334ae56db7449ce35d65176cb4955d0e4cb6a66aabd46b
- TLSH T16641FBC5E798B6FA44684863F67A9AD843EE7811A3B74C4834C8E6C91433B51F84DD0B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\TechSmith\Camtasia\License\653e1cae842f77e41a.lic
- Size 2KB
- SHA256 1002e009654a7b86035ccc417791c785b22a023304096838ce5a5ec701827b16
- MD5 96082b7853bd544db2cda97f62a6520b
- SHA1 65feb21bd830d71c63b2c9f9d9ed00cf25d937cb
- SHA512 69045f050ccb9b52a905c35f40647971b8b22046270a03a4e30b22ed6493e63aa8f9f38a8341bd34c460475887b25b2545ce7c6a083f205bbad14661165f8949
- TLSH T1ED412ABF921660CAB9DF0A47D4DD3DF5A36226B3002BEB480052B6C341C33E7AC2344A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\TechSmith\Camtasia\License\653e1cae842f77e41a.lic
- Size 2KB
- SHA256 cec14a8e9924ee85ed54cae966e966b0b1253142df645373a5f871e6e25ba200
- MD5 022b607f07f203b9e9f4a17c19452049
- SHA1 dc46a2dd01f5e6e58cc93eb95435a0840befc40f
- SHA512 36cea51d4da6faf9ac501d93be1b08dd4b628d1ef3993b39c1ee2d8b2858d489a3184ca4b0cbf23d41c90f84feb64ac15521f686fbbc9fcecd76d0f895ed1d98
- TLSH T10B413B54EDA1A9C82D0A1A3A8618392F2027654B8973FEFA50901FC206233B0EF4840B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\TechSmith\Camtasia\License\653e1cae842f77e41a.log
- Size 42KB
- SHA256 730f759868e4f504a537fa4442965d56cc474ee9fc4c8dfeef365d57fde42c5f
- MD5 d5e5d4e6df95ec4e461744f0988c6101
- SHA1 30a0965474ac8b8c824f6905a3228a6e15253906
- SHA512 a0ace87896fec438d33943ddfe93345589a80efa3d21f9ac4f658b027ff177892d75f7c5023a0b57b0b7fc62868ae8665aff4551a45096196d2070444ec78d6b
- SSDEEP 192:Od9xVxeSp8U8Qf3xdx7KRQ3tOkKOPKOPKOPKOPKOPKOPKOPcKOPK0vKOPKOPcKOZ:OPfAKpl/7NcXrcsItxTIzLJVBsb5ge
- TLSH T14913AF02B46C8D6C63663A55F82734633795CF9441463AB2ED2F82BEF31855A6C8E3DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI85DB.tmp
- Size 514KB
- SHA256 f5578e4e55f9eedc9386382a48f1be913d617d58f695eb8a754c8f05788b1c0c
- MD5 54eb37d485c2ab87e28036da91943e5c
- SHA1 180ee6b5750b3a5364fc6ef39ebb5a1989e8792d
- SHA512 63105f82ce797874b58e29a5aae1d647477292fa00aa639ba424dd79e6b6ac8fb9392d1865b876d68efee6119f1395d9374078e359121f2614f3cf4dc12cd97d
- SSDEEP 6144:v0J39rrXzgzQIQhh/1iraPae1dHYGI18NINMosRz2e1fxe6w6OY2B4DnOq4v2IMo:MJJr8Qh9Q3klU6S42e1w68Y2+DnO1x
- TLSH T1BEB4E00179D0C931E9FF593915788AA1867EB9A01F70C9CF23584DAB8E307C29B74B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI8D11.tmp
- Size 310KB
- SHA256 91f73c73a370fc16157270cb64502404681cd3adabc9afe7c11294e694f56715
- MD5 716914b26e26bc00643c97b427a6e27b
- SHA1 ca7a7ef536fe95088bab33206053645e97f80d33
- SHA512 128eae38f69f3085b1e3dbebb41802459ea6355309b8fd10345e8e0e4f46903f95944712cd0f20b1906bba0b8b555296af59bde644e5a2dd49d446582f7adec1
- SSDEEP 3072:RRdrITNkw/xJ9ifBh0xHNrXzgEg8HKH1raEe/VImepSFBXGcd8GFRHX9H24w0TX2:R0J39rrXzgzQIgh/JKcd8G73Lw0T8wPe
- TLSH T1A164BF0179D08931E9FE593915788AA19A7F7CA01F7089CF678C4D6E9E307C29B30B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA62C.tmp
- Size 310KB
- SHA256 436577c46907e7541e4fc049135416b0a5a26617b5dcbfbbe97c2fac2b03000c
- MD5 9d2feb72932eb75edb351f39d2c9c1fe
- SHA1 b18937639b44f0cc45df4361622d85297ee9c479
- SHA512 f8a9b3ef025f2a08d2d901c7eced6252b86b46eceb7f39bf964345ddcee4219f52bd2463f8b28eb02c0ff981529079993ee5cf08b145849acc7580365851dbfa
- SSDEEP 6144:W0J39rrXzgzQInh3EbPy3A4DxXkQPi6/kPIrkM0:NJJr8nhUUzeQPdr30
- TLSH T1DA64BF4179D48931E9FE593915788AA14A7F7CA01F70C9CF67480A6E8E307C29B30BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIB9E5.tmp
- Size 413KB
- SHA256 54febbd1f0a3875df16a4b88621cc0a10729b3c94b9a68639aab27d36fe39381
- MD5 ee729e752fa4e2e8b7755a138a188463
- SHA1 b0048f505d180d10feb1afa01cc4d3f5f15cf2a2
- SHA512 41a90d86894fbb1386099a6cccab416d88e76a4cadf83a90f8f91cf196a0feea2a4ab91daa6828303d8706cf9141ca1249425dac1df13d5d9ebd8958db909ba8
- SSDEEP 6144:0JqjGNa7YhzTvsGgFZFKjTMsAgzeF35cYr8XjuoY4zxR:SqjGaYh3UGgFjKgZF35VijuoYg
- TLSH T1E6946B29B3E418EDE4B682B6C5A78034FF75744D332095AF87A4952D1F3BAA430BB705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIBCF3.tmp
- Size 445KB
- SHA256 304b33c231e51964a41a0a0119a0222250f3a9e4b0162ec8c169a7b02092f36c
- MD5 eb4f8d449017a36fd3dad595a8b2ca4e
- SHA1 c92b70d49a529e826aefeed33a07b2d8777f1418
- SHA512 03839a8a37f09cb81f74bbb0ec3e13a2ee9a8a0e60986c38614049689be804f5699da38bc1dd6f78b7eda059f4bda036c4107585244dd88605e0ea2cfb909c81
- SSDEEP 6144:M2HnYlk/uqaM2q7xAfHwjnHl3ph0lhSMXlBXBWnc6KoNw:y3+xAfHwbl3ph0lhSMXlicC2
- TLSH T17BA4AE11B7E144BAE16B8674CDA70A05EB3278450751EBDF0394EAB66F237E05B3E702
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSICD51.tmp
- Size 196KB
- SHA256 548ae7115a58acca73d444311ebcf4fc5ec53ad881f6c9fffbb1261dfa7aca0a
- MD5 c61bb3f2674eba50f3fbd64f2f090cb5
- SHA1 93a5ab58e0739867c99c466308ba09888a90649d
- SHA512 bef880f8faf97613da2f436140f5237aefbe3e8acea79dc5b89b1af2a427ab349ae215959f35855fa47db92303ccf843f01f4e12447e4b455d6f623a1e763545
- SSDEEP 3072:/Dav2HGRnSh4PPM1QxKkTv1EDUVi7oysOrDA9G6u:ralnSieQMoOJsBM
- TLSH T1E6146D1572B404BAEC738674C9934912FA72B805236096EF43A48279DF2F7E4B57FB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSICE1D.tmp
- Size 201KB
- SHA256 f5066919f6e3aa39f98c88d187d9a8b43bf8dc6aa7f994b7fd85d018e24f8270
- MD5 6b4664a3ae875770e9cd204278eac598
- SHA1 55171557ae8eecfc92086b7425d456f03f59aea5
- SHA512 88d3b5ae27bb1bf42a530396d7387570e23313384a603520f45966fe50c3005f802bfade1b1241aa453e4f162eb075f956435b43048732ccb8028d9a52e86f17
- SSDEEP 3072:n3ZoR/qtDvkBfX1YkQ9GmM40U4FglKra8WDQIL1frcAJ4LCWrDlS:3ZoR/WABfKkNmKmS274Js
- TLSH T1DA147C6573A004B9ECB38234C9934A55EB72780523209AEF43A48679EF2F7E4A57F711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA18F312A20446E7B8BFF5827C70E11845\WebView2Loader.dll
- Size 113KB
- SHA256 6f59ad578fde1f65c44b6935dab0901f014b5268e056b930fb34c0919f1bf4b9
- MD5 7254e511f7bbc49652079d1bb2c737f1
- SHA1 4992f889460da4c97f8f8c33634a0a2f1ce17b76
- SHA512 5b40cd18b9b966dba1139befefa341977eebc23d288905d1529e319867ad73b471d9f2c85c6442f310afe981b01db0f01594775aec1a36e3e8fbfc21c8aba19f
- SSDEEP 3072:GeCt9WJtX8ri9f2+DP6zmDgqeNZPTLxEtJhAlC0Jf4fm3L:GT9WJtswdSzXVEtJ6Yq2m7
- TLSH T1F0B35B5175D08071E5BE1A380474DB659F3F79A0DFA09EEB27840AA94F717C0CE35E2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA8027257B0A4D9D4871EDC78D244CCD20\FuseCA.dll
- Size 12KB
- SHA256 383408798aeccdbaec22d3273427dc47f9c5bd97d9ab4de3a9b484287e7e03d1
- MD5 7add7d385daab9a8c77b642dd4e36761
- SHA1 ae03e8a4f89cf1248622f7e964b45d92598bd0f5
- SHA512 eeec3a31276b36871ae7043d26fc2fe0303f397f41e403294dde0da3aa3cb95d985f937dd3d03a263a294caf9a33c1ee62bc3e544f06605d94c4637574d593b4
- SSDEEP 192:JROIBk/D/cZE64RllluTJzD09cYfHXMHr9DvpdjKCqnkbI/OXSGsrqcEzZAN4D/m:JAIBm64RllloF09cO8HrUi/N4r
- TLSH T17C42FC2C93E19732FC795AFAAAE6C280D735D267C413D71E1CC601961D12E790A23BB1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCA8415A5F79942242A8D21105C9D5734EC\CustomAction.config
- Size 1KB
- SHA256 c3ec8ae85eb2ed845160f738bcab1e7309e15f75b6c934a0eaf41fb39d8b7351
- MD5 f8d737dbfeee5e70557564cd8fe07d80
- SHA1 038b4a48e55ac1e4f61414deb9a16540a8741d07
- SHA512 3ffb39b8b0c07f0370000518484f0333baeeb1b42bf09a4b83d394e5b8860d25c7e17846ff18dc385902409ae3c3296fab499cbecb5ef65f4b61f41156d34c9f
- TLSH T13D31538E0A056B7710322753AEED90C5D775A1AB3C54811C38AE9A2D3F36978137338F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\SFXCAA2271601CE40FDDAE376DCD85EEE66D5\WixToolset.Dtf.WindowsInstaller.dll
- Size 193KB
- SHA256 dd4120702e4cc794705c0ad23ce1eaa265310ab96064fd23947f6dff38e8e680
- MD5 599912457191503b65184f0d35a9dbc9
- SHA1 60790092e6249b194732a606ac9dd7ac291f66ce
- SHA512 cc07ae732a4cd1ba296a0f388b924c0b0280f2fde201409719087cae0c25fdcaec2af771d1734c64daa80c394832d3261e1675001e90a2fc046fda801833d60f
- SSDEEP 3072:UOf7tVL6+Yvj12FuDHYQj69UgoTqddHYCnfKlRUjW01Kyqx3GR8UQQ:UgTex224Qj6jomdT8x2R2Q
- TLSH T166149C2657F8473ECEFF8B78E2A14212C7B1F1E67203D71D5D8281A62163784B692397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\SFXCAFD18344BA44C29B835CDE5675532C415\CustomAction.config
- Size 1KB
- SHA256 a1e6633b99398ec69cf5e525934c091873cbcb49efc49a91e94598e80402ba79
- MD5 b834fe2448431793a308d78e7ea4f611
- SHA1 2a4af2e704f7217f355cf06cca9e0dc47c1e7959
- SHA512 1dd6d898e1454b600b4eaec01591fef7a20622e9ecb9b1757d7a7c6c4beded9df09f3497a2fcaf63cd675a2c9d5d1f059e89e1cc376b226793cb13802df8d0cf
- TLSH T13631538E0A066B7710322753AEED90C5D775A1AB3C55811C34AE9A293F36978137338F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\SFXCAFD18344BA44C29B835CDE5675532C415\FileSystemCA.dll
- Size 13KB
- SHA256 94469ed049506d2fd0e38e2915affadd4e6637acbf071aeb7a90e7aaee7bd958
- MD5 460a235798d160e5fc488a05d64d85db
- SHA1 0ab50c5ba756759b723584ee4654bbbf7383d7a5
- SHA512 e0c385a8964879d0ccd99be3d9331cba5e054984563ccae9b3555d5bb6d7f069518b8e83745a2b105e25d1975cd457cda37ae2179370c735d88409484c974ff4
- SSDEEP 192:TIBK+6/ZMXR3nF7pBiQWPCka7Vp2jfscGW2qmg2JaNDzuw:oXttiQoa7VdcGNqb5Ow
- TLSH T14F52E71833F90129E8FA7B75ECF759618B35FEA85432E71F1688500F067A3015AA277B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\Tmp3C64.tmp
- Size 2KB
- SHA256 c3eaf0f34277fdeff101e64d2cacde2e997bff742f77b107cc893dff0aa3f975
- MD5 d650af9b0f233e6ac63b8b04ef9cabb4
- SHA1 6d1f98da233dfd241fd5239ea5d9b22b462d9b16
- SHA512 2fb1de747ba936a1d7a26dacaad4e0066e7d8f683fcfeb57e68aee49405dccaf7ac4f7fc62cd86bc666f0c1a90ef22310b272b72824a0925f3e5d4d5250de9ab
- TLSH T148515CE993F2D800FC38CAAC183754890D50C7121FE011EB65609AFC6836E633E5D143
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7080_1202598151\manifest.json
- Size 118B
- SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
- MD5 acb0c12cc7e5345764763e37bcebbec8
- SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
- SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
- TLSH T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7080_1387984880\hyph-as.hyb
- Size 703B
- SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
- MD5 8961fdd3db036dd43002659a4e4a7365
- SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
- SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
- TLSH T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7080_1387984880\hyph-hi.hyb
- Size 687B
- SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
- MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
- SHA1 d0914fb069469d47a36d339ca70164253fccf022
- SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
- TLSH T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7080_1387984880\hyph-nb.hyb
- Size 141KB
- SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
- MD5 677edd1a17d50f0bd11783f58725d0e7
- SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
- SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
- SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
- TLSH T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7080_1387984880\manifest.json
- Size 82B
- SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
- MD5 2617c38bed67a4190fc499142b6f2867
- SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
- SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
- TLSH T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping7080_828059214\manifest.json
- Size 108B
- SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
- MD5 8e9357dbfee2ec0378af047a76d0b453
- SHA1 794f8cce8fbea87b2b62162769bee35c319ebfa0
- SHA512 85b5f52013803198e6af0ba37c9c3c66ce4bed4df5a7ee86ca1fc7c3658e2c973e92eed88fd36864d4743db44ad81fda7b24e70ef7530212e85b12c13d5db29d
- TLSH T1E2B012A13C007DBB1DCD03760060E3D783B63E0A1659190006DB6D422A4C9FB137253F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\TEMP\{DE4C5D77-6A48-4B36-A5BE-DFEF1F615B8F}\.ba\BootstrapperApplicationData.xml
- Size 23KB
- SHA256 4c3d6ab188eb09aaacd51b3ba2946519523ac06fd123c19ab6a9eec92fbc12e1
- MD5 e5cec4fb6474415550933e7373809cd8
- SHA1 464148ec5e237d32bbe5fc7319825124ca6cd328
- SHA512 8c8d70c54dc34d5b04c7df88543fe212fefda3bdcdae3b27363332e0fd9cd3e4a899ab295b6ae8d5e31120236e138123225bbbac40a88f22848a0fa31d980c9b
- SSDEEP 192:bR+4DrHpvv7lPO4sjbFfFOFSFhFnFOF8FLFxFUFoFHFeFoFuFQZFqF2+FYGFvFQj:Ob1tsNsXs4gjXO/l
- TLSH T1EFB2A6527BFE1208F1F39E88FBBA51551E76BD516E39C86D01602D0E49B3E41C862FA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\{DE4C5D77-6A48-4B36-A5BE-DFEF1F615B8F}\.ba\WPFCommonControls.dll
- Size 704KB
- SHA256 54a6818d8b3103cd4044f207b655dcec954e086088fd0a495627efc5b40462bd
- MD5 0c0114f11772ccdebd065e041bdd55d2
- SHA1 781dc5eed3b4f86760cbc787636c60b8bbc89ae8
- SHA512 23fe1840f8011dec38c35fd1effb09d3c66a48314b3b4453a869fe2744debc39ccdf1162a56bd586a8437b2d6af80ad5f06b682619eb6cdcb2cc779974d7698c
- SSDEEP 12288:zAi1CQVZYRes9ktJIsk21y2b5x+jv5Efjay9DRuDXz1:0GCQVZFDRuDXp
- TLSH T143E45B5433B444B2CF7F42F9409198949A3A796B52E59E053ACD27ACACE330B46473EF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\{DE4C5D77-6A48-4B36-A5BE-DFEF1F615B8F}\.ba\WixToolset.BootstrapperApplicationApi.dll
- Size 168KB
- SHA256 e881e65f0e83f20587ced7028aab8e53eb2a090bc0d66d8bc525040ee7ba5136
- MD5 33d68aa6ad22d0e3b4c44655e6eb61ce
- SHA1 447ee9bdf20e1bb7a361a4fff850a8d6b98a1368
- SHA512 116641ed3a5c173491a45c4022d1785d4dc92cf286222f0177d3cbe781470d5612cc1f3e08f3326b470d390c6364b8570e978a53bb9055c7ef080e6c36559174
- SSDEEP 3072:RyBmMtVxcKhL+N5KpjjV10d15g9clp0k9zazmNat:RKFWK2oNjVe15gelp39zazms
- TLSH T123F3281543E69073F287793EE0164B5386BAF9C914A2F3A956209DFF2D337061921BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\{DE4C5D77-6A48-4B36-A5BE-DFEF1F615B8F}\.ba\mbanative.dll
- Size 266KB
- SHA256 f4af0d9add791e808f39cc95e5fdcd0d4ab83841a6426ad67741646c25f2d18f
- MD5 06bf7d2069338dbaa4726b654bc9fafd
- SHA1 6682e57d8b5dad4ac6d56cfec28a18fa38d1d04c
- SHA512 b103060189053a4e9b7b493b87c8e97e4c1e0583fa372422e49f7e3b73083de63639f624a75ca0dfc723ab741d6fcaa30bff9c9d0e4e2d14edcffd31200c6187
- SSDEEP 3072:wLCukNn03t9bl+tshsQ1M7IfydIQhoNBCtGM/Ipq2nyP+/+y4CG3MVZk:sCu/3tX+ihsQ1AcyIdvM/Iw4GaG
- TLSH T14244F86170B48432C7FD1A76AA59F921AF78F104271084DBD310ED297A28DE977BB387
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{3DEA67B1-C0B6-4309-8324-6C350BE8B069}\.cr\vc_redist.x64.exe
- Size 615KB
- SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
- MD5 2de7a2a87f61fd6ead5276047feaf36c
- SHA1 d9a03aa94dfb0f485a9fd281d89d2edd499408f7
- SHA512 ea8dac8d0cf79b2d8302a4405ba2d44be8dbca316038d90f19bce6d0760685105771e87b1e905ff58e6ee10e154ec9ad6c00fc575dd8c82ea4eed856fb5569ac
- SSDEEP 12288:73mgqnIZuYfCYqFet4CovkM7RVYnE2EwCeYG1LM7d:73WnIZuMCxezot7rgd4e2d
- TLSH T1AAD48D32A5614033FBF105B3B928A6303E7CE728275188A9D7D4BD1D7EA84C1A7F7256
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{581EC6CA-388D-49DD-9C14-32DB7C0CB150}\.ba\BootstrapperApplicationData.xml
- Size 7KB
- SHA256 0af0673e1f3ca87701e3c00d5ff004fccb00e2a983df1d72671c429cfef7f3c5
- MD5 26b905ce74a8c0b0a30f538f87e6687a
- SHA1 6120047d20501f22e28b4016a1061637316623e8
- SHA512 8556763e3cc715810d96b3a4afc74bd8af1b1e84691654e0e17827f8f82567daa96461412f13fdadb675f8860e5c3a108f6990636ce44625cb319a8c08aafe4d
- SSDEEP 192:X0skADp8pTtHxLUrizLG0LPTtHJC5300I0dNBL5LYLVLGlLYLJolB:X0swtR0OJjTt4IAVEp+Ea
- TLSH T125F106642BFD0119F1F34F84EEF455629E76FC963938C81D01612E0E4972E819962FBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{581EC6CA-388D-49DD-9C14-32DB7C0CB150}\.ba\thm.wxl
- Size 3KB
- SHA256 21a76eb702fe727ca06de6632be2294ed1caa9e1d3798d01ed1428e0f40e19ea
- MD5 8d7baa10be22463697654d8aca5d2a1f
- SHA1 67a757111562a216f8b7da791a0151bb1b0fb3e4
- SHA512 9935a5da93d229ea879f1b1dba01ba42655517e68797bb65fcb0ad9c07f1bb92c2ddfbca702c256afd7cae81cac8d048e5f26db7bd9a5988b7098dab0f9dfddc
- TLSH T133519AA77CCF639028735125EAD2596A6920C19C923F2DF1FC4A914B838D532A373F57
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{581EC6CA-388D-49DD-9C14-32DB7C0CB150}\.ba\thm.xml
- Size 8KB
- SHA256 8d67851408a62b0f04dbaaddc588cd98499cf3630ec5df9f7c0699f0d367f79c
- MD5 c29a69f34ff31ff63c3ec6b2d4f903e5
- SHA1 44e58eb62821c8d023bc91b51975162841647abd
- SHA512 b46d13206c1a6064fe4857dc3de96769a773711fbdf5f8cc979216bd6b8e62703f1bdc3d3b86ed07405249613eb22697f0cdd039963f741bf2b13a4e3addd199
- SSDEEP 96:8L2HdQG+3UzHfz96zYFGaPSWXdHRAmImlqFQKFBiUxn7ye5tM82rkO/pWL3nswP:ZH9z//S
- TLSH T126026AB546DDB801D232FB1166E231D27F126971C0C46E99F90C3AFB5FE1140A8B72AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{AFAFCF5A-7C57-4D5F-845D-4B53194D42FD}\.ba\wixstdba.dll
- Size 191KB
- SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
- MD5 eab9caf4277829abdf6223ec1efa0edd
- SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
- SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
- SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
- TLSH T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{DB4EC45F-80BF-4EB6-B9AC-402BAAFAD25C}\.ba\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- TLSH T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{DB4EC45F-80BF-4EB6-B9AC-402BAAFAD25C}\.ba\wixstdba.dll
- Size 215KB
- SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
- MD5 f68f43f809840328f4e993a54b0d5e62
- SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
- SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
- SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
- TLSH T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{DB4EC45F-80BF-4EB6-B9AC-402BAAFAD25C}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
- Size 5.4MB
- SHA256 19c0cdc59ae89d0491c025a966f6d40515adc2449af40f2c6c6f52e2f293ad1c
- MD5 6686bcb455d5f62a61d86891d16181c9
- SHA1 d6058d6c6ef18488234d63cbfa4f7fd1db7cd3d1
- SHA512 08f0d948fe7d775b138c8e82c5cb4440da313f3ba3b194093949cac9c74551b6660a70575bf06d8dffdd457e7dbc84cbe06986dcfbcd47864c461079c493864f
- SSDEEP 98304:IxLTWXWLzK9s4JjKw6DikdiE6UXdw2Ar8NmIcdG3LCFPnlXv1jtAol/QXAEDI:MLzK9sQKpBlw20PIcdnFflXNBl+DI
- TLSH T10C46335E6D3632190494BC0A4E95EF68C270F23D27D71D11A188EB113A167A6FAFF0CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{DB4EC45F-80BF-4EB6-B9AC-402BAAFAD25C}\cab5046A8AB272BF37297BB7928664C9503
- Size 1.0MB
- SHA256 6e8ee73933678c55973e83366e48e948b394c7a36743a36b7224c95de979b13f
- MD5 6ec3f250b554e0d25091313f9ec4f4c2
- SHA1 21a16c194602bd649d37d0a27b21b9e60171e8b5
- SHA512 cef3af4a024ebdb1b4ea6ac80ad5af5f3ceae80344c7582019ed8a94a632d817e460f91544da77aa967031f8c6195dbc24d4742ea7a52780440de73ccdc63fc3
- SSDEEP 24576:OMOHVhmG5++niVUuK2O7UB0yKHP3goh4Q5keEuAQdTWBf7e:SFUVUunOQWVHP3gY4YBWte
- TLSH T124353352B882B059D5535A26CFFA114ABC9773B25CA6C3B401CC26C8BF7D349A277CC5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{DB4EC45F-80BF-4EB6-B9AC-402BAAFAD25C}\vcRuntimeAdditional_x64
- Size 208KB
- SHA256 476427800c1c958dc4e71d9a0f2f3983b2608da70835db9ee5f3b8ac387e9617
- MD5 84c946189fda9171c59b683de5d603d2
- SHA1 4f96a4bb0f64451ca98c1b7824763f2a9bc24dfc
- SHA512 ec1dad777ee1f27de02f097ce1175b3ef64c3e65d6a97361f3b9ad6ca61ba9f3cd9c4002f51e69c31df1126e4bf589910003b5796df9e1d631eab864eb7931fe
- SSDEEP 3072:c9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT65yRW:alaZeKFxCnBheIdluyS
- TLSH T19824AF12B5808033DAFE1A311178DB615F3DBE608F544A9B6364B6AD1E717C08F369B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{DE4C5D77-6A48-4B36-A5BE-DFEF1F615B8F}\.ba\CamtasiaInstallerUI.exe
- Size 911KB
- SHA256 a247c4900c738171d13a6365650f736fa4c9357cbafe47b6cab468679daca416
- MD5 473684fb76f7b90a0e5b00c1c3fadd3c
- SHA1 e5acbe05bc865dfc72b2b6433f50ffdb89716845
- SHA512 3c5ee870f302421e6bb1a18e8f1159d021b3f5c069b386a80f97d5709911a1f3ea887e108b8cc97150866d18805002995c71d24bbc3f2334d6c7c43eaa54109c
- SSDEEP 12288:ixLha6Mfv32KwxUc1iLiZ9SSMRoHQkupWiO0P:yahvGV1i9SMRJrP
- TLSH T197158CA826010339F2B29370FC55F1946EF9F8003476A995715EA1AD5FBAF8DC23724B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{DE4C5D77-6A48-4B36-A5BE-DFEF1F615B8F}\.ba\EditionConstants.dll
- Size 24KB
- SHA256 08f3aae62a3980b0a42f933378fc060d4326faeab9edfb1de8c909bbee180675
- MD5 fd684ecf9840f8876bc78cafcc9a8237
- SHA1 bbb17cf0a39e0b2699d482e570a33a0ad6c54b17
- SHA512 c81a8875959d441cdc20d1da9708f022c18b7d34fb0e20adcd755d3561714ec8361e3ae1b0d3d7532859f9ff878fa544f3077cdb151dea0f636460428f52b88b
- SSDEEP 384:Tna4oipbJ6mbOrhqjW2MWe1EZY6N0q+EaX2NHQIYifspwaJfy8RbmL4nNyJ4HQ2:zaE6upW2MyY6N0caX2R5Yifs+aJf5ALo
- TLSH T1F3B28D27CBA88525EE7B8E3474C445326BB0B5C87D51CBEB214CC1598B737042B7A33A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{DE4C5D77-6A48-4B36-A5BE-DFEF1F615B8F}\.ba\Microsoft.Xaml.Behaviors.dll
- Size 141KB
- SHA256 b864da9d88414877cea9b1a016146265a5fb9d0e12f4dbb1dccc0cc998119a54
- MD5 ec5a1abee150abe698689211b07cd1ec
- SHA1 affc3cb47da8fe76986d271cdc3e7ea345cc04e5
- SHA512 a2b55b4ffc3f11546ed8d3457e98b986c089e25229bd687da35d45d63e4860722e8b13826d3a3daa1be843cf3a4ae3da4cf9b6fdcb5d1a4948648537e683789f
- SSDEEP 3072:UAyazS96IT0O6gAf+LwCMe1u051dXcr9/soMEs5r/j9:tyhYIT0O65cwCMyE
- TLSH T1AAE34B9593FC8A2EC7FF0635E0B451145631F757B923DB4D6EC0A1AD0993382A6223BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{DE4C5D77-6A48-4B36-A5BE-DFEF1F615B8F}\.ba\WPFCommonViewModel.dll
- Size 34KB
- SHA256 3437cd2f904d8222f72c7e0d6aec450c1ca0cbbe95cfe214355e25db1b11d213
- MD5 ca6abbc2ac13622c3120b315c3508430
- SHA1 62c888d6e1bfdeae3554d7358a615513f948bfc6
- SHA512 5f2821b6d54a6627c93592f1ce2db0bb2554a4dca0f07cddf0f2d71635fda559dc862306a9f7e8e59a8b333e671f8ff649b8cc2fccdf4840134014843abef649
- SSDEEP 768:04yiw4jtZ6D5QlhPpyuQ9PxIx8tQ5Yifsvtm5AL/z:04twsfrlhPpydxg8tC7Ij
- TLSH T1C4F26D52979C8522CB5F2E79BCF417225EF2FA466D22D397310C92961F933001AA53FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{DE4C5D77-6A48-4B36-A5BE-DFEF1F615B8F}\.be\CamtasiaInstaller.exe
- Size 1.8MB
- SHA256 b200a99af8fca4891b5a29c73bb9dcb0223b70790003e5acdb153f1374089c33
- MD5 eed7d8e90271c3d6413997d698b245aa
- SHA1 aad069fd0eadbbc6a8a68c92b3982f295c38d114
- SHA512 6e828671285504ae824124713d9f7528e729b8841ccc18e348ee98e36bdb8f8b5afe4a590fc0b3fcf86004a929833ed3ee6f30fecf6861b349da80c4f66c84d7
- SSDEEP 49152:mNvQJoafzshjNvJg5sV8oU/weAbyogc8tn:mNvQJoKzmx254Nbzgc89
- TLSH T10195D031A165242BE6F40973F910D2307E2CE7082B5C55A6C6D0ED1C7D689EA6FFB24B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\Bootstrapper.de-DE.wxl
- Size 953B
- SHA256 6051e0b497531c84481f13326cb7780e46424a68a2fb5f37c6f52995b8131832
- MD5 0fcd8005b466394845bb72b46f3f8506
- SHA1 800a42f3643d22fb6d4e5256fd2ab7f54de7a19d
- SHA512 a980d3aece2c3f67ca952c4ccaed9b30919b230d9a6c3399e7f45a90ddf298951f3d41d26efdeb3547ddd26a499da68442f297d3a99945807445e62fd09ee30d
- TLSH T10311101A17F1AA4565BBA7ED13ABB7C27C3672964353400141F20013BB731B75317A93
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\Bootstrapper.en-US.wxl
- Size 852B
- SHA256 f925d2acf372e06fe0040fff71740fd6a2176b52fabd72f7804414e2a9b2680f
- MD5 b0252da43aa57617ee827dee0e8f3d4d
- SHA1 c258cf62d5d38e9cc72bca53d3ff34ab35f4e8a4
- SHA512 444eb8e7ec6cdf2725c9d82196e6552b83b90e86832763d3b00575388bd27cb8d09d98aacd73d75de33992a000ed48f8bb4f2fb4169102c1df460871b161d376
- TLSH T13001125C57F5A7D16537D6A572AB71C21C37F06A0343415090F60053FBB31456323962
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\Bootstrapper.es-ES.wxl
- Size 896B
- SHA256 7a03ae9442369ce6d8455f809e6068e3e5f779cedc07d7f26bee0d204fa0ef59
- MD5 ed7fe8558dfabc62c4a49168dc7788b8
- SHA1 b2e83d4d2cef64d0ba9349d60a8f618dee993ebd
- SHA512 ee22fec6756aed508ad82de8eb9348c6356270bbfb9d3e36b125f6615df7296e1b6eef3c1d165407b63f7371e37cc231a50fe743ec7e6eaa82a3a929f2917c37
- TLSH T1B411C09C11DE5882767B909D2657F2C7C977B12A5943819090BD1063F7B35495327453
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\Bootstrapper.fr-FR.wxl
- Size 1KB
- SHA256 39eee678cd331945fa7b9be883a1fe9334bc137c757678de39fa9b22d60a62dc
- MD5 dded99ea03f6f8de2b1b8099aef26187
- SHA1 a301aa10d67ce4f29d3133ecd43dea969b89bb94
- SHA512 ec2640f89cabfc2457e3d437b7103284f028b1ee0f3bd593523c3674db7ca65484aa467c8dd73e8d18ebb27f883dd4dbdcbe4b594126c570e18adeb3e6afaa7a
- TLSH T1C111259E52E515D324FB52566293F3D355367289C67742A0D1B70013ABA70D263934A3
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\Bootstrapper.ja-JP.wxl
- Size 1KB
- SHA256 628784b5050834ffdd4f2ee93ea1c671cdb70caa40fb08d74b14b656f3027ebe
- MD5 6b4362423ece44433303f86b6889471c
- SHA1 7952539b1370275681a955bb1d90ae0eb6cea1fe
- SHA512 28866d86eda1136afd47db8768623079197f93827b90b2505ea4609956f238bdd9d1b51f55b9721a96cc354dbb12acdff96dec19c6ccb837683b82cf3f355292
- TLSH T1AA21797ED1C16D92AA76A071295E72C6A84B1C95CE57227050BCC003BA722EEC203631
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\Bootstrapper.pt-BR.wxl
- Size 914B
- SHA256 29cc46c8d4f3110f1cf63a5f7e671354d6ded5fd25740f91a7c36e8dd61bab1b
- MD5 31e2251566684ad6a96bd8559ec1dd42
- SHA1 8ad3b67016bdc86ddc6b42249cee4907f5dfd8c8
- SHA512 353b02aec9c3972f3c47041902f9eea96ad6f2e93e5e1ca8a35f5625517cd49bd1d69ab34cbe7f59d7c372a49975ceab0504e9276e531cca9330b0015cd420a2
- TLSH T1DC11231D02D64582BB7A52792377BFC39895B09F0B5B828290F70143FBF3486A323923
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\Bootstrapper.zh-CN.wxl
- Size 803B
- SHA256 53d724cef4446d9a171e0c8076ca386fb268aa987a2c008db2abdb779af7a4ad
- MD5 a9f4cd877c3dcc010265bfdb540ac2db
- SHA1 399272b8566257da9a05675701b4622d3c2cf276
- SHA512 1cd6aca9079deced7b1a2b83888a1166af09f4110df5ca054f507a8cde7f263ec3bfadd392f0751811e6fb1c54f3459bf10db091aec2d6d8bb1938d6f7ad5864
- TLSH T17601F6EA05A61DC101BBE1D137BBB38AE43A557A47C1D5E051601013FF6706B5753457
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\BootstrapperExtensionData.xml
- Size 276B
- SHA256 258fac237622533e7f9ec3f95bcec8abcc31ae87e2017e5717af0841c61e9df4
- MD5 240bac991e5860465ce0dfd580ea7cb3
- SHA1 a352934cbb14ab877883ac219ceb78c92e27f495
- SHA512 67ff8063a071436ae7dca8ee12ad1991bb70752dcc63f00f129f38dffa1aaf9299fff591fc67dbf4d2fdc57a9242831b149d575181b84857cd4f22463076f315
- TLSH T1DAD05E432FBE2304F1B30F49A6BA94102475BE009D78CC6D0228080C0573D92C8B2F77
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\TechSmith.Win32.dll
- Size 51KB
- SHA256 96345f7e67b38ff4f68647554b3ec9d0464e6f76776359411b1a7e7519a65cde
- MD5 72bf10b262cb22df329980e2af7201f5
- SHA1 7ce5a910dce04e037fcaec942e7e80bd7cfb5b38
- SHA512 6f8fb19d10cbd7a76b263ff97747980d6cc797840c36d82284837cfe7b04486e8094a8d7e9b618aa84cece0625f6611ea73bba03dd8024d5a6a0c881772e8362
- SSDEEP 768:7CUTV5o/GWCBzaEhefLXVxWz8IqIGZ3Q9TBwAsj85Yifsj5ALV:7CUvLhebyz8IqIGZkTBwtG7r
- TLSH T119338D86E35024A3CC6F8B7B61A30F02C7B1AD86CA1BD3F361968125D9B77950DC9BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\TechSmith.WinForms.dll
- Size 23KB
- SHA256 8f67073c4e728349b1d062d4e99ca18a3cf41b37c028c4c621afc494ec6a1ba8
- MD5 4af6fc99cf9c1e6a1552bba4804a1fe3
- SHA1 8ad6e8542dd5737473c64c556e1447b0747c312c
- SHA512 d3ef373adbbb0ec72a3791d99b33b85e7de28cb3cbe55395437ceeca06c2966a8f46826e0f9788636e96b0fe9da6d8c3eb7f4a84a5511300f80dc42da234b64c
- SSDEEP 384:yr7/PoxEvLNrmarF+Dw/sE+nc0t7HQIYifsq1Fvqy8RbmL4nNyo6SJ:yr0xEvJrmaZ5gr5YifsqC5ALW5
- TLSH T101B27B2683A44418EEAF4F35F4D392359EF5B1449D40DAC729CCD22A8F663442B9E3F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\WixToolset.Mba.Host.config
- Size 586B
- SHA256 2a4e7466c1cce6a9aa972e1e56a6f9436c73f71b90f73607336a76640950384d
- MD5 35a355048759695efd65d5c59e5d6231
- SHA1 db6ebf835797aea954adc9a8c0069b37f1da3d2b
- SHA512 fc1169699eef4a61d66af64b7ddbb8db7e2daffec29c9326f7ab70d57e1d9d19c3e4a807495cfe7e0907977e9c8d564f652f7a9b467d259289cc83d617df934a
- TLSH T14AF0C28492D0BD5187230A2FB6964155BBB0B2B241944848B1BE7A671F6719A3E4333B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\de-DE\CamtasiaInstallerUI.resources.dll
- Size 233KB
- SHA256 352a1cb646f9159a62b769efee7f09f07d5d0c7c8cceab9ac7f80bd85d79ba8d
- MD5 45517c0ee566fbc7744296a3b680db0f
- SHA1 4aa3965e82b913245655eccaf7a12fdcfc0f991d
- SHA512 ee399fc396becc101a187d20c789eada51f43920ebd54119f3a4c32625450d4bf18aa50f5c2309473382360cf743c7c75872d81350425d1c411b4d7e8130f44f
- SSDEEP 3072:Q33RH5Y7/5JKU4NjnLGZMI1at8QwcB9c5cDDTt9:irRyumat8QL9acDD/
- TLSH T19F3486FC05C25785F2B1A7A0ED11F8C87DF5E01520776098726EC2BEA17FDAAD16A813
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\es-ES\CamtasiaInstallerUI.resources.dll
- Size 99KB
- SHA256 23dd89cc930acc7d3c0bf6901f900ea96fb117f57d64b238b8df963c8847e1c9
- MD5 444edb0cd5b5fd33b2aab05ba1105d00
- SHA1 120c2aaa503e1c005406a7dab528d9598a6bd896
- SHA512 822ef4e80f4b720b99d56c84feab0e020c0cb5c852714ecac2bdc2f79edc50a8802f098e373b8810ba7ba4652cea2cf18e7f7c0f95f2870382b46976e615ba87
- SSDEEP 1536:QI03fSZaUtdS1Rwoxyma3YbUHzDO7JDhbq0iB0PfWKnB7nGUCnABpn++jviIK+DJ:Q33fSZaUtdS1e6tNqwmd0nZ7DsFJC
- TLSH T188A33B35AED40754F5F30375AB83E663E6B874C87C0CC0D6999E871820EDE88D17AE99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\fr-FR\CamtasiaInstallerUI.resources.dll
- Size 274KB
- SHA256 c148092346b3bafc827b6d82985db5ce05b03bec20f098916b8f72aa102c8525
- MD5 87b446ffc678dfb4a5be885d283c4a15
- SHA1 0821668f49888cdd5413d35ccfab7e23841c0571
- SHA512 453fbb02376aef29635b118128c0616244ab519fa3e3a372cbdff3823ee959097caac1aed3b2eda6cb6b070567aa063e27d40cd0db99104014bbb3d4a890ba4a
- SSDEEP 3072:G33D52TSfnnuEoXtQKxdpxGS3NcdexbVVc5cLD5AH:BCoXn/cS9cd4VVacLDM
- TLSH T16D5473FC45C25293E66183A5EC52F49CACF5D404203BA151A26BC1FAA47FEBBD1B7807
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\ja-JP\CamtasiaInstallerUI.resources.dll
- Size 205KB
- SHA256 ddefe9c8b76615c611206ddb86c9753dd20678278b494cea9494e7c82aed5672
- MD5 38d559a62016a1080521e2a90e0c2415
- SHA1 262bd6ba33593d90a3d064e46e5e2a0043240471
- SHA512 29edc585ff5e3da37183eb78e2efd1e18fca7a397b430a6123184963401362c25b703e69f695bb01ddde179188bf4b156ce34b53078a95a445f0dbb7324f1a6d
- SSDEEP 3072:833bbbOCyO9SCx41yYfLiqmeA5+i7hGBDBfp6:xDm
- TLSH T14C24F81BB5A4B93C6DD456AE9F16A4F96BEF18028F72F103B81D6303081A14ED787372
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\pt-BR\CamtasiaInstallerUI.resources.dll
- Size 100KB
- SHA256 cc1143b1397edb195448e507a46fe7ec1d842a6241f19d06d42a034c1125acb3
- MD5 2f61bf74a05d7c4c2d600c3c46b6fdb3
- SHA1 dde962641ebea42d11c846e781c126c710644ce0
- SHA512 43715929281d047540cfc9c75f370ea6a804884ac79b97609ff40ce84bce98b6970698c3979ef70069ae51b010f0e21e69e4cbaf7d0670d11d58594d1dce8b5a
- SSDEEP 1536:kI03+o2vshk3/v+iwfWcJIxBfh62dyWmQZiIquLu8wgmyDlHCX8NGKR0Dex27N:k33+o2vshk3/v8exBJfmQZPFCe8Dc2h
- TLSH T105A3097D9FD40318E97303707B93D153DBA9A484AC4DC08AD6EF860652EFA14E1B772A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{ECA52B21-337F-4760-A22E-045D32AB0614}\.ba\zh-CN\CamtasiaInstallerUI.resources.dll
- Size 134KB
- SHA256 dbef278cbf7cf19a6e3479e3c2b9902a804890525933d5940d40e3e81703a879
- MD5 23595a9179c774b5bbc5565e1abbdd56
- SHA1 016538ba261abbadafa20659a3b63a702706d279
- SHA512 8c64ad262a6aae62ec1a84c0d6b81dff8f5a6fbc6fdb35d8c6d873f6071e686bc65f424306e88efcde0b16468f258ebf943c8df94fb8c9ec36683eadd7ec8d0d
- SSDEEP 768:sIhm3lV0D9vZ4e0ngIgE8cavC6damR5nsZD/DiDymk1htx6I6lIqKYMszpO5KTlk:sI03l2tZ4e0ng/493HeD9xk7Rp
- TLSH T14CD36845E9756D5DD4D25B3FAA3A90E57AFA560FDEFD41028E6F2303083792EC183882
- MD5 SHA1 SHA512 SSDEEP TLSH