2569595539c28392ba776e0a2ee64ba8086c0251e12e1642933e02ad8ad3423b

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
omnicontrol.exe
Size 63.1MB
Sample261107-vbrk6set7p
SHA256 2569595539c28392ba776e0a2ee64ba8086c0251e12e1642933e02ad8ad3423b
MD5 b0c07e4699f567efadba426046f50560
SHA1 cd2b2b82634834d3e5a7b756978352b97eabf391
SHA512 fa29adeb60b1d5c4a2f47bb00e412c62e64185fe458c6d90a549576a62855883b20403772405934fb27918e4a03afb45fb411cb1c3b759defe470076cd752a63
SSDEEP 1572864:3EFfXz5KPw671DT9qggmlCm+DL4KXthGb:0z0Pw679BjgmwZ5Xt
TLSH
T19AE7AE157A5F99ACD49BC87083478A734E2130DB0A36B9BF44C452393F7ABF46B29319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	omnicontrol.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Filtering Rules	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Part-DE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Part-NL	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Part-ZH	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_1908813347\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_1805809106\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\adblock_snippet.js	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Part-IT	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Part-RU	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_1805809106\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Part-ES	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Part-FR	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_1908813347\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_1805809106\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5744_1908813347\protocols.json	msedgewebview2.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4884	sc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	omnicontrol.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	omnicontrol.exe

System Service Discovery 1 TTPs
Adversaries may try to gather information about registered local system services.
discovery

System Service Discovery
T1007

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	omnicontrol.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	omnicontrol.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	omnicontrol.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	omnicontrol.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	omnicontrol.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	omnicontrol.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	omnicontrol.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	omnicontrol.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{46CAA903-F818-416D-8FEA-444C7D796FED}	omnicontrol.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4720	msedgewebview2.exe
4720	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2316	omnicontrol.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5744	msedgewebview2.exe
5744	msedgewebview2.exe
5744	msedgewebview2.exe
5744	msedgewebview2.exe
5744	msedgewebview2.exe
5744	msedgewebview2.exe
5744	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2316	omnicontrol.exe
2316	omnicontrol.exe
2316	omnicontrol.exe
2316	omnicontrol.exe
2316	omnicontrol.exe
2316	omnicontrol.exe
2316	omnicontrol.exe
2316	omnicontrol.exe
2316	omnicontrol.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2316	omnicontrol.exe
2316	omnicontrol.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 5744	2316	omnicontrol.exe	85
PID 5744 wrote to memory of 5216	5744	msedgewebview2.exe	86
PID 5744 wrote to memory of 3412	5744	msedgewebview2.exe	87
PID 5744 wrote to memory of 3412	5744	msedgewebview2.exe	87
PID 5744 wrote to memory of 3412	5744	msedgewebview2.exe	87
PID 5744 wrote to memory of 2760	5744	msedgewebview2.exe	88
PID 5744 wrote to memory of 3700	5744	msedgewebview2.exe	89
PID 5744 wrote to memory of 3700	5744	msedgewebview2.exe	89
PID 5744 wrote to memory of 5404	5744	msedgewebview2.exe	90
PID 5744 wrote to memory of 5404	5744	msedgewebview2.exe	90
PID 5744 wrote to memory of 5404	5744	msedgewebview2.exe	90
PID 5744 wrote to memory of 5656	5744	msedgewebview2.exe	91
PID 5744 wrote to memory of 5656	5744	msedgewebview2.exe	91
PID 5744 wrote to memory of 5656	5744	msedgewebview2.exe	91
PID 5744 wrote to memory of 4468	5744	msedgewebview2.exe	92
PID 5744 wrote to memory of 4468	5744	msedgewebview2.exe	92
PID 5744 wrote to memory of 4468	5744	msedgewebview2.exe	92
PID 5744 wrote to memory of 5456	5744	msedgewebview2.exe	93
PID 5744 wrote to memory of 5456	5744	msedgewebview2.exe	93
PID 5744 wrote to memory of 5456	5744	msedgewebview2.exe	93
PID 2316 wrote to memory of 4884	2316	omnicontrol.exe	94
PID 2316 wrote to memory of 4740	2316	omnicontrol.exe	96
PID 5744 wrote to memory of 3608	5744	msedgewebview2.exe	98
PID 5744 wrote to memory of 3608	5744	msedgewebview2.exe	98
PID 5744 wrote to memory of 3608	5744	msedgewebview2.exe	98
PID 5744 wrote to memory of 4816	5744	msedgewebview2.exe	99
PID 5744 wrote to memory of 4816	5744	msedgewebview2.exe	99
PID 5744 wrote to memory of 4816	5744	msedgewebview2.exe	99
PID 5744 wrote to memory of 4212	5744	msedgewebview2.exe	100
PID 5744 wrote to memory of 4212	5744	msedgewebview2.exe	100
PID 5744 wrote to memory of 4212	5744	msedgewebview2.exe	100
PID 5744 wrote to memory of 1404	5744	msedgewebview2.exe	116
PID 5744 wrote to memory of 1404	5744	msedgewebview2.exe	116
PID 5744 wrote to memory of 4708	5744	msedgewebview2.exe	117
PID 5744 wrote to memory of 4708	5744	msedgewebview2.exe	117
PID 5744 wrote to memory of 4720	5744	msedgewebview2.exe	118
PID 5744 wrote to memory of 4236	5744	msedgewebview2.exe	119
PID 5744 wrote to memory of 4236	5744	msedgewebview2.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\omnicontrol.exe
"C:\Users\Admin\AppData\Local\Temp\omnicontrol.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection,CalculateNativeWinOcclusion --disable-renderer-backgrounding --lang=en-US --mojo-named-platform-channel-pipe=2316.5724.18252059546016583533
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x118,0x7ffe3756b078,0x7ffe3756b084,0x7ffe3756b090
    3⤵
    PID:5216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1684,i,434882061121456795,16203141444640199522,262144 --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1676 /prefetch:2
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2016,i,434882061121456795,16203141444640199522,262144 --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:3
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1716,i,434882061121456795,16203141444640199522,262144 --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3692,i,434882061121456795,16203141444640199522,262144 --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3908,i,434882061121456795,16203141444640199522,262144 --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4308,i,434882061121456795,16203141444640199522,262144 --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4588,i,434882061121456795,16203141444640199522,262144 --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4796,i,434882061121456795,16203141444640199522,262144 --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4712,i,434882061121456795,16203141444640199522,262144 --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=5020,i,434882061121456795,16203141444640199522,262144 --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=6080,i,434882061121456795,16203141444640199522,262144 --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=6112,i,434882061121456795,16203141444640199522,262144 --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6116,i,434882061121456795,16203141444640199522,262144 --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4720
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView" --webview-exe-name=omnicontrol.exe --webview-exe-version=3.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5216,i,434882061121456795,16203141444640199522,262144 --disable-features=CalculateNativeWinOcclusion,msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
    3⤵
    PID:4236
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query OmniMouseFilter
  2⤵
  - Launches sc.exe
  PID:4884
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Query /TN OmniControl-MouseFilter-SelfHeal /FO LIST /V
  2⤵
  PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Service Discovery

T1007

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5744_1805809106\manifest.fingerprint
Size 66B
SHA256 7ad6d17bd7b1bf49425f7efe322f4a9065446eca71d3ea1ebe0a838efcb08e95
MD5 fa32cf839f99432676ca9acccd8a0550
SHA1 9a869d2475f9840495188509e12ce9ca5a9e7189
SHA512 b1e901d92adecc46f96f52ac38954688f0a2514710041109785656ffe694766448cdbafcda397e9edb196763997d952537ebfefb4e5d128954576024f8856c04
TLSH
T1C5A00216AEA0E812F29486DEC4254B6A14372BF9AE76008979E8E4819C87260815B8D5
MD5 SHA1 SHA512 TLSH

Submit Download

Filtering Rules

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules-AA

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Filtering Rules-AA
Size 2.3MB
SHA256 95beb1f39b4cd5b29f5ebaced4a33753fb0bb876f078ed3de041f12be16cec5c
MD5 b91a6cf79bedefedcb5603d3477cc3ed
SHA1 b3512a426a6a613f8cdf7f9ae3a0d02b700d1843
SHA512 9d85945f7f963fd9277adc20a0af459e8bb5904ef7038584e510ebd041b3029bf24ecae2047b24ecfa853154beef7e2bc5bd34ff8d90aeda000fbcdde741341d
SSDEEP 12288:DUoPNPlfiCBGkqNEWymqMD2N3FRgVfFRg3oFRgHsFRg/sFRg7dFRgImFRgJ1FRgs:JNhiSGkqdT5+9
TLSH
T189B51BF69947509145B9631938ADB2C82B14A28147ECCBF2EBB4C4AA2791DC737C05FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules-CA

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Filtering Rules-CA
Size 11KB
SHA256 65aa171487dca70aad69973d0459c6a4b0882fcc6223bdfb53cd9ab711c5b125
MD5 40b3ba01a09be340fdf879f97b31c867
SHA1 b6ac58d1653c1b76e0e9898b17cfea3e6b56de94
SHA512 97f82f162588a761a13a2efd38d2c9518954400c7898cdd12923ce26e90818d94310b4a9f2a2cb2f55f5101c9a2e177dc1b14de8c9486eafc910271e2991dea9
SSDEEP 96:MKSlCviF3P2DoTc+cTKSlCviF3P2Do3lTKSlCviF3P2DoT:MaviVucryaviVualTaviVuC
TLSH
T17C3275333E488D6792A4C1A0DC92752C9E3087D98C9CBEC31235B9776BD1E6A508B5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-DE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Part-DE
Size 305KB
SHA256 367ad4a5699a69499d13e8bf9ed5e8bab3573e3731ff8127178e539735ba46a8
MD5 fa08e85d713ad46803e924d443e4bf7e
SHA1 bbcce20f5ce73be4b34cf5c43d6f71bb4ae2c5ff
SHA512 884314e04cab57c9907f90525a4fea7710fdff5e47db4500c03d4dc6c5491a3f4df4868620a2a1817444ee75bfc913e79f9a414e3a68108deb7abab700ae9f85
SSDEEP 6144:7FjHKfRBie5M0SPtVRY7od0x6qNgKWIescUHVTl1dKcJEtmmt4l843NWKOb2P5+S:5T41N/IuscpL1Kxa
TLSH
T10264C693296AFAB12A320E7D600A1C4C5322F111C2C7DDD9F775C98DD1E468BBAC16F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-ES

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Part-ES
Size 137KB
SHA256 55e005c8aea4180093fcb56f4ddeb9fc763892d8cf1fcc840f612a7531b7ed18
MD5 6e8f660d075254a08948dc3517304256
SHA1 bc8abaa82d6d555ee9482c568a1d661453fbc956
SHA512 cc3484fe628e4242eeec2ce969c51e817ec9ab3feecec8d8097f43a319c9dc226771eefe63316d8ec2ad895f23ed4603c4836faa49369db785580455ecf21f37
SSDEEP 3072:NiZ3EhHST197h/6Jl06bBeS1G56asSnGpFrUboki9a8jRU+Zw1:/RxbR1EnYpLv/Vy
TLSH
T166D30D55AADCA8B55A73102C64D9254C911772D082CECDE4FB6686CECAE05CF3BA03FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-FR

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Part-FR
Size 528KB
SHA256 56e80041432156be4f08bac11e3494f2f06f65b61a60b7dcb61d15debb7b318c
MD5 6804859c589fa0ce46529c3a53b882d6
SHA1 70ffd62bb826e29500d36bbdd7c8d9c6895e2d1d
SHA512 3a659c284f55d203fded7f2754673e55a43d2c131b4790fcfe374af138158a690b5a330d4e720348c03aabb561b0aee7d818dcc111698c05ecd99c239d07735c
SSDEEP 6144:zfi0kH6u1I6c2Qiw934vv8gxK2SzX6rDVu9cBwZp0CiEksn7p0heBB6pHIgnb3hc:aT43+R5I7p0ABaIgne
TLSH
T114B45D136619F9F11FB31E3D640B5C088235B2A183E3EDD5EA67C14DD4E468FB9A02B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-IT

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Part-IT
Size 216KB
SHA256 e1552312fc16e0f279e72f7eb4189a47e0beb36733220b0ef605f66defcc5fa7
MD5 268f6a3c0990d434175268cf09cfa6ad
SHA1 464e10c57c536e6bb55a326a48469246a9241505
SHA512 5154048a794227c45b950ec2d2ca378f9e7a9542b9fc79c1fef1f1615e97a263168927d883967b06f8b52227a47e3ac75ac7061b25400ebaa63e4536a368d50a
SSDEEP 6144:1quRAGty7QiWYIeezuu2CGiXTyRl+XPWRq14T/KfY:HRZtQl+XPWRS4T/5
TLSH
T16524E9176A54EDBE4E22156CA09F5E0C7225758182C7CED4F3D5C08DE5F827A2BA03EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-NL

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Part-NL
Size 79KB
SHA256 935465fc40adbb4ae89ba37542ed37609014666c67fdf5115927809d69144b41
MD5 65126d1e76de4f0872e6cfa96609beba
SHA1 95268d3b2134894040afd0530d062a3b836f63c7
SHA512 0c6dd17cf622ad1a1a4ddc43fdc6f36567a98309e145e16d95edf38e9b21905867b28865bee591b52eecaa371138ac436eee6d18ff8d78f4c8f7031ba4e7ad84
SSDEEP 1536:x3ACbKFpRTfKGy7Dpj+u9huKCe/MELfmoRyQpnokj:x3ACbYpxfKGy7Dpj++hu8/L7moRyQpnv
TLSH
T14A83D70AAD68F8754A331D2FA4990D1C9625B600C7CAFDC4E725908EC9F52DF2AD07ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-RU

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Part-RU
Size 1.2MB
SHA256 f8abf856660805e271d9d2033accf4f8cc43b19b7662fc2b96f56739229a90fe
MD5 e946014ae78f059f0698731a745a3f00
SHA1 afeb8dc2d86d2763b69f97717e454a7c6b8a267a
SHA512 3c699d3205c3a000c13d20411a0e958f2107f62d813591652cfc573f9a29647badfb1703e499a8896644f1485ecc19cdcaca0c6bd5ec1e5e328339c95784cfa3
SSDEEP 12288:4o9g8Q9u1Xku8Uc24wpDs2zGFtyKnVgLxB7rsvAyLuQCdj9/CwYJWj0Ek0ozM/vQ:4Oe9u1Xn1KFtyKnKq1CvH0Ra3Rnkd
TLSH
T1F44560137254F9F04F734E7E549A9C089275B1A083D7EDC5CA29C19C98F2A9FFA402B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-ZH

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\Part-ZH
Size 686KB
SHA256 9645edd48b978354345b657bacb3f30be1f450300856a82ba4d5dbf1236c7c9e
MD5 3e8cbee42dcb97db0df88cb96643e3fc
SHA1 94cd9e2bc876e04bfd2f311cdc160b6ae1d3c9f3
SHA512 319c69fcba623a0fea9ba4e1dcfabe3e9bd47f31dce7146e317835331217730fb61d0449abe7e66b1bc6f06a50c12269f7f09dbb633c85b4fd8dcc7b21c95304
SSDEEP 12288:g3gaBN1zyZzxT04duSeYXzhW+svzgAfk+XTAdXUd84nT4x09/xSE8Y:CgaBN1zyZzxT0N9YVW+sv8Afk+XTAdXy
TLSH
T114E491132168FCF51EB21E7D284B6D48813A76A047E3ECC6D62BD54ED6F025F39A01B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adblock_snippet.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\adblock_snippet.js
Size 2KB
SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
MD5 f5c93c471485f4b9ab45260518c30267
SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
TLSH
T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5744_998402302\manifest.fingerprint
Size 66B
SHA256 b1c8d3a1e8d3d85433eaa60a50001e5d1599809fb03a7b31bc19f963058a0d54
MD5 58d2918fbd8bfa6cecc58ecb48dd0723
SHA1 1c6f36fa1434000e97d6f32f32edf02772bb40ad
SHA512 31a3a6d71ec58392f3330df1cb23088c437d72c8709da71598fd626af76b45f26091daa1ae3d49ef15929b6b518a3fac0a911d09cf79ef67bc823d52db4580a5
TLSH
T18FA0220C20C82AA088BE0A0302082803832000A0AC383380A30CA3C8BC0C80820C00FA
MD5 SHA1 SHA512 TLSH

Submit Download

2a954894-2b35-40cb-bd84-9e4614204ace.tmp

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\2a954894-2b35-40cb-bd84-9e4614204ace.tmp
Size 2KB
SHA256 b9e1e52de2dd59738b3d6ca47123dd2f42215b73d973b7deaf206ba761f43903
MD5 a825ce35b70a90c98d7794f0203bb65d
SHA1 f89c989b6730ce88663c2cdf6dc313c69b2605f7
SHA512 f270dd08468e8dc79b62fe49e022fc17d158571139e0274911c291b100f6c29137f5d9ed775441dcfcb8b7931cfabb57e68779a217e4a51e6d4e5dfa908a0a45
TLSH
T13251C732AC247A3359E28954790A7F27E936C2658656AF6069EC0B1C11EBD4C3342C37
MD5 SHA1 SHA512 TLSH

Submit Download

5ea5953c-e998-4656-ac3e-b258963ae94a.tmp

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\5ea5953c-e998-4656-ac3e-b258963ae94a.tmp
Size 16KB
SHA256 8801990cbce73d1aa7b7400ad1a7792656a86edbfd9072255e55deeba9483165
MD5 df8f76ac7386852867c22e13f1fb48ce
SHA1 19cce8f7803848ec31a7c1f10bf11b93b4e1ad69
SHA512 94e1ba02c16173686493684253acb2cb457cdfa1f133246ac3825c561efe5cbbb7b7daaa6bbcf540c8476c1c97d8a2165759d625a8a61d59961d2ad40f55eba8
SSDEEP 384:zd+OBqImmJvGBLx3NaFMJFBNbeMItdI2g6r4:McvGtlNv6dVE
TLSH
T13D72A07528756A233CF38949BE897747DA61A297C0D5BFE8CCEC4F0E227B4842352C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\CertificateRevocation\6498.2026.10.20\crl-set
Size 13KB
SHA256 b85327be29f5d0a5be4a47da5bf5062f5115bda5e9827db40ac4776d829ccd18
MD5 5111ab39b220749a299b5bb7cd25c730
SHA1 970c9013ee629ded1b5d2a058cd147950c3544ab
SHA512 37caae776f5d9365367e12a6ca13e07761f09b3cf6d1f9ea9523af89e6f2579afdd148d3942822358a49ac597a544c30bdf070aee051d69d8a0adab6f6af708a
SSDEEP 384:oeYPnEDMU2kk0yu7uCnglcJUoCzL4pv2W9cBTgE:ojPEoMk67R1UoCwV2W0cE
TLSH
T16152AF4FDDC4A62AF03911AE982262A412794A8552554B731B6C3A64BCFB28D4E38C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\CertificateRevocation\6498.2026.10.20\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e22b6537fd6b962bd96526ed5f087b91ae49d82cdcdb1ba61a2b72d9232d74c9
MD5 f8ea8a6f0a145b6f17b53ea40091a6e7
SHA1 bb30bfcd2b198ec146b2ff17f44deeb487175ee5
SHA512 a04c791dd0205b67bac43a193eb4f47315725a22ace52b17c88075ec669b2360493f39b77b297f6bbd3406f437172071b404064565f5b8059fd3ce18ed5d22a4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 57e229aa492af345a2adbbc636e5a05f16e333430b6ff5430ee0e56a563f5591
MD5 1cec59502c9f22f4246fcce9c3eae939
SHA1 99a253d66789a4aacbd3a591635cb0491e45a435
SHA512 abbad83acc6d3a4e1e191c442e080d9edda7e219c95fe8e35df96c62892b40750a11ba9801308661073dbfdab33aa36fda197a1e9545ceffa6c7ee235efcc457
TLSH
T1F1D012273A114534C01024330102FD081441C90B404A4000582D965D5F140902906872
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

526bab35-8d4c-4435-9edd-97bbc7002e2d.tmp

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\526bab35-8d4c-4435-9edd-97bbc7002e2d.tmp
Size 6KB
SHA256 af5f94b43bf90cbf313f442ffe33987b675db882e51ade0e433ad7a98bda4942
MD5 2e4fbc51b0c05304f023ddac559fb221
SHA1 8bd0ccda84aef24e736f9ac577e9786c339eb035
SHA512 bec114b6b10c330618cd63083ad729b94a00b78166b506ab3360d6c7a9c11f581fd68a39fb86390a12530086f82ea157ac2b32f4cedba10eb155f638cb9e973a
SSDEEP 96:stv05Nk7zb97ff3Z8i0vhEkktzm/7qx+WVHMSm+uecJHMXKdQj5+gtvMOB:stv0jSffZ8paHC/S+WiTHM6d8PvMC
TLSH
T12CD1C6026E2879774CC7F6097A35FF46E2F6502221C50E98EBFC862C08E66CC234790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ec55d66fa60aa64_0

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Code Cache\js\6ec55d66fa60aa64_0
Size 17KB
SHA256 a608aac97af6bac4c8c2e3e75515475998382e817ac1637f708e9b92b3b822a0
MD5 dbff930cca7190eda203ef9355bee001
SHA1 38a13d002ae7efe044faa9f9eb3489761f7afb59
SHA512 6e678e0e09fc61596d6f5e85ad622df6ea40489ab92ad7d253ed8a01299a2a9df9cc294d5977b8d4fefd1a1ec63e7207c23ff5bc3b0538dcec185de6afec9135
SSDEEP 384:WTYQHoTjgi1U3koCT0WvAx2Pok6KiNyn:WTYdT91KxCTU3kaNyn
TLSH
T1E0824301BA408750CA7786F14B16867AAF355B9D7FD3930239F88F7EACA50D2CD4DA48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7981b7a3e487ff51_0

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Code Cache\js\7981b7a3e487ff51_0
Size 257B
SHA256 3c19be519315e8900b04df8b3ab447e21b367cdfbafb8e326713149c6c380163
MD5 cd33065580fb1a9bd7ea61d78ceadc9a
SHA1 3afa9e3608bfae709474cfaa6832c38bcd604952
SHA512 f3708fb720ba6070dc59379538bc44f077bb3e2cc120b55922d6ecd4aab703e2e0fb633c1cfe1697c047fdbb8098d8a631dd9d4fb0328ba91c2268176312c786
TLSH
T1ADD02E8F4BA2B418C560E8F0CAE9CC2BC34605A41C0CEA02632162922AA2A58659D708
MD5 SHA1 SHA512 TLSH

Submit Download

a3677252bd8fcfc5_0

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Code Cache\js\a3677252bd8fcfc5_0
Size 257B
SHA256 7be6542732a6860fc2538702cb395bf5bf8bd21233b062e54f9ff5d7c2a35ead
MD5 2617fc12149be5a01ba7acd79cc8bcdb
SHA1 9fadfcc69411119c00faf7f3fd6379700c5dea81
SHA512 a423056c1b19a106f4ad635811c1901b50fc60eb100f0ba8076818953aa9426db1604b201a9b418303920fbb523b1e69b9ceaaf249f60c203940757b49e3ccbd
TLSH
T170D02B8E8B152400D0AC99B0C3DBD59ED28615D0046C9312D0214C5115A374D5498711
MD5 SHA1 SHA512 TLSH

Submit Download

b29b34f335ee44d8_0

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Code Cache\js\b29b34f335ee44d8_0
Size 658KB
SHA256 a5a2c535e921550357a6e263de211d12f95f793dccfce4010cd9697b45677071
MD5 a9716517bec8cb5121afc6d0ce93f1e6
SHA1 7084ab3b1e029766810e94e7861f4fc9a3de8e37
SHA512 9756906b839d8b3d3cf4db7a3c4546c9137caca3642e749996711ca1ff65e168a6ce175fb5900c61829bc4aec0d3007d51a8477ec7288efbb5bf56e5652544c4
SSDEEP 6144:85mmLr89NEMgO7dbBmQnBVah9qGYH87peqULvW0cBPZRlwQJirSAbApwQDM:KNLYzJ9BVqNrJ/kqirSAbIu
TLSH
T12CE45C5B03204B71CBF215B5760657497B30C5A88AD2731767A8B28B25C90BDCFBF68B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 935762ecca24b6d34babc9f443b3fbd40125f33cf2ddce74a34b410c478c355b
MD5 9cac1a3e8c8f11622cc84ddffb7ffc0c
SHA1 1ab1f1402138882d203cefa9e407d56215701104
SHA512 f97b13e891cbf63a5f693c15b52b82db2ac149d9cb432481b12084fc6f04d89d0a6b68b9844e61c81056eeec72cd653fe519990d0cf6980bfd8812af5a6c2c3f
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 552B
SHA256 fe4ce48b708d065fa8ecd116e3cdff04174a4c8e13f0ce8a428a734d38fe5dd2
MD5 a07180570dc2d925a4a6643b33046445
SHA1 fdcd18fa91539af6d9e51bc688eb85d969910c38
SHA512 df12476d89594eeac6b189de5dff4d07d65deb60667d210a102ac602a5ee2a2e57cc79eec592c1a5814a8581ee601d966c44be723fdb8af48d32eb7a519e924e
TLSH
T17FF0A071200F2224D302023635F1B892377BA5597ABB6F1DD2B269B7109B385A78960D
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 7873e6b880c16123fc1970c4e610c257b5d2506546933d57ebffa39fe8a6765b
MD5 8240baa447ba146934dd7910b5098fd4
SHA1 68fe8b79b8abef3b4e269c76d67c54f7138b6dec
SHA512 72d647ee6e1e7c3cacf437d0277b55dc073024867c62b55f2b7dfceb45cb78db234b58fde62b403709afc04452311b4dd609358700a3b806b58c9d89ac8173d9
SSDEEP 3:LstlNllkll/lkll:LsX3lEtk/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c8bb5c7e-cb10-48ae-a2e8-3702af2abd55.tmp

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Network\c8bb5c7e-cb10-48ae-a2e8-3702af2abd55.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Preferences
Size 6KB
SHA256 4e595fc8d2d4165d4dc358b45586d7baf871acd91c411015cc8593acc6689d9b
MD5 a714e1329e14f8aabdf4ee223b1bfce3
SHA1 3b6b65efab4a3085871c464226f82e619ee9b43c
SHA512 447eb50addd454c0a6f0b8982e1f5ca6bf11099856f4bcb4528e473c016ecf62cd230801ac3c754055b116fa28bb4d72883ca3b21706deceabe8847d6c8fc2b4
SSDEEP 96:stv05Nk7zb9VffjdZ8i0vhEkktzm/7qx+WVHMSm+uecJHMXKdQj5+gIvMEB:stv0j0fRZ8paHC/S+WiTHM6d8ivM8
TLSH
T18CD1A5025E3879774CC7E619BA35FF46E2F6506225D50E98EBFD862C08E66CC234790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Local State
Size 1KB
SHA256 7b1fdff9a0d5e90f93c963cc97e76349268ddcb01e59089ef62a35fad7c18958
MD5 818a676823ab8267fba264436d094db5
SHA1 df23a24155a1186ecf851e21ae6ce44af3730aa2
SHA512 8e6e6cd319f87cde5da51495756b04d7d80c5451b3ac903c27aadcdc6ccff6dfb7227adddc3b2c3704cebd4131ef59baa93836eab8b5cadb9d44467d4467a299
TLSH
T18E214272C8A57A73388088B47207BE4B7E11D53D8219CF18A1ED031C26DBC8C66B6D37
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

adb6d25b-a8cc-40e1-89d2-7568ff65b3ce.tmp

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\adb6d25b-a8cc-40e1-89d2-7568ff65b3ce.tmp
Size 1KB
SHA256 7a5578f588c37478995f5bdddc7e178c64699c4f92b42696c36aac623dad7dee
MD5 abc0866e919991a43158066500da37e9
SHA1 2b66c83aa2cf8bcf47660f40ec7726088af07cd6
SHA512 88f06cd4098b1459db11fa3087508a03fa225868cf220a78eb28409aaf674daaf82c95f8ee93124edf78aff070bc20ed06fe8a9912bdf1779136dd0555d0362a
TLSH
T1BE319272D8A13B332CC095A53207BE5BBE22952D8115CE0861ED071C22E7D8CB6AAD33
MD5 SHA1 SHA512 TLSH

Submit Download

daa288f4-f85d-4d58-8e0f-cd57ee8ce3f5.tmp

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\daa288f4-f85d-4d58-8e0f-cd57ee8ce3f5.tmp
Size 3KB
SHA256 bb063f971c18272afd2b6a9af9e0b6336af42ba4aa17c175d5965d88441df765
MD5 880d1dcb032ba6af559c2afdf8cac27e
SHA1 1afd3a07ad7b7a3b4beb61f50d8702364244c56e
SHA512 b63b3f8402051d03b14257d28f64a4d0b2d709c255cd8e45a2ab5bf24caea2ec76a2bcd1573b0b9b6ae797e7a575a0d5302bb5a7b00358911e0e0843c01f533e
TLSH
T1C071B736AC74B9370DE28954B9863F1AF6618237D5857FA8D9EC0F1C11E7A882392C17
MD5 SHA1 SHA512 TLSH

Submit Download

dcda8e1a-347a-41db-85de-7f7b7756f3a5.tmp

Path C:\Users\Admin\AppData\Local\app.omnicontrol.desktop\EBWebView\dcda8e1a-347a-41db-85de-7f7b7756f3a5.tmp
Size 4KB
SHA256 7337908fcf7d6629b0944a8b1c94bd756e182d450730f0a8ebd88c7cc323236e
MD5 a3a30278b7b8d0b6eb477d0b3cc810f8
SHA1 95e6928209584aac173b66e2d85a36a4665302ed
SHA512 4fc9bfaef83d159933b4fb57338f04601a1d609d191081a2c8ac2106bf95418f59ba84e664210d4bfe255d1622167f02432a878f480d3b38c32996d9417754cd
SSDEEP 96:zulOzNkCEA9fnYP88Frh/cInURoDoto+5ppDeIBSNG6EBZy9or0ZPTblsa:zpzNb5+rooDUhD/SNLorUrt
TLSH
T17C91B732A874BA371DF2D948B94A3F06B6619127D4957FA8D9EC0F0C11EB6CC2352C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omnicontrol.log

Path C:\Users\Admin\AppData\Roaming\OmniControl\omnicontrol.log
Size 540B
SHA256 85ec035c9c2ed9efdbfc0533826ff9770402d8d2e954fa60e5fc2144494878dc
MD5 798a1c6cca33a23be326d26dacc12681
SHA1 ab868812c42be59cb9ea681a273578c2d847f589
SHA512 dbfc5b753c2ff2b4fc51014a7623b6b41c39342f2838f87a51625b37c66014615c7b6df14c97d697ead4dde3bc57537baeba20806c07374f9be326582a4a0c08
TLSH
T13DF0C04502FEB47646C9E0DB753E1A06F012B08C3E5B0584735ACDA445DEC5D5761111
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3412-296-0x0000022A86910000-0x0000022A86911000-memory.dmp

Download

memory/3412-333-0x0000022A86A00000-0x0000022A86A02000-memory.dmp

Download

memory/3412-318-0x0000022A86970000-0x0000022A86974000-memory.dmp

Download

memory/3412-317-0x0000022A869A0000-0x0000022A869A2000-memory.dmp

Download

memory/3412-315-0x0000022A86960000-0x0000022A86964000-memory.dmp

Download

memory/3412-314-0x0000022A86970000-0x0000022A86972000-memory.dmp

Download

memory/3412-312-0x0000022A86980000-0x0000022A86992000-memory.dmp

Download

memory/3412-311-0x0000022A86970000-0x0000022A86979000-memory.dmp

Download

memory/3412-309-0x0000022A86950000-0x0000022A86954000-memory.dmp

Download

memory/3412-308-0x0000022A86960000-0x0000022A86962000-memory.dmp

Download

memory/3412-306-0x0000022A86940000-0x0000022A8694B000-memory.dmp

Download

memory/3412-305-0x0000022A86950000-0x0000022A86956000-memory.dmp

Download

memory/3412-304-0x0000022A86940000-0x0000022A86941000-memory.dmp

Download

memory/3412-321-0x0000022A869A0000-0x0000022A869A8000-memory.dmp

Download

memory/3412-26-0x00007FFE52AB0000-0x00007FFE52AB1000-memory.dmp

Download

memory/3412-375-0x0000022AF5210000-0x0000022AF52AB000-memory.dmp

Download

memory/3412-323-0x0000022A869C0000-0x0000022A869C2000-memory.dmp

Download

memory/3412-352-0x0000022A86A90000-0x0000022A86AA2000-memory.dmp

Download

memory/3412-351-0x0000022A86A60000-0x0000022A86A69000-memory.dmp

Download

memory/3412-349-0x0000022A86A70000-0x0000022A86A82000-memory.dmp

Download

memory/3412-348-0x0000022A86A60000-0x0000022A86A69000-memory.dmp

Download

memory/3412-346-0x0000022A86A40000-0x0000022A86A44000-memory.dmp

Download

memory/3412-345-0x0000022A86A50000-0x0000022A86A52000-memory.dmp

Download

memory/3412-343-0x0000022A86A10000-0x0000022A86A1A000-memory.dmp

Download

memory/3412-325-0x0000022A869D0000-0x0000022A869D4000-memory.dmp

Download

memory/3412-326-0x0000022A869B0000-0x0000022A869B7000-memory.dmp

Download

memory/3412-328-0x0000022A869E0000-0x0000022A869E5000-memory.dmp

Download

memory/3412-329-0x0000022A869D0000-0x0000022A869DA000-memory.dmp

Download

memory/3412-331-0x0000022A869F0000-0x0000022A869F2000-memory.dmp

Download

memory/3412-320-0x0000022A869B0000-0x0000022A869B4000-memory.dmp

Download

memory/3412-334-0x0000022A869E0000-0x0000022A869E4000-memory.dmp

Download

memory/3412-336-0x0000022A86A10000-0x0000022A86A19000-memory.dmp

Download

memory/3412-337-0x0000022A86A20000-0x0000022A86A32000-memory.dmp

Download

memory/3412-342-0x0000022A86A40000-0x0000022A86A45000-memory.dmp

Download

memory/3412-340-0x0000022A86A00000-0x0000022A86A04000-memory.dmp

Download

memory/3412-339-0x0000022A86A10000-0x0000022A86A12000-memory.dmp

Download

memory/3608-404-0x0000027506590000-0x000002750662B000-memory.dmp

Download

memory/3700-53-0x00007FFE53590000-0x00007FFE53591000-memory.dmp

Download

memory/3700-52-0x00007FFE52D00000-0x00007FFE52D01000-memory.dmp

Download

memory/4212-409-0x000001A9B3360000-0x000001A9B33FB000-memory.dmp

Download

memory/4468-402-0x000001B242370000-0x000001B24240B000-memory.dmp

Download

memory/4720-612-0x00000198CB8C0000-0x00000198CB8C1000-memory.dmp

Download

memory/4720-613-0x00000198CB8C0000-0x00000198CB8C1000-memory.dmp

Download

memory/4720-604-0x00000198CB8C0000-0x00000198CB8C1000-memory.dmp

Download

memory/4720-606-0x00000198CB8C0000-0x00000198CB8C1000-memory.dmp

Download

memory/4720-605-0x00000198CB8C0000-0x00000198CB8C1000-memory.dmp

Download

memory/4720-610-0x00000198CB8C0000-0x00000198CB8C1000-memory.dmp

Download

memory/4720-616-0x00000198CB8C0000-0x00000198CB8C1000-memory.dmp

Download

memory/4720-611-0x00000198CB8C0000-0x00000198CB8C1000-memory.dmp

Download

memory/4720-614-0x00000198CB8C0000-0x00000198CB8C1000-memory.dmp

Download

memory/4720-615-0x00000198CB8C0000-0x00000198CB8C1000-memory.dmp

Download

memory/4816-405-0x000001EC21740000-0x000001EC217DB000-memory.dmp

Download

memory/5404-391-0x000002240ED40000-0x000002240EDDB000-memory.dmp

Download

memory/5404-138-0x00007FFE52AB0000-0x00007FFE52AB1000-memory.dmp

Download

memory/5456-403-0x000001BEE4A10000-0x000001BEE4AAB000-memory.dmp

Download

memory/5656-401-0x000001E6C4740000-0x000001E6C47DB000-memory.dmp

Download

memory/5744-369-0x000002648B2E0000-0x000002648C2E0000-memory.dmp

Download