hxxps://cdn[.]discordapp[.]com/attachments/1570182554022322277/1570501739533049926/RobRunFreeMI5[.]rar?ex=6af75339&is=6af601b9&hm=a5f4309e7fcd9296eb4a83390ec5c91fa116d7fc767098c13de5ad054d6fc83d&

Analysis

user interaction
yes
max time kernel
1799s
max time network
1801s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1570182554022322277/1570501739533049926/RobRunFreeMI5.rar?ex=6af75339&is=6af601b9&hm=a5f4309e7fcd9296eb4a83390ec5c91fa116d7fc767098c13de5ad054d6fc83d&
Sample261113-ble6caey3j

Score

8^/10

microsoft discovery execution installer phishing

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2584	powershell.exe
548	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
150	4356	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	VSCodeUserSetup-x64-1.146.0.tmp

Executes dropped EXE 2 IoCs

pid	Process
2244	VSCodeUserSetup-x64-1.146.0.exe
4580	VSCodeUserSetup-x64-1.146.0.tmp

Modifies file permissions 1 TTPs 25 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4940	icacls.exe
5132	icacls.exe
5772	icacls.exe
6288	icacls.exe
6932	icacls.exe
7056	icacls.exe
5132	icacls.exe
3036	icacls.exe
6644	icacls.exe
6856	icacls.exe
1868	icacls.exe
6060	icacls.exe
3752	icacls.exe
5824	icacls.exe
2156	icacls.exe
7008	icacls.exe
6012	icacls.exe
6944	icacls.exe
4524	icacls.exe
2504	icacls.exe
4060	icacls.exe
980	icacls.exe
6964	icacls.exe
5340	icacls.exe
4116	icacls.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
344	discord.com
345	discord.com

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdmpkpjlmnndlfdllmnekbmgjikhghjg\1.0_0\manifest.json	chrome.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
80	4356	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3284	cmd.exe
5700	cmd.exe
3628	cmd.exe
5260	cmd.exe
5836	cmd.exe
5132	cmd.exe
5116	cmd.exe
4196	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VSCodeUserSetup-x64-1.146.0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inno_updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VSCodeUserSetup-x64-1.146.0.exe

System Owner/User Discovery 1 TTPs
Attempt to identify the primary or current user.
discovery

System Owner/User Discovery
T1033

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4356	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/2244-541-0x0000000000120000-0x00000000001FC000-memory.dmp	innosetup
behavioral1/memory/2244-557-0x0000000000120000-0x00000000001FC000-memory.dmp	innosetup
behavioral1/memory/2244-761-0x0000000000120000-0x00000000001FC000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	copilot-runtime.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	copilot-runtime.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	copilot-runtime.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	copilot-runtime.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Code.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.asp	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.mdtxt\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\" \"%1\""	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.pyi	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.config\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\69047191fc\\resources\\app\\resources\\win32\\config.ico"	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.css\shell\open\command	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.makefile\shell\open\Icon = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\""	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Applications\Code.exe\shell\open\Icon = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\""	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.mdown\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\69047191fc\\resources\\app\\resources\\win32\\markdown.ico"	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.gradle	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.less\OpenWithProgids	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.toml\OpenWithProgids	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.ini\ = "INI Source File"	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.sql	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.handlebars\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\69047191fc\\resources\\app\\resources\\win32\\default.ico"	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.hh\OpenWithProgids	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.mdwn\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\" \"%1\""	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.edn\ = "Extensible Data Notation Source File"	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.pm6\shell	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.psd1\DefaultIcon	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.gitattributes\AlwaysShowExt	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.hpp	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.tex\AppUserModelID = "Microsoft.VisualStudioCode"	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.xml\DefaultIcon	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.csv	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.mjs\DefaultIcon	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.plist\shell	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.wxs\shell\open\Icon = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\""	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.java\shell\open\command	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.pod\OpenWithProgids\VSCode.pod	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.rs\DefaultIcon	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.sql\ = "SQL Source File"	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.erb\OpenWithProgids	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.sql\OpenWithProgids\VSCode.sql	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.t\shell\open	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.cls\ = "LaTeX Source File"	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.cshtml\shell	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.go\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\69047191fc\\resources\\app\\resources\\win32\\go.ico"	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.go\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\" \"%1\""	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.plist\OpenWithProgids\VSCode.plist	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.ts\shell\open\command	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.yml\shell\open	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.zsh\OpenWithProgids\VSCode.zsh	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.csv\shell\open	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.gitconfig\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\69047191fc\\resources\\app\\resources\\win32\\config.ico"	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.txt\OpenWithProgids\VSCode.txt	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.txt\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\69047191fc\\resources\\app\\resources\\win32\\default.ico"	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.hpp\shell	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.wxi\shell	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.c\shell\open	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.fsi\shell	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.html\DefaultIcon	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.jshintrc	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.rt\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\69047191fc\\resources\\app\\resources\\win32\\default.ico"	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.yaml\OpenWithProgids	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.bash_login\DefaultIcon	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.cc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\" \"%1\""	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.cfg\shell\open\command	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\.mkdn\OpenWithProgids\VSCode.mkdn	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.svg\shell\open\Icon = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\""	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.ipynb\shell\open\Icon = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\""	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.pl\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\" \"%1\""	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.scss\shell\open	VSCodeUserSetup-x64-1.146.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.shtml\shell\open\Icon = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\""	VSCodeUserSetup-x64-1.146.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\VSCode.hh\shell\open	VSCodeUserSetup-x64-1.146.0.tmp

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
1264	chrome.exe
1264	chrome.exe
2584	powershell.exe
2584	powershell.exe
2584	powershell.exe
548	powershell.exe
548	powershell.exe
548	powershell.exe
5784	Code.exe
5784	Code.exe
6904	Code.exe
6904	Code.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs

pid	Process
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
544	Code.exe
544	Code.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
544	Code.exe
544	Code.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
544	Code.exe
544	Code.exe
544	Code.exe
544	Code.exe
544	Code.exe
544	Code.exe
544	Code.exe
544	Code.exe
544	Code.exe
544	Code.exe
6232	Code.exe
6232	Code.exe
6232	Code.exe
6232	Code.exe
6232	Code.exe
6232	Code.exe
6232	Code.exe
6232	Code.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6868	OpenWith.exe
6868	OpenWith.exe
6868	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 3840	4224	chrome.exe	84
PID 4224 wrote to memory of 4356	4224	chrome.exe	85
PID 4224 wrote to memory of 4256	4224	chrome.exe	86
PID 4224 wrote to memory of 4256	4224	chrome.exe	86
PID 4224 wrote to memory of 3260	4224	chrome.exe	87
PID 4224 wrote to memory of 3260	4224	chrome.exe	87
PID 4224 wrote to memory of 4440	4224	chrome.exe	88
PID 4224 wrote to memory of 4440	4224	chrome.exe	88
PID 4224 wrote to memory of 3700	4224	chrome.exe	89
PID 4224 wrote to memory of 3700	4224	chrome.exe	89
PID 4224 wrote to memory of 392	4224	chrome.exe	91
PID 4224 wrote to memory of 3404	4224	chrome.exe	93
PID 4224 wrote to memory of 2132	4224	chrome.exe	99
PID 4224 wrote to memory of 2132	4224	chrome.exe	99
PID 4224 wrote to memory of 3312	4224	chrome.exe	100
PID 4224 wrote to memory of 3312	4224	chrome.exe	100
PID 4224 wrote to memory of 4888	4224	chrome.exe	104
PID 4224 wrote to memory of 4888	4224	chrome.exe	104
PID 4224 wrote to memory of 1880	4224	chrome.exe	106
PID 4224 wrote to memory of 2004	4224	chrome.exe	107
PID 4224 wrote to memory of 1472	4224	chrome.exe	108
PID 4224 wrote to memory of 1740	4224	chrome.exe	110
PID 4224 wrote to memory of 1740	4224	chrome.exe	110
PID 4224 wrote to memory of 3476	4224	chrome.exe	111
PID 4224 wrote to memory of 3476	4224	chrome.exe	111
PID 4224 wrote to memory of 4648	4224	chrome.exe	112
PID 4224 wrote to memory of 4648	4224	chrome.exe	112
PID 4224 wrote to memory of 1676	4224	chrome.exe	113
PID 4224 wrote to memory of 1676	4224	chrome.exe	113
PID 4224 wrote to memory of 4264	4224	chrome.exe	114
PID 4224 wrote to memory of 4612	4224	chrome.exe	115
PID 4224 wrote to memory of 4612	4224	chrome.exe	115
PID 4224 wrote to memory of 3116	4224	chrome.exe	116
PID 4224 wrote to memory of 3116	4224	chrome.exe	116
PID 4224 wrote to memory of 4908	4224	chrome.exe	117
PID 4224 wrote to memory of 2244	4224	chrome.exe	118
PID 2244 wrote to memory of 4580	2244	VSCodeUserSetup-x64-1.146.0.exe	120
PID 4224 wrote to memory of 1264	4224	chrome.exe	121
PID 544 wrote to memory of 5012	544	Code.exe	133
PID 544 wrote to memory of 4048	544	Code.exe	132
PID 544 wrote to memory of 3040	544	Code.exe	134
PID 544 wrote to memory of 5372	544	Code.exe	135
PID 544 wrote to memory of 5628	544	Code.exe	137
PID 544 wrote to memory of 5636	544	Code.exe	138
PID 544 wrote to memory of 5644	544	Code.exe	139
PID 544 wrote to memory of 5836	544	Code.exe	141
PID 544 wrote to memory of 5132	544	Code.exe	167
PID 5372 wrote to memory of 5352	5372	Code.exe	145
PID 5372 wrote to memory of 5392	5372	Code.exe	146
PID 4224 wrote to memory of 6540	4224	chrome.exe	149
PID 4224 wrote to memory of 6540	4224	chrome.exe	149
PID 5372 wrote to memory of 6644	5372	Code.exe	151
PID 5372 wrote to memory of 6856	5372	Code.exe	153
PID 5372 wrote to memory of 6912	5372	Code.exe	155
PID 5372 wrote to memory of 6964	5372	Code.exe	157
PID 5372 wrote to memory of 7008	5372	Code.exe	159
PID 5628 wrote to memory of 7036	5628	Code.exe	161
PID 5372 wrote to memory of 7140	5372	Code.exe	163
PID 5372 wrote to memory of 1868	5372	Code.exe	165
PID 5372 wrote to memory of 5132	5372	Code.exe	167
PID 5372 wrote to memory of 5440	5372	Code.exe	169
PID 5372 wrote to memory of 6012	5372	Code.exe	171
PID 5372 wrote to memory of 5772	5372	Code.exe	173
PID 6868 wrote to memory of 6940	6868	OpenWith.exe	177

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1570182554022322277/1570501739533049926/RobRunFreeMI5.rar?ex=6af75339&is=6af601b9&hm=a5f4309e7fcd9296eb4a83390ec5c91fa116d7fc767098c13de5ad054d6fc83d&
1⤵
- Drops Chrome extension
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe28dac728,0x7ffe28dac734,0x7ffe28dac740
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,10492316959072895618,17923895759081234123,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,6044017513632850707,13722852049706994781,262144 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,5347355044428605780,17930960702472921204,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2252 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,18057141973811190075,16606281768919131109,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,10522615631360857361,1746682804917095765,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5108,i,7666657705903623259,6887341179322412647,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4592 /prefetch:8
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5116,i,5643061221047450072,16954876860538034084,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5556,i,1833388700714502764,4610310200452933985,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5732,i,7205233820109024218,16566050344702030469,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6088,i,6223798288015338093,3366259439519555192,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,1312017842426924245,14642555795605580068,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5096,i,6015883538563604347,11567130453635923003,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,1738648223088089571,14699667572241001120,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5124,i,11339142304947078226,15543210319150162292,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6060,i,14114773197911248328,12474530014256918888,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5704,i,457781605913703575,826562954684436792,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5708,i,7609678563844111701,7518057116580472076,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6276,i,6073378799052931784,5567839750936662398,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6284,i,3504037648943271648,6146571763096881914,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6476,i,10182844248760444050,10683003804805263110,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6744,i,4223162204235516076,15662893358912532040,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:4908
- C:\Users\Admin\Downloads\VSCodeUserSetup-x64-1.146.0.exe
  "C:\Users\Admin\Downloads\VSCodeUserSetup-x64-1.146.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Users\Admin\AppData\Local\Temp\is-K61G3.tmp\VSCodeUserSetup-x64-1.146.0.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-K61G3.tmp\VSCodeUserSetup-x64-1.146.0.tmp" /SL5="$C0248,284689711,841216,C:\Users\Admin\Downloads\VSCodeUserSetup-x64-1.146.0.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4580
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-WmiObject Win32_Process | Where-Object { $_.ExecutablePath -eq 'C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe' } | Select @{Name='Id'; Expression={$_.ProcessId}} | Stop-Process -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2584
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code" /inheritancelevel:r /grant:r "*S-1-5-18:(OI)(CI)F" /grant:r "*S-1-5-32-544:(OI)(CI)F" /grant:r "*S-1-5-11:(OI)(CI)RX" /grant:r "*S-1-5-32-545:(OI)(CI)RX" /grant:r "*S-1-3-0:(OI)(CI)F" /grant:r "Admin:(OI)(CI)F"
      4⤵
      Modifies file permissions
      PID:2156
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter \"Name = 'dllhost.exe'\" | Where-Object { $_.CommandLine -like '*1C6DF0C0-192A-4451-BE36-6A59A86A692E*' } | ForEach-Object { try { Stop-Process -Id $_.ProcessId -Force -ErrorAction Stop } catch {} }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:548
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\tools\inno_updater.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\tools\inno_updater.exe" "--gc" "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "69047191fc" "Code.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4368
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"
      4⤵
      Checks processor information in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:544
    - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1820,i,4934844714434961065,4258481644014665626,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,9661519725781369276,14671559444353079146,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1908 /prefetch:3
        5⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1820,i,4934844714434961065,4258481644014665626,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,9661519725781369276,14671559444353079146,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1732 /prefetch:2
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --max-active-webgl-contexts=32 --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1820,i,4934844714434961065,4258481644014665626,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,9661519725781369276,14671559444353079146,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3368 --vscode-window-config=vscode:b1ac02fb-e9a2-45ca-99df-0d94df7a9d6a /prefetch:1
        5⤵
        
        PID:3040
    - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1820,i,4934844714434961065,4258481644014665626,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,9661519725781369276,14671559444353079146,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4092 /prefetch:8
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5372
      - C:\Windows\System32\whoami.exe
        
        C:\Windows\System32\whoami.exe /user /fo csv /nh
        6⤵
        
        PID:5352
      - \??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\prebuilds\win32-x64\copilot-runtime.exe
        
        "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\prebuilds\win32-x64\copilot-runtime.exe" --headless --no-auto-update --log-level info --stdio --no-auto-login
        6⤵
        Checks processor information in registry
        
        PID:5392
      - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /reset
        6⤵
        Modifies file permissions
        
        PID:6644
      - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /inheritance:r /grant:r *S-1-5-21-895009113-1202185046-1686627690-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
        6⤵
        Modifies file permissions
        
        PID:6856
      - C:\Windows\System32\whoami.exe
        
        C:\Windows\System32\whoami.exe /user /fo csv /nh
        6⤵
        
        PID:6912
      - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /reset
        6⤵
        Modifies file permissions
        
        PID:6964
      - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /inheritance:r /grant:r *S-1-5-21-895009113-1202185046-1686627690-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
        6⤵
        Modifies file permissions
        
        PID:7008
      - C:\Windows\System32\whoami.exe
        
        C:\Windows\System32\whoami.exe /user /fo csv /nh
        6⤵
        
        PID:7140
      - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /reset
        6⤵
        Modifies file permissions
        
        PID:1868
      - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /inheritance:r /grant:r *S-1-5-21-895009113-1202185046-1686627690-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
        6⤵
        Modifies file permissions
        
        PID:5132
      - C:\Windows\System32\whoami.exe
        
        C:\Windows\System32\whoami.exe /user /fo csv /nh
        6⤵
        
        PID:5440
      - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /reset
        6⤵
        Modifies file permissions
        
        PID:6012
      - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /inheritance:r /grant:r *S-1-5-21-895009113-1202185046-1686627690-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
        6⤵
        Modifies file permissions
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1820,i,4934844714434961065,4258481644014665626,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,9661519725781369276,14671559444353079146,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4232 /prefetch:8
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5628
      - \??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe
        
        "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe" tunnel kill
        6⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1820,i,4934844714434961065,4258481644014665626,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,9661519725781369276,14671559444353079146,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4168 /prefetch:8
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1820,i,4934844714434961065,4258481644014665626,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,9661519725781369276,14671559444353079146,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4360 /prefetch:8
        5⤵
        
        PID:5644
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"
        5⤵
        Executes a command shell one-liner
        
        PID:5836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"
        5⤵
        Executes a command shell one-liner
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1820,i,4934844714434961065,4258481644014665626,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,9661519725781369276,14671559444353079146,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=1356 /prefetch:8
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1820,i,4934844714434961065,4258481644014665626,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,9661519725781369276,14671559444353079146,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4476 /prefetch:8
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1820,i,4934844714434961065,4258481644014665626,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,9661519725781369276,14671559444353079146,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4532 /prefetch:8
        5⤵
        
        PID:5612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"
        5⤵
        Executes a command shell one-liner
        
        PID:5116
      - C:\Windows\system32\wsl.exe
        
        wsl.exe -l -q
        6⤵
        
        PID:6200
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"
        5⤵
        Executes a command shell one-liner
        
        PID:4196
      - C:\Windows\system32\wsl.exe
        
        wsl.exe -l -q
        6⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAQgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1820,i,4934844714434961065,4258481644014665626,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,9661519725781369276,14671559444353079146,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5452 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6732,i,11704868525084477615,9136906465582425733,262144 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6396,i,5302348543874591480,3387421039912434051,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=944 /prefetch:8
  2⤵
  PID:6540
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "C:\Users\Admin\Downloads\RobRunFreeMI5.rar"
  2⤵
  - Checks processor information in registry
  PID:6308
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Code /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Code\Crashpad --url=appcenter://code?aid=a4e3233c-699c-46ec-b4f4-9c2a77254662&uid=f4442429-4a40-4e9e-b5c3-8929fd429ad4&iid=f4442429-4a40-4e9e-b5c3-8929fd429ad4&sid=f4442429-4a40-4e9e-b5c3-8929fd429ad4 --annotation=_companyName=Microsoft --annotation=_productName=VSCode --annotation=_version=1.146.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=43.8.6 --initial-client-data=0x4f4,0x4f8,0x4fc,0x4f0,0x500,0x7ff78c943948,0x7ff78c943958,0x7ff78c943968
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1900,i,2609967420306770465,3259119103710180195,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1904,i,7681099859915013183,4784739565015590193,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1932 /prefetch:3
    3⤵
    PID:6400
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1900,i,2609967420306770465,3259119103710180195,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1904,i,7681099859915013183,4784739565015590193,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1896 /prefetch:2
    3⤵
    PID:6484
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "C:\Users\Admin\Downloads\RobRunFreeMI5.rar"
  2⤵
  - Checks processor information in registry
  PID:6872
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Code /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Code\Crashpad --url=appcenter://code?aid=a4e3233c-699c-46ec-b4f4-9c2a77254662&uid=f4442429-4a40-4e9e-b5c3-8929fd429ad4&iid=f4442429-4a40-4e9e-b5c3-8929fd429ad4&sid=f4442429-4a40-4e9e-b5c3-8929fd429ad4 --annotation=_companyName=Microsoft --annotation=_productName=VSCode --annotation=_version=1.146.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=43.8.6 --initial-client-data=0x4fc,0x500,0x504,0x4f8,0x508,0x7ff78c943948,0x7ff78c943958,0x7ff78c943968
    3⤵
    PID:5760
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1784,i,17230712282288821017,9268025859620598747,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1788,i,15524710190079102857,3415760284402431964,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1776 /prefetch:2
    3⤵
    PID:6560
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1784,i,17230712282288821017,9268025859620598747,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1788,i,15524710190079102857,3415760284402431964,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1876 /prefetch:3
    3⤵
    PID:5784
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "C:\Users\Admin\Downloads\RobRunFreeMI5.rar"
  2⤵
  - Checks processor information in registry
  PID:1868
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Code /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Code\Crashpad --url=appcenter://code?aid=a4e3233c-699c-46ec-b4f4-9c2a77254662&uid=f4442429-4a40-4e9e-b5c3-8929fd429ad4&iid=f4442429-4a40-4e9e-b5c3-8929fd429ad4&sid=f4442429-4a40-4e9e-b5c3-8929fd429ad4 --annotation=_companyName=Microsoft --annotation=_productName=VSCode --annotation=_version=1.146.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=43.8.6 --initial-client-data=0x4f8,0x4fc,0x500,0x4f4,0x504,0x7ff78c943948,0x7ff78c943958,0x7ff78c943968
    3⤵
    PID:6236
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1900,i,4021936524177849281,9621175349901694787,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1904,i,5375850949678408000,4916869880949503746,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1932 /prefetch:3
    3⤵
    PID:6764
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1900,i,4021936524177849281,9621175349901694787,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1904,i,5375850949678408000,4916869880949503746,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1896 /prefetch:2
    3⤵
    PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6952,i,4840213595928507302,14693599037505387330,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6856,i,455443593173425888,17447199621240645076,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6468,i,9489632377202525985,15095690177250027359,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7228 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6996,i,10303934971166546108,16571203548751384504,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6960,i,13466834691921551824,6710614214574475333,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7208,i,14746668914143031597,12584225533276539712,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6980,i,4002335539713126918,8927762567009947229,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7468,i,1576246439624278714,2746534927957966415,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6448,i,4490441911272176528,12906833316889250617,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7136,i,10251619191986829968,15944811013047877488,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=8076,i,18318560573640067522,5063612312108543923,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6984,i,12248212148758711156,12692478302977463257,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8084 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7092,i,2127800772176731064,16724259409918019191,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8056 /prefetch:2
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=5784,i,8943273821657139350,15176372117021188694,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6864,i,2217520353108116754,4368292700897838095,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7540 /prefetch:8
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6588,i,9756663196942898118,6217158918807802641,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7580,i,7168831917537214430,15724405730748718537,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7784 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7776,i,5745938699584642939,16150403424237694353,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7516 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7848,i,1351723146478481879,1346036937944293229,524288 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7104 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=6180,i,11829401586136288163,3240124391377238377,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=3428,i,13661231309514141714,444318161498311784,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6012 /prefetch:2
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=6184,i,1081651556583398252,5541027937506692326,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7776,i,14825999011129123648,10199242078689885765,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5784 /prefetch:2
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=1480,i,7219285812083381122,14520056548881552757,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:6788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=5984,i,16247113404927318766,9093842625765815815,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=7380,i,9624329861138347728,2911593459455205591,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7140,i,8225087908853674262,3117473764011839231,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=6940,i,11463838220070876516,6468477166881272003,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=5872,i,12150073798830972455,12659348235310043632,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=6440,i,10219775783297392560,5478706096601625759,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:6876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=7564,i,14726210991156857018,10369567157521607281,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=2580,i,12911747076455670163,7873702321280946590,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=5844,i,17967741186623318675,634166611405051687,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=7176,i,12178493570220592819,15675013912820626979,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7340 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=8240,i,10175727878011174212,11293699521866248099,2097152 --field-trial-handle=2088,i,3520295514430755517,11768369074714675391,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8252 /prefetch:1
  2⤵
  PID:4892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1672

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6868
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "C:\Users\Admin\Downloads\RobRunFreeMI5.rar"
  2⤵
  - Checks processor information in registry
  PID:6940
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Code /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Code\Crashpad --url=appcenter://code?aid=a4e3233c-699c-46ec-b4f4-9c2a77254662&uid=f4442429-4a40-4e9e-b5c3-8929fd429ad4&iid=f4442429-4a40-4e9e-b5c3-8929fd429ad4&sid=f4442429-4a40-4e9e-b5c3-8929fd429ad4 --annotation=_companyName=Microsoft --annotation=_productName=VSCode --annotation=_version=1.146.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=43.8.6 --initial-client-data=0x504,0x508,0x50c,0x460,0x464,0x7ff78c943948,0x7ff78c943958,0x7ff78c943968
    3⤵
    PID:7076
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1808,i,15481095176982437505,2154183640733780728,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1812,i,9764142205722533209,823206287717715516,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1932 /prefetch:3
    3⤵
    PID:6164
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1808,i,15481095176982437505,2154183640733780728,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1812,i,9764142205722533209,823206287717715516,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1804 /prefetch:2
    3⤵
    PID:6180

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\RobRunFreeMI5\" -ad -an -ai#7zMap15522:88:7zEvent23870
1⤵
PID:5840

C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"
1⤵
- Checks processor information in registry
- Suspicious use of SendNotifyMessage
PID:6232
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Code /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Code\Crashpad --url=appcenter://code?aid=a4e3233c-699c-46ec-b4f4-9c2a77254662&uid=f4442429-4a40-4e9e-b5c3-8929fd429ad4&iid=f4442429-4a40-4e9e-b5c3-8929fd429ad4&sid=f4442429-4a40-4e9e-b5c3-8929fd429ad4 --annotation=_companyName=Microsoft --annotation=_productName=VSCode --annotation=_version=1.146.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=43.8.6 --initial-client-data=0x4f4,0x4f8,0x4fc,0x4f0,0x500,0x7ff78c943948,0x7ff78c943958,0x7ff78c943968
  2⤵
  PID:1768
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1828,i,7672177242694093681,14832500444253118185,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1832,i,6277463278879404174,11035196816303604111,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  PID:2340
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1828,i,7672177242694093681,14832500444253118185,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1832,i,6277463278879404174,11035196816303604111,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1936 /prefetch:3
  2⤵
  PID:6516
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --max-active-webgl-contexts=32 --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1828,i,7672177242694093681,14832500444253118185,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1832,i,6277463278879404174,11035196816303604111,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3392 --vscode-window-config=vscode:cf03aabb-9aee-432c-80d3-66059d0eed07 /prefetch:1
  2⤵
  PID:6120
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1828,i,7672177242694093681,14832500444253118185,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1832,i,6277463278879404174,11035196816303604111,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:5928
- - C:\Windows\System32\whoami.exe
    C:\Windows\System32\whoami.exe /user /fo csv /nh
    3⤵
    PID:5224
- - \??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\prebuilds\win32-x64\copilot-runtime.exe
    "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\prebuilds\win32-x64\copilot-runtime.exe" --headless --no-auto-update --log-level info --stdio --no-auto-login
    3⤵
    - Checks processor information in registry
    PID:5444
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /reset
    3⤵
    - Modifies file permissions
    PID:6288
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /inheritance:r /grant:r *S-1-5-21-895009113-1202185046-1686627690-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:6060
- - C:\Windows\System32\whoami.exe
    C:\Windows\System32\whoami.exe /user /fo csv /nh
    3⤵
    PID:5296
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /reset
    3⤵
    - Modifies file permissions
    PID:5340
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /inheritance:r /grant:r *S-1-5-21-895009113-1202185046-1686627690-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:6944
- - C:\Windows\System32\whoami.exe
    C:\Windows\System32\whoami.exe /user /fo csv /nh
    3⤵
    PID:7028
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /reset
    3⤵
    - Modifies file permissions
    PID:4524
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /inheritance:r /grant:r *S-1-5-21-895009113-1202185046-1686627690-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:3752
- - C:\Windows\System32\whoami.exe
    C:\Windows\System32\whoami.exe /user /fo csv /nh
    3⤵
    PID:4200
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /reset
    3⤵
    - Modifies file permissions
    PID:4116
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /inheritance:r /grant:r *S-1-5-21-895009113-1202185046-1686627690-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:2504
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1828,i,7672177242694093681,14832500444253118185,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1832,i,6277463278879404174,11035196816303604111,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3884 /prefetch:8
  2⤵
  PID:6496
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1828,i,7672177242694093681,14832500444253118185,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1832,i,6277463278879404174,11035196816303604111,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3952 /prefetch:8
  2⤵
  PID:7068
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1828,i,7672177242694093681,14832500444253118185,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1832,i,6277463278879404174,11035196816303604111,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3996 /prefetch:8
  2⤵
  PID:2332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"
  2⤵
  - Executes a command shell one-liner
  PID:3284
- - C:\Windows\system32\wsl.exe
    wsl.exe -l -q
    3⤵
    PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"
  2⤵
  - Executes a command shell one-liner
  PID:5700
- - C:\Windows\system32\wsl.exe
    wsl.exe -l -q
    3⤵
    PID:3336
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1828,i,7672177242694093681,14832500444253118185,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1832,i,6277463278879404174,11035196816303604111,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4668 /prefetch:8
  2⤵
  PID:928

C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"
1⤵
- Checks processor information in registry
PID:5296
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Code /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Code\Crashpad --url=appcenter://code?aid=a4e3233c-699c-46ec-b4f4-9c2a77254662&uid=f4442429-4a40-4e9e-b5c3-8929fd429ad4&iid=f4442429-4a40-4e9e-b5c3-8929fd429ad4&sid=f4442429-4a40-4e9e-b5c3-8929fd429ad4 --annotation=_companyName=Microsoft --annotation=_productName=VSCode --annotation=_version=1.146.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=43.8.6 --initial-client-data=0x4f4,0x4f8,0x4fc,0x4f0,0x500,0x7ff78c943948,0x7ff78c943958,0x7ff78c943968
  2⤵
  PID:7008
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1808,i,4235803456767279270,9228105255653558578,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1812,i,13874700383273194948,6664316626436707400,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1804 /prefetch:2
  2⤵
  PID:2368
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1808,i,4235803456767279270,9228105255653558578,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1812,i,13874700383273194948,6664316626436707400,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1956 /prefetch:3
  2⤵
  PID:5996
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --max-active-webgl-contexts=32 --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1808,i,4235803456767279270,9228105255653558578,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1812,i,13874700383273194948,6664316626436707400,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3400 --vscode-window-config=vscode:f175f3c8-1998-49be-82b4-0397117742ff /prefetch:1
  2⤵
  PID:5580
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1808,i,4235803456767279270,9228105255653558578,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1812,i,13874700383273194948,6664316626436707400,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4436
- - C:\Windows\System32\whoami.exe
    C:\Windows\System32\whoami.exe /user /fo csv /nh
    3⤵
    PID:6176
- - \??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\prebuilds\win32-x64\copilot-runtime.exe
    "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\prebuilds\win32-x64\copilot-runtime.exe" --headless --no-auto-update --log-level info --stdio --no-auto-login
    3⤵
    - Checks processor information in registry
    PID:6824
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /reset
    3⤵
    - Modifies file permissions
    PID:6932
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /inheritance:r /grant:r *S-1-5-21-895009113-1202185046-1686627690-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:4060
- - C:\Windows\System32\whoami.exe
    C:\Windows\System32\whoami.exe /user /fo csv /nh
    3⤵
    PID:1952
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /reset
    3⤵
    - Modifies file permissions
    PID:7056
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /inheritance:r /grant:r *S-1-5-21-895009113-1202185046-1686627690-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:4940
- - C:\Windows\System32\whoami.exe
    C:\Windows\System32\whoami.exe /user /fo csv /nh
    3⤵
    PID:3416
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /reset
    3⤵
    - Modifies file permissions
    PID:5824
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /inheritance:r /grant:r *S-1-5-21-895009113-1202185046-1686627690-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:5132
- - C:\Windows\System32\whoami.exe
    C:\Windows\System32\whoami.exe /user /fo csv /nh
    3⤵
    PID:6688
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /reset
    3⤵
    - Modifies file permissions
    PID:980
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /inheritance:r /grant:r *S-1-5-21-895009113-1202185046-1686627690-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:3036
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1808,i,4235803456767279270,9228105255653558578,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1812,i,13874700383273194948,6664316626436707400,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4012 /prefetch:8
  2⤵
  PID:5964
- - \??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\resources\app\node_modules.asar.unpacked\@vscode\ripgrep-universal\bin\win32-x64\rg.exe
    "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\resources\app\node_modules.asar.unpacked\@vscode\ripgrep-universal\bin\win32-x64\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/package.json -g !**/.git -g !**/.svn -g !**/.hg -g !**/.jj -g !**/.DS_Store -g !**/Thumbs.db --no-ignore --follow --no-config --no-ignore-global
    3⤵
    PID:1800
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\resources\app\extensions\json-language-features\server\dist\node\jsonServerMain" --node-ipc --clientProcessId=5964
    3⤵
    PID:6496
- - \??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\resources\app\node_modules.asar.unpacked\@vscode\ripgrep-universal\bin\win32-x64\rg.exe
    "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\69047191fc\resources\app\node_modules.asar.unpacked\@vscode\ripgrep-universal\bin\win32-x64\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/package.json -g !**/.git -g !**/.svn -g !**/.hg -g !**/.jj -g !**/.DS_Store -g !**/Thumbs.db -g !**/{node_modules,.vscode-test}/** --no-ignore --follow --no-config --no-ignore-global
    3⤵
    PID:112
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1808,i,4235803456767279270,9228105255653558578,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1812,i,13874700383273194948,6664316626436707400,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:6240
- - \??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe
    "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe" tunnel kill
    3⤵
    PID:6532
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1808,i,4235803456767279270,9228105255653558578,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1812,i,13874700383273194948,6664316626436707400,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:5924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"
  2⤵
  - Executes a command shell one-liner
  PID:3628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"
  2⤵
  - Executes a command shell one-liner
  PID:5260
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAQgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1808,i,4235803456767279270,9228105255653558578,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker,UpdateCompositorMemoryPolicyOnScreenChange --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1812,i,13874700383273194948,6664316626436707400,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=1284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe28dac728,0x7ffe28dac734,0x7ffe28dac740
  2⤵
  PID:6336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Owner/User Discovery

T1033

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

process-1794532617666-5392.log

Path C:\Users\Admin\.copilot\logs\process-1794532617666-5392.log
Size 2KB
SHA256 c220cb931d1e38cb89a8125509326bc615b515f14ca2c9abd8d1eb3592d5c269
MD5 ff62e60056e0824c64e66e192cee542f
SHA1 5b352aece5ebe1f6e3cfd88272be490b37a99fe3
SHA512 3b0a07f481e4d7b9f66d57635ac8e7e789ba9c868ef5e45383cf5339f961cee1185c3d163361443751778de95b67eebda200c61d0345606db734bbf1eb94ef32
TLSH
T1C941E13C0E85D0BE8721AC5386AA1A702B19A02DB748AD2DC674CB657041BD5263FE76
MD5 SHA1 SHA512 TLSH

Submit Download

process-1794532617666-5392.log

Path C:\Users\Admin\.copilot\logs\process-1794532617666-5392.log
Size 7KB
SHA256 bd7608b68fe1501e630326e1fc31b0412c4e24537fdab3d6212f77ca4637f475
MD5 2701d57c7a70281b312bc30047e36623
SHA1 3d914c983c89343639f0b9356a49617814b3fd33
SHA512 87a77f7366240e18ea462bc5a0d6c537e2319b55203d4fdde5f522dc339373929b6768b271913d38e6a173a589c1cd1cae6336e5e8d471da4743631ec05baabb
SSDEEP 192:gySqvvrvWvTFKRQcZt+OOcySqvvrvWvTShW2IR9PvqvvrvWvToK+a3lW7:Lylyayz2
TLSH
T1CAF1C07C0E85D0BF8721AC5387AA1E303B59902DB748BD69C674CB65B042BC5163FE76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

process-1794532904002-6824.log

Path C:\Users\Admin\.copilot\logs\process-1794532904002-6824.log
Size 4KB
SHA256 d7721ebdbaf67a45e1850099918550ad77192aaaecdd79f24e0b3cbd4b476346
MD5 afa084c05961991b9f7880d464f8e2fd
SHA1 d22892b18d35368cb1fd2605b61a56607df93a7f
SHA512 22453e329d131db09cc7fa1536d1f67b2dd651da7edd88b49d0169b60232db8f302330c6572d0d1455049ce64890ebdb99cafd9c3e6e105259a02e4032468a76
SSDEEP 96:HX3qvvrvWvTY0Ky0KLDbzTqvvrvWvTIVfpVi+WgvPqvvrvWvT1VQOzHmxa2TohW:HX3qvvrvWvTY0D04DbzTqvvrvWvTIVfs
TLSH
T125A11428290AD06F8713AC13D5790F10276FA01DB3AC59E9DF78CE14245A6C4367FEB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.vscdb

Path C:\Users\Admin\.vscode-shared\sharedStorage\state.vscdb
Size 12KB
SHA256 f8df612c59d03dd2d68f182377b24a5b54c0da37acb409d9bbcc902c70d64774
MD5 61d238a33cc0606baca9ddba4b51bcaf
SHA1 86db387ddbd7939f9f15e13e85b29eaa6a7e685e
SHA512 98a058f14fc91eedc4bb5423418b3cf5db5caa8a3fdb8a7d9159d8e3629ca48eb94e209b784103e03a31713b78030c5038d91815eae717adb3d32a0740479190
SSDEEP 24:TLVIXEKfz5fwHRi1uIuibfWJ7HRVBiHRjUeHRtv:TBkVL5fwHw1jTDWJHAHlHf
TLSH
T16242EF87E18514E9C7906BB9F88336553FFC9FC4060B522238C4665D69360E8BD9B4E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.vscdb

Path C:\Users\Admin\.vscode-shared\sharedStorage\state.vscdb
Size 12KB
SHA256 898791cd1814b0511368b577c005bbabdff03a4686799e33a59577c0cbf925fe
MD5 ee419cb9b41754db468550e2ed5bb9a2
SHA1 a1026b3f57be5ce2cb0b60161ef1fda89ffc7681
SHA512 8a3e06d7b4b3eb3010cc9ecb3fcc0a557d6e2a317f4657fb297b0eb126876e28bb5e15189048e2944e0836430f3a0717e872c3958e48a0983170931d62e11d6a
SSDEEP 24:TLbiXEKfz5qwHRi1uIuibfWJ7HRVBWZHR+5aD5eHRtv:Tv+VL5qwHw1jTDWJHaHgRHf
TLSH
T18642128BE18514A5C7C06BB4F88736653FFC9FC4060B121238846A4D69360E87E578E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

argv.json

Path C:\Users\Admin\.vscode\argv.json
Size 798B
SHA256 d8729ca4de8cb3a0391ca4bc927d450eb0b17302fefd2f1007799e9a96f42157
MD5 fcff1ffa1197c888dd54a41c95efbf99
SHA1 f5cc2ad6d953e5f45a89901eeb4e04d8d32bdabc
SHA512 2ede4234ef456fcdd8ea2a3460c10db0a312ba717ded15563b431ab182bfb984b8dfbcd2126c2e24d8dba7567965f211906b5808eef9f635028b66e1b49918be
TLSH
T18B0125743FB42674990416CB794A17E3B737516671A7AB0C6536531D311C8B0027FDE3
MD5 SHA1 SHA512 TLSH

Submit Download

05e73a66-1ec9-486a-8a61-c5a63329faae.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\05e73a66-1ec9-486a-8a61-c5a63329faae.tmp
Size 131KB
SHA256 36c54aa36b2ac30aaafeeba67974a059caf6165251dff7afb37be026a9224358
MD5 cf95558e28174d5d24320adaecc39128
SHA1 7655fbd03797414eac1230cf25d90779f2466932
SHA512 796202c83837082327bcd10b1e2af160e7eb0193c47a4bb2dccaa52e3f499c6d27e33fccf8bd338413c6c2051d6c2a4718009cd80af6a98a45371c0721147aed
SSDEEP 3072:2geF+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:DeF+hFD+7t56OD9ZfSApprE
TLSH
T1B8D30232AA95D877C9FC7541F147A300DEB668ED85DE2A0D444A9F8EA09F84C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f40381a-4f1b-47ec-8321-58a47d00e0b4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1f40381a-4f1b-47ec-8321-58a47d00e0b4.tmp
Size 209KB
SHA256 9fde4143f8c9a7a7ab698fa35e31046937139dd01cba232b922368f3a82403bb
MD5 fc187f60fad7437d9666ed70dd0faebc
SHA1 07b1d51833905825dcda4952773d46cd37768a5a
SHA512 2710b014183fb2e9430b717c42cca8ed5290b8a5454dcea15f6bdf698eec031eaf82276e96f5c4411fae75693afe256a1bb5815def270c73eb1578427217e2c7
SSDEEP 6144:zT90Hh4V0HMY5lSj+hFD+7t56OD9ZfSApprE:zh0B4V+MqMyFSXD9ZfS4S
TLSH
T1352412727868F87B86B2B602A19F66059DB625ECC6B53F0C44774E87A16B54C0A13E33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

235ebe22-684c-4086-8acc-60bc95846d68.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\235ebe22-684c-4086-8acc-60bc95846d68.tmp
Size 131KB
SHA256 92351a7d6995dfa3d128b85b5195971e2948f3853cb96bddf6bf03e6ef273bb1
MD5 118a50e5938ecf5dea3e31b6fa244d4b
SHA1 a3d64360817916a8e9f4f79b9edce8e11e4058a4
SHA512 a751f8d4916a22efd19523a033273bac37a7d9f3c2fa64e142b3252b76323074dfe921b81e6294e618403c93075d0bd39fa495c8367d7e406683d2e92c34603b
SSDEEP 3072:C4eF+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:zeF+hFD+7t56OD9ZfSApprE
TLSH
T10CD30232AA95D877C9F87541F147A304DEB668ED45DE2A0D444A9F8EA09F84C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2db9366b-bfa9-4792-872c-6a42958dcf41.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2db9366b-bfa9-4792-872c-6a42958dcf41.tmp
Size 131KB
SHA256 94b5b5d045ed6e101a14019d7dcbbc68de6903e0941bb17ebfba49a0ec4e4d6d
MD5 255f533bb611f72c09dc687f4d01d4c4
SHA1 60206d3e3bddd55e344a2ebab481ecaed191f02d
SHA512 68c08dda157a84ece94eab314e9b8cc724b381d5177e098f400ac03a72e62470e7d43af5b9f783285ee792adb7b144397109086d22bd77d6029a29e643a96527
SSDEEP 3072:2qeF+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:teF+hFD+7t56OD9ZfSApprE
TLSH
T194D30232AA95D877C9FC7541F147A300DEB668ED85DE2A0D444A9F8EA09F84C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47abdd47-1796-4814-b09b-074eeac0f0e6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\47abdd47-1796-4814-b09b-074eeac0f0e6.tmp
Size 131KB
SHA256 4bd2565117a5a5a229bb3649661c9906e90c886a252eded6a4164449bd162abd
MD5 24e5ddebffdd6759df0fffc7985d4c1e
SHA1 ebe89fea06d5065698b3b9fdf820a1ef2fde2156
SHA512 abcdde6be2ad9afde8ec480d3c96c59011ca5fb02eed03ef85af9f34514c228aa1d1caacadd5de195f50751032e9daac3cf7f8e79ae310bb1d4e1027559c3ad7
SSDEEP 3072:C4Jg+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:zJg+hFD+7t56OD9ZfSApprE
TLSH
T171D31232AA95D877C9FC6541F147A300DEB668ED45DE2A09444A9F8ED09FC4C0763A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71470c1b-2e36-4c84-bc4f-405f6354281e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\71470c1b-2e36-4c84-bc4f-405f6354281e.tmp
Size 131KB
SHA256 a0af85637a73838bb62723f6b068136d84635cd67ead57559b29f93f046fc8f4
MD5 34e295eed447694db0c858ee8c0cc6d0
SHA1 2be7d9d0c012288c67547a2a36f0dd0c842041ed
SHA512 64b6d80398801b5f7779612a05d58185c279c8e3a8db2cb2b72076e88129873869814b08dd7ac3d856af6d5620bdea6b28204018216994ab7cfe21f77138ab54
SSDEEP 3072:24eF+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:3eF+hFD+7t56OD9ZfSApprE
TLSH
T16ED30232AA95D877C9FC7541F147A304DEB668ED45DE2A0D444A9F8EA09F84C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e2fb373-535b-4152-990e-d738d21539e8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9e2fb373-535b-4152-990e-d738d21539e8.tmp
Size 130KB
SHA256 a2e769acb8c390b3f360b880e8fbe4d5b9734f3a1fabfa4686e7e2a1399ead29
MD5 fe170b5fb846aa5cbfd09950d1cca169
SHA1 36a71fc0aedaec3e46f3694c6b245d02b500262c
SHA512 de2574005970fc0f5389b63c2a368c53294b3de4fff29cf959226a4194312b08b048e2e857845c60898983c080720cef3e99ac92d662c8aee2d671bbbc616e14
SSDEEP 3072:xBW+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:7W+hFD+7t56OD9ZfSApprE
TLSH
T15BD31232AA95D8BBC9FC6541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 4d0c5fbc12a875642429b0dd2daa46ea463d1c2b1482abf3f14cd122bba54191
MD5 d588345da3672470b53c54f52ba4c7ae
SHA1 a4a09d4dfe1f7232a6aee942ed8ba9fafacc4c81
SHA512 8fdce53fcf159847b327d3aea853aff1923b0786fdc362c79ba5e9c4a508f118e8dd193e48658133923b5b97a69d4cf2f94ecc2a52de56b372a393039e32aff8
MD5 SHA1 SHA512

Submit Download

03afc883-7b77-43bb-b487-a2b5e51f2738.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\03afc883-7b77-43bb-b487-a2b5e51f2738.tmp
Size 17KB
SHA256 b71f1035301ff526e21cc47c8495960554da06529528b869db95766c6a078045
MD5 bd9a4f8df8e9dff5fdb7a6c05901666d
SHA1 ef367b9fe2c43efd8e916d96b974c2c5b40f886f
SHA512 5767a894a450a7d75e75f6be3d5a0b0286395f770728607d962f30503a284db79f7d3cd5f85522d260baaceeebe88fde63172d1f73872425a21fd4e08fcf7108
SSDEEP 384:uRUmz+ha0mEXS1rw9+5rbXerjZA34rqVnBa6E:fmz+ha3/Vw9+PVn4J
TLSH
T18382C75EA8202A7B9CEBD22AF911BB6AD3F5202159D41E84F7FC8D3D19D76DD2207403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fb6fe51-0c95-4a91-837a-b6ec0c2d1dbd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0fb6fe51-0c95-4a91-837a-b6ec0c2d1dbd.tmp
Size 16KB
SHA256 02008c507e9e8e01fc441a7ee1ea1e934c0182fc00ee9354231e138ccf4b5596
MD5 75d4391d6c5314c5150ece23173247cd
SHA1 36f05ca2369481c0debcb3b354aa3976a0a58f06
SHA512 de5083c8d8c7a9d2968cdb15315e882d2eed29519c64907daf0e1a2318d33228b74fc18d77b9e459355836ad5df6a7864303b8f6a876fe9c0da82d5e416d8faf
SSDEEP 192:wRb2cBz+hnd86sv7ahbPRp38mxOWT5h9/Hsb+WNJrXwP/Vlo4P1ec4d6J6meSgY9:wRamz+hh4mBXBhw9g1lX7jtAYknBa6E
TLSH
T1FA72B75EAC102A3B9CEBD226F912BBA6D3F5202568D41E84E7FC8D3C19E76CC6107553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2570745e-d5e0-41d9-965a-60176a90a65f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2570745e-d5e0-41d9-965a-60176a90a65f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

28ccef19-7409-4f2c-99c7-ec9c66ebaaf1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\28ccef19-7409-4f2c-99c7-ec9c66ebaaf1.tmp
Size 14KB
SHA256 88566dc9ca5b5bee94a40a2330a7bcc453b8aca144a3f283e76d7b46e7f95f53
MD5 e8b8f1ed2312c03526114d2adfa1b337
SHA1 fdcc2ab67d5502f75b6fa61a414aba6fed621c1e
SHA512 9bda0448421e3d061d27d46986ed3529ee03cffe444123b2f5f7a295c0431f277b6f2bb32f33e143267c1b8f04d035c30ccd1890f93b39d1b154203555771240
SSDEEP 192:wRs2cBz+9868v7ahbPRp3cxViTT5h9/Hsb+WNJrXwP/VPecl6meSgYZRTai6TVyN:wR3mz+BomBX8chw9g19xAYra7E
TLSH
T19762A62EA810297B9CE7D22AF9127B67D3F5202155D42E84E7FC8D3D19E76CC2217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c42a585-8c8d-46da-88e1-bff252dcae13.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2c42a585-8c8d-46da-88e1-bff252dcae13.tmp
Size 15KB
SHA256 0eb84a0d3293607c5281545338a4faae53e688382a99759f3b7dfc4d915c6cef
MD5 2fb499b9531ecd581db7eb5173108948
SHA1 c79d27ab949404c3503522d9e2b63408ea555f3c
SHA512 9f1be49aa24bca56f39ac5b0735da006556e3c2a6e20c0bee029dc8a265aa1ed37c29b8ebf845884d3282caf4772ff8186946ba435a36dbeeedc2373e8e7367f
SSDEEP 192:wRs2cBz+986Gv7ahbPRp38mxOWT5h9/Hsb+WNJrXwP/Vlo4P1ecl6meSgYrnw0R+:wR3mz+BymBXBhw9g1lX7xAYrnBa6E
TLSH
T1D362B85EAC102A7B9CEBD226F912BB66D3F5102169D41E84E7FC8D3C19E76CC2217453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d255df5-e4ca-48d6-8d7e-94aa65f04be2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3d255df5-e4ca-48d6-8d7e-94aa65f04be2.tmp
Size 16KB
SHA256 4f01eb5c9deae9e13699bba0e20919873343a6f8ad2f6aff07f497dd18e171d9
MD5 d942444020b3abd1fd1ee68dac63e801
SHA1 d325e6c6a082d367cbfb748a96c453555846bc8f
SHA512 19a798cd52d736e237299844fdfb0333fc16cc1f09232a29ee9760f4587c61e9d2d64c8263f9788c4707bd46b802edbf2a9d393a96a0ad5c6120a99d863a3149
SSDEEP 384:0Ramz+haqmEXShw9+5rbXRcZAKrqnnBa6E:bmz+hal/hw9+znn4J
TLSH
T13672B75EA8202A7B9CEBD226F912BB6AD3F5202159D41E84F7FC8D3D18D76CD2207543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f19b762-d662-4ce5-9914-518c8a4e6607.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4f19b762-d662-4ce5-9914-518c8a4e6607.tmp
Size 17KB
SHA256 ca73fe35779a3e5b7c1a0ac067520d7e1e7d2c8f62174932fc60b6211e9932df
MD5 c926a30c054d7321487617b45332cbe8
SHA1 2e70ef1452141961bb752fcbf85be12fd3dba936
SHA512 e5fd407d16c5529487ac4d8f5bd5dc31e85cec3467fdc54243813b0ef55ad98378c6666e223737f38e3f13a250e4b56e1e92d7e574ed11eb421acbf91a6da43a
SSDEEP 384:uRamz+ha0mEXS1rw9+5rbXerjZA34rqVnBa6E:Jmz+ha3/Vw9+PVn4J
TLSH
T16582C75EA8202A7B9CEBD22AF911BB6AD3F5202159D41E84F7FC8D2D15D7ADD3207403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

500d5e3a-a5a6-4ff3-9c07-838df8c2e922.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\500d5e3a-a5a6-4ff3-9c07-838df8c2e922.tmp
Size 16KB
SHA256 f6272594c1eee1e7cfe2229c39d7553b0106c72d0e68b2ebdf75959f7e02c4c1
MD5 d09de15e6b2ee57d0089a96300e30d5c
SHA1 108c795041c21b85e556081c62fd57f4103938a7
SHA512 f746ba8d6a7aeb8a8ad13fe37ce80b6c8efb962e4c32313e98e6679eed114598bb1ed6395add9c99aebeb9730523e5a8f4c2978e8d661ba728492fcf6eb3643e
SSDEEP 192:wRb2cBz+hnd86uv7ahbPRp38mxOWT5h9/Hsb+WNJrXwP/Vlo4P1ec4AgcA6meSgB:wRamz+hhKmBXBhw9g1lX7IZAYznBa6E
TLSH
T1FE72C75EAC102A3B9CEBD226F912BBA6D3F5202559D41E84E7FC8D3C19E76CC2107513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5299f7c5-68ae-4c0e-9fa2-9147a7a8e9d7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5299f7c5-68ae-4c0e-9fa2-9147a7a8e9d7.tmp
Size 13KB
SHA256 445308f1ea595a0d57488acdd1a25add28340919d0050f37a92386a0dd52af11
MD5 e9fe5cf63835ccd7b49255dec698938c
SHA1 16625430061712dcae1279470d1af5d188fafef6
SHA512 ccfff3411968c87b556eea730e0c5b7d8504d5d34e3ca28a6d517ac5583a063fee9024eb89055fb8ac1d167d484c9d857a6693311ec9fec03726720383d37f3a
SSDEEP 192:nRHcBh8w82Pv7ahAPRp2cVM4R9/Hsb+WNhwfcuSfWf43T2sRTai6XVyIsnAUgE:nRHmh8UHm8XBhwGkis2KaXE
TLSH
T1E552952EAD10297B9CEBD21AF9127B67E3F5102124942E84E6FC8D3D19E76CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6647d82b-0463-4e93-9f26-9f93e359b1fe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6647d82b-0463-4e93-9f26-9f93e359b1fe.tmp
Size 17KB
SHA256 7ecc265a0219311591285a8eda2bc546f69addfff098ca633f39d453a5643465
MD5 6c7b3a01c7c1f3cf6c18ce80aa1a38fd
SHA1 e2939b1730b46f82688352669a8b7460722b6c45
SHA512 7461f89fb5d54a4972a1af25339704cb1445110806b47d48076761be517359f1c6295cdbd1f26929fc6fb9c8e32bd2e4c01c3c7f8caf21e5a46416093e542bb8
SSDEEP 384:0Ramz+haAmEXS1rw9+5rbXRcZAEqrqInBa6E:bmz+haj/Vw9+6In4J
TLSH
T10182C75BA8202A7B98EBD226F912BB6AE3F5202159D41E84F7FC8D3C14D76DD3207543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

674fa3e1-757f-428d-ade1-b2b69bda6e8f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\674fa3e1-757f-428d-ade1-b2b69bda6e8f.tmp
Size 17KB
SHA256 965a1455dff007abfb1cc37d5b8f1f7b841853c9aa0e4725db60d4328a05258c
MD5 7a3a16bf4bb2b4c7139c5caffaa833e1
SHA1 0963aa18aef1afb38bb0acd6c479192ffd8fc9ff
SHA512 6670628b25237832020e7a3b3623dc3a76efe447946c22438955d8fb7c67fba1137f4fee8f4bdd639e45dad539d1badfa9df86cb8d2cd0d5f47470a4b0244f86
SSDEEP 384:0Ramz+haYmEXS1rw9+5rbXRcZAkKrq5nBa6E:bmz+hab/Vw9+C5n4J
TLSH
T14782C85BA8202A7B98EBD226F912BB6AE3F5202159D41E84F7FC8D3C14D76CD3207403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d51b6b4-aef0-4748-aa07-c095d72d012d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6d51b6b4-aef0-4748-aa07-c095d72d012d.tmp
Size 13KB
SHA256 cbff59adc7b520f0de2985ad921ee12da5b00aa0aaadd64b2862a8b11ece7f19
MD5 8620b09f169758aa6d92f2e7b8a4c29c
SHA1 c265bb3d46a3af238c08a66240583a655be69a0e
SHA512 017bb2738ebc633e2b1824b1fe90215df48c3e3ec2d222610a597c250ca9b406bd8560dd6e15c6ddcea319cc301407ec464c4569fc29dfb4f74923aa99fdceb8
SSDEEP 384:s2jGN7KxkXqKf/pUZNCgVLH2Hfgsl1/XODGN+ErU3pxHG4xHk4V4:s2GN7KxkXqKf/pUZNCgVLH2HfgszvO61
TLSH
T1C4520A27A88C9A3F0FD8C54DD8177F4FADF101566268492452FB9C1903A5BDB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6decde0e-0c29-4464-8e83-4aa5a0bdda32.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6decde0e-0c29-4464-8e83-4aa5a0bdda32.tmp
Size 12KB
SHA256 f826aea48b03a86e29f2619d66b472475b3f6ff92431d6459efb79ac07f46bc6
MD5 d22060059d4efd9819fa24504bd051f4
SHA1 a230c0046acae03c89a2c12cf73fc0010795577d
SHA512 cf05ee264935268347629b487ed51d75e144e0d82222261c94ea09f3e3863a8d62785edbf06eb3e7d26c181fcf3f105000b69495b962cbfabe261c2ff3373554
SSDEEP 192:nRHcBz8w82Pv7UhAPRp2cyU9/Hsb+WNnSfWf43T2sRTai6XVyIsnAUgE:nRHmz8UHA8XNhw3s2KaXE
TLSH
T1C342842EAD10793B9CE7D22AFA527B67E7F5102124942E84E6FC8D3C19E75CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c73cbb3-a903-407e-a27a-7908df59fc49.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7c73cbb3-a903-407e-a27a-7908df59fc49.tmp
Size 11KB
SHA256 9ac4b768eee7ad6a3e617f062deca87c1784db296b794a95f5ec649acb68b682
MD5 76414627c588fea6e0072bef887ed0a5
SHA1 2c4991833b91626f8c7ca1c8fe3f88f475cc2207
SHA512 2cdaeb998bf95646d9545c52114d324b2d0a16c3f043df560e2a88fadfebea2f604e029c36c69a54332930e11c694ae76419d80ed7d94a87fb1e965f6f4892df
SSDEEP 192:nRb8w85Pv7UhAPRp2v9/Hsb+WNnSfWf0CWRTai6DVyIsnAUge:nRb8HHA8Xchw30pafe
TLSH
T17142942DAD14793B9CDBD22AFA627B63D7F5102124942E84E6FC8D3C19E76CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89254bdb-6163-448d-a3cd-ec03dfed9fad.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\89254bdb-6163-448d-a3cd-ec03dfed9fad.tmp
Size 16KB
SHA256 f31086dd401f367f6db14cf3a07ff3bcd67577d8c0cccb5a4c9014c5cc075131
MD5 b98b429efcdaa01f1e8bb6d58575cab7
SHA1 268ab4f384d46beb9d8af183f1658881adc2e9ed
SHA512 56bde6c5d16d6cdec2d2b18d0205690ca78beae41c2a58c98ae56e7b7ba9070bb4bc7fe5bc57cd8b995ed9d1c69b066f40332818a6596b034508c3d0ff453106
SSDEEP 192:0Rb2cBz+hnd8POv7aIbPRp38mxOWT5h9/Hsb+WNJrKtwP/Vlo4P1dt0AgcA6molV:0Ramz+hoqmEXBhw9n1lXRcZAgYknBa6E
TLSH
T18772C75EA8102A7B9CEBD226F912BBA6D3F5202169D41E84F7FC8D3C18E76CD2107553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ca144ec-f4f7-427b-a47b-e12c62c53acf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8ca144ec-f4f7-427b-a47b-e12c62c53acf.tmp
Size 16KB
SHA256 1e8f9a115cf254b2ab3d11309212e19bae4b1ff459c66ea62fa37a6245d6e587
MD5 9ac3cc0027bd20fbda97b2a9547f67c7
SHA1 f5ebf3c47cdff207026e6b82f2eba953c42be43d
SHA512 898b785aa16886f4d136756d92e8e70f240f5fa5e0a4b3db7d2a2c364cc5a77544ab55f0fc6c6359ccfb1da2d1dfaae3d9beab5bd1ed0a24aa9260fcee40457d
SSDEEP 384:0Ramz+haxmEXShw9+5rbXRcZAKrqnnBa6E:bmz+haQ/hw9+znn4J
TLSH
T12A72B75EA8202A7B9CEBD226F912BB6AD3F5202159D41E84F7FC8D3D18D76CD2207543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91923760-4725-440c-a325-265f33f7baae.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\91923760-4725-440c-a325-265f33f7baae.tmp
Size 13KB
SHA256 ecd376a9794b0ceb39f54c8b5ff5aed6408d3afd5110f172e9d40d8c3b49c3a2
MD5 de001ce5fa9fc172767c63ec46d091da
SHA1 8ade8e51f4e3f87cf67ffbe51e7322de0c7efb72
SHA512 4d497b4aabf02ff44bc2a2ef4087f2d84d246f048736f98ff26e349100f4b415e61774def8fb706f529b19458e4b45749522c01cf2335611996ae378c34bbcff
SSDEEP 192:ZRs2cBh+987Pv7ahbPRp3cVM4h9/Hsb+WNhwfcuggK6me3T2/RTai6TVyIsnAUgE:ZR3mh+YHmBXKhwGkWO22Ra7E
TLSH
T15D52852EEC10297B9CE7D22AF9127B66E3F5202165941E84E7FC8D3D19E76CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cf02362-f2a7-47c6-b142-2b40342bd984.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9cf02362-f2a7-47c6-b142-2b40342bd984.tmp
Size 11KB
SHA256 07b67e7b8f9a63b3a47ffbd3c5bb87cc2db33de13e8adee8cf31fa8d8fd7bb8c
MD5 434d095aec2763abb5526f6025c3a7ec
SHA1 223999dd40d38def1e4fb5fea587b94f7caa4368
SHA512 b9704068b3681622e860db5e2146f774c4855cbb5016d5223074e6795093ed4309519362ec6000fc78f0960d757b543417242eeb23e51d72b04697286fa8aa64
SSDEEP 192:nRb8w8hPv7UhAPRp2v9/Hsb+WNnSfWf0CWRTai6DVyIsnAUge:nRb8nHA8Xchw30pafe
TLSH
T1FE42942DAD14793B9CDBD22AFA627B63E7F5102124942E84E6FC8D3C19E75CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 78KB
SHA256 e35e5dcd69d2cef0eb8d0c70954e33c271d7455704fd05c2a2e1d12fa42584c3
MD5 3eb646c53642ded8315b91770e2f1d7a
SHA1 3dd89b63de3c47f5841b02f0fbb8ea9f50169583
SHA512 962cc14a1f6fd7481e506985b17b0f6373ca0c94d0fedec0e461b17b84dd9cd900db8688351deae61e1fe033f8a6d74999d70ac432c303ec1399e86e8ee3f4fb
SSDEEP 1536:+Q3yhf6qdIjJvoibt1mk2W7sPyDuhjwMZ0wwNHpqhEaVf8:+Q3BqdYV1mkYPyDWjb0w0HAhEh
TLSH
T10F7312F451E0F9BD51FAEE67CF95C38606DE865EE1CE2908EE1190730F0ADD850A115A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 546KB
SHA256 7db18d2d7b8d10860cbedfb898862ac45b4c58cf4d739eb6928a30d511ab2d7c
MD5 447327b110e0a48106af3045d579dbe7
SHA1 7f61847368066fa0c4c3acb635989e1b20a7dedd
SHA512 f3982f188d99524e3bc8d9a942c9d68e6460e88ae31b51d3b71e74c64e7a4da432f87ba1d90dbb2904e33ef6f90ae23790fbfa31172c5e4094725f045d5f795b
SSDEEP 12288:95LVY4FDR8bpbivvmk32mx6aFfR3luxTkI73ZH6R:9hVYGR8b1iGhaR3s73ZH+
TLSH
T127C423B21C315DFFED7CB4759BAC9B94704E0B71C0272486BC6C36CAA914794E7C8866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 92KB
SHA256 e6ca7c73d5e6823970259644cf09e6d010ce983ae6174223c21355edf5769e51
MD5 aac5d446e8ad51e404c03fc3a57491ce
SHA1 a9c95a5f237bc65ed9ca92a06e282578b13dbc1b
SHA512 3016ab0d707f9acda319daeca3efb8854c9578604629ac81ffe05038101ad1698d205a3da4c51feb27bf35367637da335cc89cfc4e8f6c078c3cd19d3a234c78
SSDEEP 1536:BW3NKJDCma6TE9GNiGhNjXEumXq3zkXjoMqjtu0vz+jc4XsES6JxMkN:s56NNLIXOzkX8MqJX+jcEsES6jMkN
TLSH
T1A2931246A49DD19CE4279CEC803A1D3813B0E88BAF3452127CA0DCB9C15E4AEF8678F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 428KB
SHA256 6a077b5c7bd7b66a396f0a91fc7314350fcc1c38c259880aafc4de8112e86ddb
MD5 694d9e71f974e6b9500c4c3ab5e41fe8
SHA1 91af348171aca3e29bfb6b9470673224928e9cf1
SHA512 e26fe4d8d150e592cf64fdc44b8d005beaabe757bf20357968a4b83e2717c35bcaf7a6425a8c3a9d2f35465c7218b1c0963b21e05ea184981bf4d7f019d3f9a4
SSDEEP 12288:zbNFW6KPNfufHSRhDMshlu3spi8pkeUJfUnL3FVb:NN2NAHmTlu3sptkRf0L3vb
TLSH
T14094231EA7E43CD85100778949F84C4E8636E9D2C7FDF6C6C966AF11A898425383EE2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 114KB
SHA256 de4a8912f8a9d53f1eb32ad8985f7cb30d1484241bd11b31577bf3c879047c2d
MD5 e13ceb8fb63e7ab2e96554d2aed0f6f2
SHA1 95609f590f68ba3c01dc2d86ab52c59d74245e29
SHA512 3ce279523fd0c51bf7480bbe8b22e4e6272b0d994a904ec919c14fd4f8690a260a8c323cac58de8d9dedf4b1c2198d3ced86f83e18cfa51da3deb8395e21ec07
SSDEEP 3072:uyT+JBNZyRwmRytSRDThnbTwnigaH7TYpGvvfAW7w:XkBNUx1DTJUnig0YMfxU
TLSH
T1EDB3139373D33EBC518CB16743400A2A9D0D178FA3B39E52F7D6654E42B059A537056B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f
Size 29KB
SHA256 8aa3ffca51f0c0503d735b9a00b4ea3c97263c14b33f43a094c8c9ae508a5b66
MD5 9c8ae4c068327080ef51d49232bdbf33
SHA1 b51f50417632f3f742bc4c0628414b3e816ddff8
SHA512 3b5e34a6f1a54462c2472c5225c2d45a60dd106d27140cf08cb4223d078205a95fce525987e95c2225c4f43015bd929fea8f0bc536813e8d55fde98d35fd5f6e
SSDEEP 768:4hCCm0abBFnDBq4uTcNX/VMkERZt9FXeaiQ+P6hLtyUbS:4w5b/1luTOXtMRZ/8xQ+P63yV
TLSH
T15DD2F1CE363D31FFAA1FB9C11DDA10D18125A8468DA41196BD3E5ECB92C120BA0A7B5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031
Size 24KB
SHA256 d3cfac660fe921dcf8ac3d59510d9738ac36cfdb8a64ccef162f042394459654
MD5 c85d11176677ce2599fd8fddcc67dd89
SHA1 cde1e4ae58454224630167c4f48ba42fd39b182a
SHA512 4a692b4afb0451cc5acdeb2468df8ac431763e0247e11814d6c1ef9f9da27c0f2656e1f47c68ce47d3a8d6e6e80e04011fae6bf303a93ca61c61caf07375704b
SSDEEP 384:6QHfU7t4/Fakugiz5F9+L+oXSbbedCQn2SnNQC8japXoyaKUlgDzFTFQ0/WG:7Hsh4/FqJF0sA7nRpXoyvUlgDzFe0/Z
TLSH
T103B2E13969157124CB485F0FC3F6449373F9669D21AF4EC2FB46C9C759EBB89142020C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038
Size 77KB
SHA256 899d750bd699f242d2ead8c69541dbac085d0c21ad2ff17390d3c561f8aebce4
MD5 321c6e0292c5ecf91c6fe34bcd083456
SHA1 d03033a4ad35a31c8cd7326d53a3121e84b2c93b
SHA512 82ab8871e89c25360ca975a28120fce02cc5fe3412b79b173f211a49a3d014424d80cd28a0049a8737a0f8601d72d4a52ab4b027f4a4b526f322528f14adaf4d
SSDEEP 1536:93T5J/VwSoo7U7JRm90s+u/j58tJM3N0yM3XucqTOjyO:9D5hoo74JRfmjtanuFTkj
TLSH
T1027312D7F494B8DD6A9722B8B18C7A7B5BF6B5310F2A395908CCB1023A728293C6C151
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039
Size 89KB
SHA256 4cf1be117dce5dbafb03af2889cb9002859c00315fe2787463b4f999f1edfe4a
MD5 c7eb3c152adf7dd4b3559841d14af9aa
SHA1 adac3bb1b9a371c0866f571cab335beb7a0c9ec6
SHA512 8b7e0228d318c113a554f6c9469a8f19520a75d02e104f9de902914f74237269de4cb4449dc39a3b8decc8ddf5367bddc660dd4e9028a99aa73080dc8d655fbf
SSDEEP 1536:F2qndVmdvtBNezk/qzGaTyvObMhoibbibOB7Lzyz++TA++TZzyF60ulC1xkU:Eqd+MzoGb2oiPhryC+U+sn9C1V
TLSH
T13893123324B331C9625533CE52805D86AB5C9ACFCD32D60C7FF27E1A8E25D55A89618E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a
Size 420KB
SHA256 126b8fb2d010d4d14af94ac99e9f9ba4c356c5e7808e2d4c26cb2530ef00997e
MD5 ca06bf197fdef17449d6b88e29f5c599
SHA1 9ef2e4ad39dc91b7a3f9ba62bc22f2fcf089ba32
SHA512 25ea4ecb7ea9e7f4e5031a7c1551b77ba6c82382f1da19878db2ff4aa66d9ee6d395466f0d41631fee968d8ddb091df2f73ab56b6f4ce8e17bf617ce04f7d381
SSDEEP 12288:8c1yNOn1Glt4dZ7SlIfuovg5O7EiuR3NYexIyf:1OAk/C7wI3vg5dicdV7
TLSH
T14494234708AC67504F5B3451B8EFB22972D4A14F2CEEAB4D01DF9135B87969FABC8350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000042

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000042
Size 114KB
SHA256 4549ab8f9c96e3c3ce0bdc4bfa74f2908d4a1431ec4c0ec7afd75fbee853aa39
MD5 1df9643b7eec64486bb72d18b1accf80
SHA1 7c2a13c7f4103fcaa1555cbe255bda3bca36ef2d
SHA512 26a62b205df2cd045494c59004f6ae9fbbfea023a51bd74d5d5233ec66862a5d1d13425a1bc46fa63a83d41d9ee0c4ce185d28f804405242b4fb72c97f637ada
SSDEEP 3072:RFnmsRGuJj+jwBZuN0SUbeT84Y7KDrJh/i:RFmF6jgwnAf83B
TLSH
T183B3122868A272AB06CD710D879F9C7C4FCAC9529A2B07DFD06710DCD8531DB21E64FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000046
Size 29KB
SHA256 4f518129baeeca72ee8b09c434d77f7efd68809e51952430e82e909be1b9ecc9
MD5 c3d181d6ad37f104f4a89ea19fda6d0a
SHA1 2499cfcb0fd80c5ce86d706a4221cceb85f6c5b3
SHA512 f48188df0a9f60a94948951651a9c4c57072e702121f6ea13c94f30b8f0bb5e6f28648c5cf2f8ae85053737c0c7f196a2d418f1bb0be2d7c378e46cb04222aa0
SSDEEP 768:YHpskWBefEejlc6jX161/ev6xR/kpLWYKk2RoEFkJF/DFPqaAkKcz:gWofEej6Eo1/NzspNUjkfRCCh
TLSH
T135D2E1E998A44003D3B1FD20EBEB32CB41BD4618E9F1A54241494DC5D9F323F97AA4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004e
Size 67KB
SHA256 038d846eccf77f5835d42d77da01350a34a1ea9c5c9b2799027ebc4e28a2834e
MD5 6a1cbf3d8e548da1fd3d719c67d433d5
SHA1 717f5500222bdbecb7cd434ac5ded1d0417d4c03
SHA512 4b0eeb708b192b1732cc6338df83b0e7c260328e308df9f00e2c0493ddbd2dbc9b1e401f8ff409848f562bea9bb573db22661f49907390bee4e63ad8dfc0def9
SSDEEP 1536:97Vo1QtBO30VeeR/bv7ZBriZ4oe//iWt2q/0esB4jXrvwCiAJBVTQSb:NOAs33G/bzLOe52q/qBuwCVBVTF
TLSH
T16363026639B4AE2FD106FF651F9B4819F22FFC4887B310594EC5A98AA807430370A97C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000050
Size 276KB
SHA256 80793fd062e283e91a5081859fbeffcf92714111236d6712ebb162e20c0699d7
MD5 7cf91be8566a2576a6e9688193b5ab9b
SHA1 8abcbe03d6f0d2619a340641f032c3a01f3f52bc
SHA512 0759b83c86ee1d5fdbad9e954c7672194efaaef343723f518533d834712418886b4b0677477204f37cdf0e0b5400c8f48c437e67d1039efc9797fa474bd424d8
SSDEEP 6144:0V9lPvtEIJuopV9WzgP80d77NjIZ3IZt0wS+1TF8IZKF+QP:0V9lPeIJuAG0d77NjIZ3IZt0Zce3F+m
TLSH
T1B3546DBFF7C4306D02071347B945B739B62D0639B2A1D5C6A888E53E11D1FE5C42ABBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000059
Size 54KB
SHA256 bcc4c4b9cec8a6fd0dba0cabc62f239aae23993f7ac497a31991e02793a03dd9
MD5 1ab2861cc397abc300bcff8a79865053
SHA1 762e478a9fe6a3784b1e62b705ac2d8b7727394a
SHA512 7f4341a76ff0c2f1419ef3132da958caa0ee54ca6cbbe7ae0d75238d46db19bc59eae2d20ab6d128dcaca6db50d57ae4a0cd63a17a28fb75ecbc6e7a00a0ec3f
SSDEEP 768:pP6cmk1YhEfkjRGf9R/qIF1p/YXUUeCm97zKELuO403mWDpSKZp0iwmGWUsC:V6cEhAkjg9RbRYMpxLd402ipdGpZ
TLSH
T1E24302EFA4C3B10CD2FEE67F464D3B55026915C396ED4325C210EF6FD462A9D4A03269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005a
Size 59KB
SHA256 3191cd38b544e7228085159e794102d34346a76c7aa403315a0217fbb261e75b
MD5 57da5cc9fa6562dd5824f90d2130d62d
SHA1 559286ccd9290148f7c86d36359c8f2492016737
SHA512 ca57a37e7225657dc163a255c67b14091fbab40c4e31ba4a4f3cbb13996cd8dd9a7bce8af379005135a5fd2ff69bbd167400e08346680129dd0921501190c906
SSDEEP 1536:1jeKuE2EfAwNe3JudB7DeeNA494RE3AthS:1jeK1xfGuv7DeeNAQ4R5a
TLSH
T1A553024FCA52C91977C2A84CC024A7AE63A2217F1E75A5C0CC5950CF4C67A785C1AFFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005d
Size 61KB
SHA256 9dee0e2fe9b1baab99936862539902a01527f7f9d3524a1b6349f043e7936e41
MD5 7dbb8a61700a7b58a0e12a201097c8e8
SHA1 389b17f7e0c9d3f921b1881792bfd2e9d6495eb5
SHA512 ecea08e49aae31a04093e104fbe8f844fcba30a1ffdddc738db5779c1c3f00a8e6d3fd1c0327513116f1d587d82672bd00c8caef185ffadeaef495f550cdc19e
SSDEEP 1536:U3lABq7UcgRs/l5dnQSqXQ3FuyUJ0t65HINLUc:U3ys7tMuhWQ3FHUJ0t65HG
TLSH
T1925302963A7C7C426FFAC2917DD33648C20AB72678A35E6548434283885B4E479F6DCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000061
Size 21KB
SHA256 30316d8fc9a22d01192568ce03bd3b5fd1baba3d2c2bc6fadd976455358c4060
MD5 269470cf29b116480ca9762b9d7e4bc3
SHA1 f52de047329f337e9ab36ad71781c73c434fe7a8
SHA512 d77cba28f03f4a107683680e43b6c7f56edda2e3264fe613c5a19142a69144913fb6422dc9654509a03f31b3e960cba8fb52741cad72d2f172f4902952082b83
SSDEEP 384:+XZkP56RXz71L1bgo7Qh36hHEK5iy4WMFEjQrOy/oLZQ6OTaPH4dtMlLm9gZ0fg8:+pu5w71RUo+35y4WM6jgOpZeUHuMy9gq
TLSH
T1E3A2E0A0F5502EC9D04A931062C45C62836F3EC44DD2BFE46EDB2D2E1423E1B9926F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000067
Size 101KB
SHA256 0acd3d451533b3620f2091b5e2b7a3240137f53245ba451058717e41f6c373cb
MD5 4c72855e16094a0b0df0a2a34eb95627
SHA1 2b1edd10431cb29aeee7980e40fe4e94cc065f95
SHA512 ae067aaaf35de302be047e13f0b0cbce302f5f83660428fa63379f5efe45f66a7a166e9b4c8c6ec286045046e94e705bed0215e05c97b84c6bba508943cb36f4
SSDEEP 3072:Ack9C4ZtSQLsthSUSmPOHWVVpVxOT2GuUHmeN:L2C4bsvSuGHWVhoaRcN
TLSH
T1A1A312C287E793B391C8C926BBFC20525E71388E711144E9A7555723FFBFC1A9A128C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000f0
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00010b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00010b
Size 27KB
SHA256 a187ca303ce41911d935dc16d42bc380f917aef42b292e5757b4809e8948f0c8
MD5 edc5d1288c8768be51222313c4f0c745
SHA1 e3a25d9fac89260c5d841aeee7f8f258d18e8610
SHA512 46020bb903aa88541f295dfc9a14bf877b044bf9b60fbe1129d871279d957f795e57e0a64a6934a3ea80337b047f8f82baeeff044c33c8be7b369547c3b7cbbe
SSDEEP 768:wAo/3tSm//sBbKiJ7WFKlCpwKeY64GH2PyODP:wAj68HJ7e4CS9Y69ODP
TLSH
T15AC2F1D6F03B2B24718CAD45EE50F8228C108AB2A97405397BDF63C1525139F4463EBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00011d
Size 325KB
SHA256 237602167f0b21d2d24941e7f7ee5fdbc13c98fb1a1c47e15beee6cff1e9cbee
MD5 40cba21f0c1ca09f24e00200b95b5ded
SHA1 5724821df62fc8ca73457240e79ad3d82e506174
SHA512 49ade960acf4180d5e264c567de17318d931771b4ff0652c92001d79fccee521910d83bb8b5176b3f30b3dcf17c8ea22572f8775ad26753259340399384369b8
SSDEEP 6144:FPOoRtYtp9jJx4pnJZYuekE3Ik/s8Rk1Ttr6:FPOoRGlxonJZZTE3I8s8Rk1Ttr6
TLSH
T1036459726300A63F69274EA4A6BE6F0E3C29F357DD2704A8D6F4E63A4FD5DB9241104C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00011e
Size 45KB
SHA256 804526dd4e29be4c03cd57f12628d32f8263b21d1c509a219236e4c9bbf7a30f
MD5 799d6abcf369da2960f2fb1518af8a29
SHA1 f2260399d4831c0fc1115d7834885fa342117d3b
SHA512 b383952667a4e128ba8083bbecd89cabf92195ba378d0adccb64cdfd385fb88a46d3b43fe6aaac85c1d82416f490b2a8e65316d5dbee8ec4f6ff955323225ed0
SSDEEP 768:TMV5y7y6cAnLGedpyWgNJO7o1sovUx2tBoyP9xb48XWwuHwIJozE2ni0tOh:TMV5yWkGed0oXCtB/VKpHwqui0tOh
TLSH
T1E72302A289780060331A86FEFB8435A57CF4247EB5888581B316BF9F5715A7F0ED308B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00011f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00011f
Size 128KB
SHA256 d58439ef4d034e7003c9e84f6ce2733a6feb19f6fb02d49025edda2365cfa3a1
MD5 46d32186bb36bbe9f4e9733b21e553f6
SHA1 482a6ece0f239ee8c676661b9e159cfc6be71212
SHA512 e14d31e2427301cb7ee88a635a2bb37275b3df3ed5e231215f8acd2e29ea618490917c09e1c590444e927aca8cfad56d8e9e13ab7d3a5abe6f346c6f5f0d640e
SSDEEP 3072:Es3ZjBStluLnzkJU2VkyVu2igR4J1Z/Uvhv+WrCGy15ZEjcHF/2:EsJUtcnIJ1kyobJehv+WOV5ijGF+
TLSH
T147D312C40E54B9FC2A521604E9182F20801C3CACFE99D4DEF2AB658547EDDED3464B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000120

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000120
Size 30KB
SHA256 99254a21caba4f5a80f04e068b5fb337ba24bc4ef2f8eacd87369aa3bda60301
MD5 e6e1ff8c67510a0de8ab4b18066fd5af
SHA1 348bbb592428582795e1733dbd9a03bdba0ad587
SHA512 62d8f6edac092a8080bbd2e1963f042579bbf9b711b591e1928c630010944a2342f0dd280d7e91142d12a11b33071773da7e03817c568d9c16a77d6ae1b00cf2
SSDEEP 768:uJSEZ2nGbV75iJdfsyUVuBCnCPR2bO9gZkOMfCSx:KSEZ2GZ758tqVUJP5a/U3
TLSH
T1CDE2F1ED3042894C673B49635DA5233F35AE8A9DA4B11BC027F860F75C5A805982DBBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000125

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000125
Size 363KB
SHA256 0133e42aea5dbdfbd51ad5667e98700fbbe0223e70ee5d1e575a3e365d3622a5
MD5 8f0279ecf5b628f6583b4b2ccad7c6fc
SHA1 32253bf01c9c5f2462245a749452557b2485974d
SHA512 0396f43603223eb4a791834ac8679488230dc939bdba753f48631fc484629e60809297d3ce65635c89c356eee88ed09a7a23689c5fcef5b864d8b7389b5cebfe
SSDEEP 6144:5eix5o1HwBAOCGIzI4pyMoSvmezy9EVDUaL8doLlrwmntBwuFbrPsxu59lK3SCUT:AiUqBAOmyOuegQ8FmtBbFbrP75HlCHzk
TLSH
T1BB84231AA4F833569D67049BEA87F1D57EF41623E6F8421004DC2B33FA27A5D7E20B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000126

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000126
Size 156KB
SHA256 877d127c784f4521facfd10a1202286dc0c81b716041be2329d8095295410482
MD5 2f06ec1e85c35707dade6d838712ee1e
SHA1 b91414d0a523b1937878924a67d1d1b026160d39
SHA512 db60af900fba6de7e8a6d57e87a7faf67c3ecc0b71cc07520f989f68afeb73a399060e368be2b517490f3f638af47d3cec6884615b8372273c997e4998746ef2
SSDEEP 3072:yorBtaT85tet8b5lgtLLO0xr85sd66z39wNYIJf0F7n7Tro:Htu2te8/gtLFx8a66zOuId0vs
TLSH
T1BAF312A3873381D6E721AD6735C4621BB10EBC05E546F71F74B80BE3B145778A8A8B8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000127

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000127
Size 56KB
SHA256 adcba5d2bfd84b1ddfef94a0fe56ee2967f4b3f6a37d8af1714af17374299951
MD5 f86dce0adec68076b459d0b2e3f334b8
SHA1 b6558bd8b28f3aebb28c18873440f05513250198
SHA512 9b0292bba66bdade61d06fae3939bb6d3e7cbeed3590f518dd5e0fc509dbe6ad78b9fc0c122e8f0ed5f696ed25f887fdc96a80c7f11790c65ab7d09aefe3c2dd
SSDEEP 1536:EgudoV2xzEQnJZ9R315tljxXiAORwboje3:EgudoMIch1FjxSAOo
TLSH
T11D430202C2B07BFAAB8D43AE334C1455E43E2BBD93997426D654FE17F9E059B4903874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000128

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000128
Size 189KB
SHA256 b9d80bd2a81c30ad2249ec2527262386151e7cf9f1e0bda72e63d888035e50ec
MD5 8a86ae5054bdafc6a6634e3550c4dc1d
SHA1 fa70c92c345999372bbd0c1e13e2f2fa673f28ee
SHA512 f8d0414168455d1e9f9b7694ec598a3163878ba8a18c2dacd1d1e40c14aee4e4368d4fa4429170a0720390dd8869e7864115cb0563c1804f3c80688fe44cabae
SSDEEP 3072:LIRXnQGeFlnPEWKOqmX4uY/M7hRm847otjLO3wf+93Ejq+pzpwrsLYrZT+oIpdDE:LOXQGeF5PEW0mouYE7X7col1OEO8zgOk
TLSH
T1CA14230C22A5DFA8D3F82697649D61C3C3AC85ADFA7EC0E56006536F1E20DCBD91645B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000129

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000129
Size 351KB
SHA256 3fe90e0e5787638faec9dbbe15ffed7f89575f952316d1aa1b4b1efd7f311f9e
MD5 177db3ca83855050190c58b9c71d3cd9
SHA1 21fb057e463f4237191d645a21a2a3400672d15b
SHA512 f2629f151db750cc78bad4416de2df6c6940a95b5dd1039b515d17cac48e5ca9ffb4bbc86a4e7d83ed3f62b520a294ce409028a5673fe28e69f4b8d48b4860f2
SSDEEP 6144:oaGsIQecJMjhhC8i6HmsMpFPUn8eIPUrXvT1IBgsiYkkQMI3hkKxdlxQQRFJD:TGsIQJJUhhCbgSs8eqCXfdYRpMh5xdlh
TLSH
T1E47422A98FF18BF50A635D4C6CBFC1250CB6C7E9818837582934B5004F99986FEDEA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00012a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00012a
Size 166KB
SHA256 45e19a7786a6558dbba0ac2792486dd9dfa474c41ff30d35b419bfc475a0931e
MD5 748b517f47d847b8cbd91b9730dab20b
SHA1 6d0e1be14beb6a76832a1d57063e4279d57c9fb0
SHA512 d7008b232b273ed97da74fb76ee451fadda72a80547de741d5d700a5f8d9cc277841eec08ec519e13089d06347813416ebd6092e5fe0e033d8bb93d08f87cd4e
SSDEEP 3072:OWg2bmFhVAin+by2P8hAEaD0emvC5592Ssdme/JdMN4E8jY69X0hqvH7YKKB:I/hVA5by2P8hAE9jdQKqNI0hq/TKB
TLSH
T127F31231657DE14598B7DB36124B86DA0B30109DFBEEE90369721B1CA5B1F8E230DCE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00012b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00012b
Size 47KB
SHA256 3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
MD5 015c126a3520c9a8f6a27979d0266e96
SHA1 2acf956561d44434a6d84204670cf849d3215d5f
SHA512 02a20f2788bb1c3b2c7d3142c664cdec306b6ba5366e57e33c008edb3eb78638b98dc03cdf932a9dc440ded7827956f99117e7a3a4d55acadd29b006032d9c5c
SSDEEP 768:uj6JxavgLx5rjTH3CdZ3y11o4uMb2IVEhiB6z6GAAHJApICtBgso6HaOjTXHRWK:ujoa4LxZPCdm3B2IVEhiB62apApISxos
TLSH
T1EB2302D92E54990D29202A63F45D6E2641301B6ACEDF4BBCECA4FF38006C76F9FE1548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e8207ca1590fe75_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0e8207ca1590fe75_0
Size 4KB
SHA256 4a2bb03eaaeae03296bb52c54770d7826e28b1a483831b3d91895d291e68d0f7
MD5 48fcd33b3e2b86a58884111e3a3665d7
SHA1 745ebaca6e4a7bbe75e7c6e76582dbb5bede0bd0
SHA512 6b0d268256fb31df38c7069426029d3769477e975f01787599a7fc0245720e246d55505ae221a12830c1b4ecc41e7f87fb004f7763a00304a0a0bb18491fac58
SSDEEP 96:FAsOa/2dArYYTlNuAsOa/V77wmL4SFrTUE:Ff/ufN7HcSF3UE
TLSH
T12B9172739796BDE6CF3A5DF801213B922E7450CF1B8A834BE4C047762C666E4DEB4852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c861f663d88767f_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1c861f663d88767f_0
Size 24KB
SHA256 b52cd8b3f4b62d06c112ca5e803229bc66169911c0a74224e59fb2d2479bab27
MD5 593eb1737c3b0a8f1b30741e1f1293fe
SHA1 1ce6c60c42e6fec22832ede59ebdcd85d923d7b3
SHA512 d81814414f744b99f3f3f98614b5cbbfa8ddb0d2ad39e602d68cde7dfdace7b98bd6c5c0926a4dcfeecaf9285a761386b8b827d3239b46f4cb24b4322dc3823a
SSDEEP 768:DneZyIFvTmcJ5w+Klu1ja69A9VEaT0Z0CCSQX:ayaio5NKuxE1LxSO
TLSH
T180B2E9A9F692B066C173B171423F000DE3BB2D21E94D68ADE145C2E42E74ADD506BF6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24ac27e35493bdc7_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\24ac27e35493bdc7_0
Size 305B
SHA256 166bf9b506d9a03f493a8179a8c2c116343ebee8b3b1363477d9a657590b274d
MD5 9dadc7bf504ec7fc9944524840c33779
SHA1 e80361e60b2ff0264ba02d08086544e2ebfbd1ab
SHA512 b744975688ab29b2f501ee010deab67f2ddcb3e71e1353c1f5440a18ee38c5594a0bcc272bb9ca2d8a105b8db159dd0d1b141dd2aab974666dfed0e8f38676db
TLSH
T134E0E7E711141408D4FBCBFDDD60B0CAD5169070C7DD53031401E12296414D5D454133
MD5 SHA1 SHA512 TLSH

Submit Download

2552ec71efee471e_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2552ec71efee471e_0
Size 280B
SHA256 47637a273d4d4e7617afcc7b424aaa4406335f89d61ef716c352b0a833ab6855
MD5 a0bde0066ff1121c589a83a524192cc1
SHA1 0669bf0e2a652753dd85651464e882dfa9c05872
SHA512 70326e3d77a608b5db8cf244d54cfd7c120730f01677dfb578c6b3a613155682ab2bed7fcb2853d71212c334f669aa01f397a599d8f1ab200de45849e747b036
TLSH
T159D02BF36D2B4405D4E546F1C1836209C7738C0409CAC680078653FA11D9AB66D21550
MD5 SHA1 SHA512 TLSH

Submit Download

37ac4decb2b5f8e2_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\37ac4decb2b5f8e2_0
Size 3KB
SHA256 b351d576027a02f586b024c1d8d7eca4413967be23186d307f3afc9a2598686e
MD5 266e0c872eced4a94a13204727f6ce79
SHA1 bb4744c182cc6fc4d8c191086054516acd4ab5fe
SHA512 1e507d3aef976e9508643a41f81afd1f48583449ae12247879bf12bfe8e5db202cd71be03cf30f93a5c6eb8286b088c614f0a66dd3875c113d0f4c63b8863479
TLSH
T14371537393677CE6CB7A1DFC929626852E70458F1B8F834BF98002755CA72E8DD34892
MD5 SHA1 SHA512 TLSH

Submit Download

52137b57f30f4b58_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\52137b57f30f4b58_0
Size 4.6MB
SHA256 cdbaf88334ee05333e1474807d888b2672725779b592a875b2d1ebee8087772e
MD5 ee5d01335be54c6cc6c18efec6700eea
SHA1 1c73abbed03b00364c9bb6d820029e30622389b9
SHA512 23d967256b9f02716f5295e511b5d72fafcb148de4994865d7ab5339d497999053e71b4f66f1bb6b4ff1e97de409c110b8c4103d0f840eaf8e072913d6675ec3
SSDEEP 24576:5g4u6Vy31tz6YV8/Hkyvxh7WMzppxwByJWLQsLKZ/L7lKeS8blGRp9mYHWvFP9zN:G5MxbVo9T6FNmmQfB8OkV7Tqg+M
TLSH
T13D260811E711667BCDE243FE07638967327C45083FF7920E96D29B741D243FAAA86C86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59b50680784f4faa_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\59b50680784f4faa_0
Size 12KB
SHA256 8808fef000e381d5fe9229e46e2b6af07a35d03686a6bbac0f4ef1e3bdbce5a0
MD5 f41beb9610966a7a6c282062c00ec095
SHA1 d942c05eed35e689210024b8156e0b0f352a8b30
SHA512 0a33167922fcb8e1c10b90d2791851b9b52eacdd6ea6f012f25e4b1aa4602ca6cd3d5f92cde590e4a46e79535945fbc94013600b9ade86abde131092094bdc8d
SSDEEP 192:WYAeY/payzEX3VLDTnxcBcfeJ4kZFFwowQMwMKVipGdWy:jAr/pEHVLDTxcAeJVfWowQMzWdn
TLSH
T10942657161557BE8CB2727F809529E963F3580DF1ACBC75FB0E4A3182C9A1D48E24E86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

828391746479f985_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\828391746479f985_0
Size 340KB
SHA256 0d5ff6c8a5e60e33d416b5499f8ea2d046088d81422d8f4433ff50f526824aeb
MD5 82e0698e34136b1f32b00593ba8b771d
SHA1 facda4d33635a0e43840fa781d3cd5c152b2c84d
SHA512 4012e662928c5c7fa2dcf3a7a4f265c7ba538a49862a17d5011347f5983272a3c59b36e9b5a83680300e87f6a27371f8264e931036d4300e17efcaf1bdb87734
SSDEEP 6144:PGSWPoSzYiTU89OFjV6CY2AmqxNrlSeTiWBWJ5geMxao6tqpoTUqi2aJaLq9PNEL:upEyUrY2ANDRwrMxao6tqpoTUqi2aJac
TLSH
T17C74A645A3896FBACB2653FD4663CFA63635409C2FD7E30721E1D73A2C192E04E51D8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97dcbd15fc77f723_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\97dcbd15fc77f723_0
Size 352B
SHA256 1e619e39fbc890f6e15a6d4fd555e0cd1ba95349a63d3e61dddd6e3e51078f61
MD5 c93cfc283d46514f8f92bc088baa2027
SHA1 d260a6056b68ba17bc7d470a0f2e7bb28f11865a
SHA512 e553fcb457966a0a0312c5403290cdd3864a31428819bf105a8fa08620f841b254251ab6185b15dc78256dac9639f1b5a3bdd83a8acc974d9fdcd48642118141
TLSH
T146E028F3400C4444C595F6F4C7976041E11293171C1C10E1D04073BF45CD5172F04893
MD5 SHA1 SHA512 TLSH

Submit Download

b242ff733d6f0ddb_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b242ff733d6f0ddb_0
Size 4KB
SHA256 8ce9433b39431ffe1adaa8dde22dae0390097e75d8c0c8117dcbaf8cd29efe78
MD5 2088d2b7297cc0279de26639d9783b8d
SHA1 a423169b5800c2109d292885362ba932abddbb37
SHA512 7be810eb3304f5f0ad17ca96f01cb033b9ba8a0d88a836037a54105a1ae0afcf837a971b778548946d5ef3e750be2b85ec0f8fa254ef40649285a8451bf77258
SSDEEP 96:s+8if3uNKV0PpKNL4udUatLducdxO6cyWJi422EGhE:3xP+pIUsucDoyWJi422
TLSH
T1F0914C7342A67C2AFE6549B07E2754CA5DDA05AF42DC927D2C4CD2B4D1A181DD708632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c28731bd61015672_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\c28731bd61015672_0
Size 1KB
SHA256 fa672941ac66a72eb7104cb8f93c27429bf95cb7e49dccd56c5655f35b52254b
MD5 ef96f3cd0ef822de905e0b081280b43b
SHA1 befebb3b4e689f7b0381655a3e16ea70ffb4910d
SHA512 bb1ee84161bc5e3fa060a277ccc74f597daf247c721ee74bba1a4a0ef2d69f29c560ec379cba5bc6b1fd65a460c6ee631fccefd5591cde4bd56735dfbd0a72b5
TLSH
T18721A633416BBDC9EBBB1CF0825836960EBA118F4B4C8249EC88023265A3168EF34C61
MD5 SHA1 SHA512 TLSH

Submit Download

e23c90de6493896d_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\e23c90de6493896d_0
Size 63KB
SHA256 a4db49fc9d2963229f46392d2fea327d46f2d6891d5fd5de8fb987dcc3ee9850
MD5 3ad8617bc0d81449a62165f961fa5b53
SHA1 40b6664eb954faebb2547ccf8508e197cd5c998b
SHA512 95bcbf6b361d8c2584f74ede285ffcb7e0c19d1044b1ed43360b24969f616fbb91aa7107892b35dfa9c6fae9a6c81f60f8d40dcf991f5077c4cb45c85269d952
SSDEEP 768:GkHujFbffu9YNdNol0YzEHi/U5nrjDiAvWC94g8wnPqdAQaeA/DVcu6g7Jnxysb:Gk4AcdelnzEHoU5m0/ag8wnPqo/WDI
TLSH
T1D1533CCEB6C37B3188E371F9016B900A627E58265C84686E7D12E7F16E75C87903BF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e980c6bcd5d294e7_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\e980c6bcd5d294e7_0
Size 256B
SHA256 9e174b88378ca721441f0f002097e9edd7e8e4fff0d42872b44fc78351f15232
MD5 2aff63821bdc715a001ab3a495bb572c
SHA1 46dbcd5208cf5b2cf6477fc3187121dfa2bdd5c7
SHA512 295ee6ec19eb36a1763d2c4ce7dd25d7893bf670483c0cd450b186df8b499ba8bec85ed986bda03ad2dcb33dce0f16f2bd339f5e9634d71f0afd2536a7b1c262
TLSH
T163D0A7A388A83402D64F96F58779631BCF3756D8095D5586530D10F6746087096FC6AD
MD5 SHA1 SHA512 TLSH

Submit Download

f53a8ff5646c6e59_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f53a8ff5646c6e59_0
Size 31KB
SHA256 845ff56d550f3979c40df6cc9eb915500fdd834799bbd52ebd79d999870614f0
MD5 1a2a735d2e0ef6aaac377a0b8415e878
SHA1 73607bb69dc99118a7a4f4d85853a892cfc4964e
SHA512 55bb458332d7b24d40c08d916b27997f1b86850bde88e2b4791344e0688f8a7e814686c0d1789bb062be14a8da405559a91b9caf4c3a16e95268ecb95a0523b9
SSDEEP 768:d7l8olqQ614fgVEybLruEtJ6XQhnIzpn5wJK20jZPeUBl:D66fYUY+5X4UBl
TLSH
T1B9E2A5466790EA96CB3B53F401538DAA373145883FD3931721ADBB3A4C263E56E09C5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fab71d415fd4d531_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\fab71d415fd4d531_0
Size 9KB
SHA256 1e9319a90860151994a27dc30553b89702bc2c2af5fdc92409389eaef91ae511
MD5 bc572867b596fd4d683d468869af0ba3
SHA1 3d2dbcb0d264d0c00fa4c59d4e325b47e9162506
SHA512 d0e104b9c9c43d7c636d4449e76bb2e21cdefe7f746ed029127979dcc8b015e29bae01096728affba30229342768b2c3e8e12e8f681ebbd0a9d8af2fdb09d833
SSDEEP 192:ve86X3i10hRhyczj7fIOmI0ia3Qkoi1qb:2Xy1ghyczjzhs93H1q
TLSH
T1D322E77267917EFACB7B0BF446629A563E31908F2FD7C24774E053254C0C1D2A968C96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 a0e5b350484c47ec70090a9367bd50e15e1367c8fee816afd758d43978588999
MD5 2d56ce0886fb8b6225b4a3940170afa6
SHA1 d5ad88baf5968b24f0b6f2470b1ec3fe785abd34
SHA512 75a0677a20cd2d6ca8e4bec70c5108f0dde69fb4536beabff1726ea91d527c9d5665145282fa96b8554da7f83e7ccbeb23297128c8b6ec96cac3622a620e9fac
SSDEEP 96:iIWzTkBaxUi6AwWBGIgXKIjXvmq3MHKAibyqmkqJp:pBBesvXX8vqNvUp
TLSH
T19F913E5D3ADE7204CB6B2B7678D63B84B53B401C8FF32F8A5710EB302669F29250A341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 12KB
SHA256 b1b538406c79de4f39621b327c06b1d0da8fdc324007f0ba71411630d170c8c2
MD5 c8487c540476dc27cc178c6ea3bff48e
SHA1 1517e718b30c91635d255a4d7681e0244d5bc51f
SHA512 535907f56ac74dbf87fb5492b7821b5cb6d64eef43eb8a08a7d4c30b9cbc6a5ad6acea1e87ac91fa1ed9de26edd041e1f4da46d4446d4c56f517aecab69c03bf
SSDEEP 192:Z5saIeM+2xOxsL21IgVKxMthWxUe3tI9aqlZFvqTtccW:Z5sReMhssL21Oi/WxBt2wBVW
TLSH
T19352D65829FF3301CF5E26B518D4B9CCB07D60296AB32FCEB253963919D5F901D8B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 15KB
SHA256 2674477f4b6776400e029856cbb88afe922c28db5fcfe938b5d9beaf78881276
MD5 9894c58593cdb7241b53b5b4b8ecd7be
SHA1 1c6e271e0e363ed87cbf65ee20335b2ce8e0ad81
SHA512 37c91dda0c637c8b9fa55c4b443720bcd202d723324386ef00049a68b4ab8e7d7b411b012206cccd3578e107e61d1d55ebdf9a939f473673b527576ca68d9741
SSDEEP 192:RAsMeETGqzSwXOxm5h1IPRj6wJe3W0Qwe3tIShq7NZDpCTtmLW:RAsMeGFsm5h1OhYW0QltlpBEW
TLSH
T1C2621948A9FF7300CF5E26F558D5BACCB07D66296AB31F8E6243963819D6F901D87202
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 13KB
SHA256 5bc305e4ef7c5c4d4a341cf5cbe0f7d27ff77e8ea13ca1178cc9436d185cb4ff
MD5 80c0cf9e0ef2b59a0bda6c2fc22e8a4c
SHA1 5ef47a02857d42b7613b07650ff00d5b41a3a302
SHA512 7fff68500ef749940b1645d8403588168be426b118fff41839b834463425c9680b89d51e2e66b297f6d9386585cb46e504dedd7a2e98219a937155e573d700b6
SSDEEP 192:espZeEwWoSwgOxsL21IgVKxM5xWMQXe3tI9vqRZcOqTtbuK:esXelgssL21Oi7WMQkt2jB6K
TLSH
T1A352E64829FF3301CF4E26B558D5B9CCB07E60286AB31F8EB24796381ADAF941D4B351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 ca7d5a51fba197fe93ed7713f1533b96ab3c67f41d7338ecfc7cbd60578af578
MD5 4cdd02642cbaf1c4059e0b82abec1b35
SHA1 35ba07dfb96b7631cbe2d0c254c92e5f190f9f11
SHA512 87350065e662b40e9c294cb1c530162b2aa393a8010be5a290b3b0f3f6950a60c3452ccdff1d4d88686f7f38b481b6f95b448133bb8bea49b6b4bad6b1da82cd
TLSH
T17D510B9873DC7109CB9F05BB9DD239C42136551D8FE31F8B236076613B75FA90A47252
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 13KB
SHA256 a575007dabcdedad3fdd51556ee0b194eeeacc2f485d8cc7031d5d63c156a49f
MD5 53d2e1037c40ef2bd8692698656631be
SHA1 74bedee0f38427bdc3cbebe5d14858b79e9f3305
SHA512 8ea5e95ddec5efc6ca376207a917e49efed00a01c61fd13ad811edfef3169ea1aaec6da032c52ffebfe7b00b5d65fb468882b58caf93a7d1967b8d559b6fed06
SSDEEP 192:msxIecWorwxOxsL21IgVKxMthWRQXe3tI9vqRZsvqTtaco:msyecYssL21Oi/WRQkt2+BDo
TLSH
T17052E68829FF3301CF4E26B518D5B9CCB07E60286AB31FCEB257963919D5F941D4B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

popup.html

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp\scoped_dir4224_1953607373\CRX_INSTALL\popup\popup.html
Size 1KB
SHA256 3b0ac74c97b7bff2c71055f23d44ea2af38d1246bb4043d17bc493dfb18545ad
MD5 3c46cfa785bb3274e1a6ef04cd65bdcd
SHA1 45535ffea732d28bdba5f160c179173d289d5446
SHA512 a3c3aa9b840c480621849e5cb2b947096f5c8b13f84ff5be75017a48df9dca785d56e8ca614aa32361c80c41fe77aa5a2771b6c084dd30f484a11b9256a3b458
TLSH
T1D62142AA40F54CA201414BB565D1BC275C87440BDB8D5C60BCAD48E5BFD2E838193A8E
MD5 SHA1 SHA512 TLSH

Submit Download

0348c8b0-cd44-4283-a704-f8b881de9bcb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0348c8b0-cd44-4283-a704-f8b881de9bcb.tmp
Size 32KB
SHA256 a349e98b7b9e114a5890e7243993e37dcecd69083cdd2b4331d9115816e97100
MD5 734547d40ca819823d08db5aa1b742cd
SHA1 36d7bbeb1620be4a3ce7fac91e847d10e527ac5f
SHA512 3223bd66fda85439fb858215566e79d7581f5fb9c0dbc20138de573e3610d53c8b2bcae6e6a8f63a17dc83d368e07b850c3cca7b12ab33aa81a3a805b344f05f
SSDEEP 768:mVpSR+JYHA2OuDN6xE4AaNDSCzKBB//UB1:YSR+JYHAzuB6xE4AZMB1
TLSH
T15DE2ACF7C7E8862DC81156F49B156F2FCE291928432C3C6AC9D9AE0B93E2571E24174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ee51247-425c-4247-87b8-fe32bb5fe065.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1ee51247-425c-4247-87b8-fe32bb5fe065.tmp
Size 24KB
SHA256 426af4f99d5af8f9ff71da835907034cf75b5fb3990eae0ade61499ba0c4ffd6
MD5 afc55ac01d800b70efece671b05a88f6
SHA1 a2979216a2f42964e92687846f0b0d6d5bd05d14
SHA512 abf9e3e6de56b1786c2f3fe56d2a775bc74f381293661552ec11eef20b03075f1297ea3c9fcaeef894fbf2cb16347e9b111b970ddcab5b0502635f8e745f5453
SSDEEP 384:DGSk9hqJ4bJhOAOJcleAexTJGAz0kLZviLy/lTOqiyGS1CU5bFo0KfBe5Nj4K7AD:dVpFN6xEVXRkssNDX
TLSH
T1E9B2ACF7C3E8862DC91156F4AB156F1FCE291A28432C3C6AC8D4AE4B93E2571E24574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1fa82146-1da6-4cb7-8541-4f7cd6c99167.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1fa82146-1da6-4cb7-8541-4f7cd6c99167.tmp
Size 13KB
SHA256 8eca5dfa30972c07e7c5b2e9c85608deccd51a7424a5805a3e74fbdd11a75ec0
MD5 bb00a53669f6bf75da437cfde3d7fb8c
SHA1 d6e42ed75f82e36328dced894bddfeb0ab9ebae4
SHA512 fe5f94351eda0dac907d971628c12069afd5c29178e8a8431ceed5f3c809f9b501939a88318beb7caa150f5b06881147f523b184b1ade2363faf691bea4bffe4
SSDEEP 384:DRGZTDCMIqqJeJ8n6nM5lejaIU1//8HPtaq5bFo0KfB05NVlHgFIAWLffdxNuBDk:pwQXED518k
TLSH
T12F52EDF7C7E9852D890156F49B15AF1FCE2A0628432C3C26C9D8AE0BE3F2571E25564F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38d4798c-5f59-495d-98d5-e4a98ae46a91.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\38d4798c-5f59-495d-98d5-e4a98ae46a91.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

4f01203c-c934-446c-8f46-b588bbec3263.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4f01203c-c934-446c-8f46-b588bbec3263.tmp
Size 19KB
SHA256 05f10b40b692c902ee73e422877a06d458587bbdf89afa7c3981922ac47f053d
MD5 cfcbe1adbae0a4198e0cd22d73df8543
SHA1 8a131e813bcffee9f5769588f10021577a11e45f
SHA512 c5696c34eefd0bafd4577226f2f493b3fda09a761f61c537b6b523026c36a10d8ddda61664e138e957bab92ac71a4011d12406a2b01fc2855e309ae86af16307
SSDEEP 384:DwGS+ZkE9jhqJ4bJhDAOJcceAetTJammQaIU1CU5bFo0KfBe5Nj4K7ApWPKt4DCJ:ZwsNPxEsXRd0Al1S
TLSH
T1E792AAF7C3E8862DC91156F4AB156F1FCE290A28432C3C2AC9D4AE4B93E2571E24574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b27d7ee-bf93-4b87-805b-7830639d2813.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5b27d7ee-bf93-4b87-805b-7830639d2813.tmp
Size 11KB
SHA256 042496abe89e4b9f0275d076c14398ada2866abac1128f75d346300f71d736f4
MD5 ca3abaedb3a3589a4f6916a5fb4148c1
SHA1 4acb37ddc1ea7a070d48fc1bbaae609767e5336e
SHA512 b9de7f757917451c1fe82cecf7297964811467343906497c27e1ed3706ede170494025a6bc94ee9835fa0215cf88dab9703bed2cb0726a0d401b438594bcedad
SSDEEP 192:Dk0uwt8HGSJJ5J+dAZk87e/F/aIU1/EdHUtaPi5bFo0KfBe5N0kSuNvqZTfPVTN+:Dk0uwt8HGSJJ5J+dAZk87e/F/aIU1/EE
TLSH
T19132A9FB83E4852E891196F49B15AF1FCE291628032C3C7689D4BE17D3E2472E21675F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

813f038b-140d-4e6c-bf38-3cd08916a495.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\813f038b-140d-4e6c-bf38-3cd08916a495.tmp
Size 12KB
SHA256 38eb2a9d0a96e36908b63b8bb14911d3cd92b024550c6c5c1e1a2dc9cfc58428
MD5 46ae0b393f4e21ae4491a9641a7dbe05
SHA1 57cad6d603e7724d854ae4ec617f0e1b74af4afc
SHA512 9396eaea75e97374ae7a0c35135292046685d86ce7ed3c127ec415b07bb47d9af30c992a26b7702512c8ad671e5a1b04213a51f793cdbafa656843f697b167eb
SSDEEP 384:Dk0uwt8HGSJJ5J+dAZk87eEF/aIU1CUtaq5bFo0KfBe5N0kSuNSZTfdTNqBDrR1I:aDOuEEDYg
TLSH
T1C042C9FB83E4852D891096F49B15AF1FCE291628032C3C7689D4AE1BD3F2472E25675F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

871f5061-c3ed-47ca-8f23-8a1b511e0c94.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\871f5061-c3ed-47ca-8f23-8a1b511e0c94.tmp
Size 29KB
SHA256 818aa552ccef588dfd54657656bca2a8295dd2213b60890399680274f8d9e0b3
MD5 3e4add334326ae82ed04982e7318ae6a
SHA1 cef1bbe71d62cce5bcd7b67befe8f1079bc40b59
SHA512 eea83fecb5c9d48e651d713fc93615644f6c0ddc67b80412b044c756dd107af75521e7217e03087c37121e595ae4ba4d8d1b998f7ccf3821350c1b52e36c7c22
SSDEEP 384:DGSk9hqJ4h1wDAKJclekex3JGAz0xUvdolUTpBtlVu03JOp55edkemc6wJJ1WBdT:1Zd+XN6xE4AENDvx2IBfT0BR
TLSH
T1D1D299F783E4862DC91192F49B156F2FCE291928432C3C7AC9D9AE1B93E2571E24174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8828513f-7a03-4d2b-9b74-1957473d16e6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8828513f-7a03-4d2b-9b74-1957473d16e6.tmp
Size 23KB
SHA256 ed18428b84335bd9c54fbd31899af3d38cc081adf0d8f97c4d609218018ceef0
MD5 9041aa961fe305ef64a13167f409ac27
SHA1 c07dbe539ff6edcb2614066eb6bd3d486c780d51
SHA512 849d642ca510a8bc03ef99b32921be97874769978662e8bf3cb7a3ac4ff061773473fb79b0f7a9b613643fc4450c3dda54777d9988f43f36ae82d46b7a05e5f0
SSDEEP 384:DGSk9jhqJ4bJhDAOJcceAetTJammkkLZviLy/lTsaIU1CU5bFo0KfBe5Nj4K7ApG:QwifN9xEcXRw0Al12
TLSH
T111B2AAF7C3E8862DC91156F49B156F1ECE291A28432C3C2AC8D9AE4B93F2571E24574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d716d56-4165-4586-be99-af00f06469eb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8d716d56-4165-4586-be99-af00f06469eb.tmp
Size 3KB
SHA256 23817de4bbb8a15b2f3aff6729942f84ca9b2e42e7337387dabbee78fb819648
MD5 a5cf11b1807ebcd6fe9c761b6c37e24f
SHA1 adf9ab914ac0f3836685b2b2f75f561279ac18f7
SHA512 a65ce3c032f9f7bba09b6d053db260516c55288b798e49745f93c5efbb6045e88d4d6bc85212478c65222745489bfa9131f375f26129ab1be6c9f1c89ffbd07e
TLSH
T1218179A3C27FB86B103D89EB1F48B80699BAA836458364F4DF97926C70C15F31B47427
MD5 SHA1 SHA512 TLSH

Submit Download

aba2ee37-f29f-4485-8e5d-02534e7101b5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\aba2ee37-f29f-4485-8e5d-02534e7101b5.tmp
Size 15KB
SHA256 8fe35bccc146ad21f0e9f31202d72c8056a1058232a727d959624e28e39f98fe
MD5 482c001a317cde7d995dca1a48246bc0
SHA1 affb13ef612e3a1576e35fc0b564f36bc551664e
SHA512 4dde5a683b468a838b1f58f70c90d4aa3912c5d1035772896033a58df5695eea5536f68d8decca1d052e4ea24ceb3caf4df93c243916d46fc2d79efafd024f85
SSDEEP 384:D0uwtGSJJ5J+dAZk87eEFbhqJEaIU1CU5bFo0KfBe5N0kEDrR1GCS7ApWPKrmDCQ:4DON4k9xaF7OJ
TLSH
T1DE62AAF7C3E8892D891196F49B15AF1FCE291A28432C3C66C9D4AE1BD3E2571E24174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1e0680d-48bb-49be-831c-7cd8413d90d0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c1e0680d-48bb-49be-831c-7cd8413d90d0.tmp
Size 1KB
SHA256 5b7085727da4bfbb476d479df631e4e6a8234784e310bdb089f537fa0d3827ac
MD5 015ff2d8e53af9eaba018c78b0e100f7
SHA1 c148ef898a5269607b2fe00d184fa309ce4bf679
SHA512 3dc27aa675a4fc68962cd7235546ccca083eccda59bf91d89e484fb1cd551b7c3f4799893630c79f1f96f3ed6bc5721eb32a3a4a8fec3c2dc93aed0f2dd9a29f
TLSH
T1B1414AB3C17EB46B103948EB1F44B80A99BEA8354A4264F4DF97D37CB0C15F31A5786A
MD5 SHA1 SHA512 TLSH

Submit Download

dca0320f-8a25-4b1c-a204-24a6725542f1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\dca0320f-8a25-4b1c-a204-24a6725542f1.tmp
Size 12KB
SHA256 831c50592d5a5b9d4ed72e5afa84db2018bea766751d794a699a5e8187e81608
MD5 33e95df4a27c3daff5cece4e244e54bb
SHA1 43de0b10747ca9e35de263c6f1dc047704f74344
SHA512 9bdac8e1beda65d993d2bafb7d0c4c4bc4897ea4e4debb01e68e38e8b5aa8d1b3e778d70a86da06959e56a23f7c90308584781c6dfad7a0e92e54a15817ff28b
SSDEEP 384:DRGZTDCMIqqJeJ8n6nM5l2aIU1//8hzPtaq5bFo0KfB05NVlHgFIAWLffdxNuBDI:pwcBED518I
TLSH
T18C42EBF7C7E8852E891156F49B15AF1FCE2A0A18431C3C26C9D8AE0BE3F2571E24564F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 7834fd3292b84598123501ea098ab87da5171de1507244e753da86323d1624cb
MD5 83677f5c267c3c8e2ce61b16fc63b81d
SHA1 63d5728e23e13df69cdee12fdcebb4a7f5d28eca
SHA512 b12e04a3e6fece010d8e508164597569128af69fd79e4b84651401637cc2b44bf6b3c424fd83c74f317237680c00a807d7085d19068f7af5562e18f82020f59b
TLSH
T1A3C02B57F0190410AB280B410336819C87187CCC088EC04DB513343425B7F232102FD9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 3f30d52e52455ef12195dfc3443b4cb9851eeb1403c1798048ecdd69a759886d
MD5 7f52afe1f8e643f77e49d9528e50879a
SHA1 ac5b5393ad590128c47cf64233e30367fd8bc8f6
SHA512 e9925acf83736a610d19b593e009f43c364fd8be48a13317779da2af9397aa25d85b12f1fde977fb5b01ba2949edf9ecd61f021b24242cd203feac1ae68cc0a6
TLSH
T14AD0A75BF1660450E7AE4F520761519E8B34ACC4155BD04AD643783D28BA6939222F9A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 226B
SHA256 ae224bd63f2c6316840ed7d97890a92d84ff45a347426fdc6820a0e8320c9870
MD5 eca37a0bef5ea1a8dcdd4338ce0cc99f
SHA1 4c7eb1510ea471e7c0f1968478b5701271cc1dde
SHA512 500c5505d9421fee1fd8219c139132a988178cb61046c43dc5b23a1635e9999d36bcc28b95149fd52d3e130c43b927b6ede428c96fb6c9cbed0a436b388f840e
TLSH
T12DD0970BF0660840E5AE4F42075110AD8B20B8C4005BC04AA60218381C8B6139223F8A
MD5 SHA1 SHA512 TLSH

Submit Download

a4550aee0295842c_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\a4550aee0295842c_0
Size 1023KB
SHA256 29c0c10e74971ce309f125ab031e1a358b8c4af17df4b099fdebcecb9d4624b5
MD5 f4f09ab903deeb2e4c40966b92d082e0
SHA1 752b715fc086bd598401d5e80cdd91cacc50e0ea
SHA512 07a36b56db7ad6e783bf7049273c41a77ccf6223b239e71698bba327b830c908e791e944b80af62e2a772a5f72f0f619f5288b988728ff697dacf4a63809c863
SSDEEP 12288:/ZprqihNhyG98VCrZKLDroxN4bC52hc0QePDIp5EKqhBfTf:rqMyG98AlKProsXc0QePDIp5EhhB
TLSH
T1EC253C9873A2B16392B6F195412F4286F3BEB892F449886CF598DDD12DB8C4540F7F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a48bfc1134883a40_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\a48bfc1134883a40_0
Size 255KB
SHA256 8346db77da4b3b1b7370e8521178f5c758665d26c20edc54e6fc5c2b8ec6782b
MD5 ee36abea1241516bb02e08fd6273ca4f
SHA1 a774572ee1094a05243485afca9f25666723f0bb
SHA512 b8c5404ebd87f2b228c3982e7f7a0386befad2d661843d018e1ab3cefe6b600c94dc2603a377f00c5cb15b60ab5f55268a3280f817a26e9f72a0457ec72cc2a5
SSDEEP 6144:QNHpoPEAChJZxcnu6/6j5WRKYV8ME+hIcfEMgrKAU7R0No//EdNuKj:Q/oPbChJZm7V8MEqIcfEpQ7R0NE/EdNx
TLSH
T1B4447D723300F53FA8274EA5A67E2F4E3C25E217DE1705B8D6E4E8358FD5EBA1422548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 ada4a7f7a20648d7898c73b71047cdd89bbc86cc68ca76c70c51e0d5213dafd8
MD5 4181d46a1dda8435f29c3f6095915f3b
SHA1 8e6468cf8bd28527feb4f73e5bd4555e888bc6ba
SHA512 6abc42960d469cfe489a9b3b1de738e973ffc5aeea31c93456ca73aa5d5e37b65dd99c1bbc345b06a554a147480f00009f76ac6c0db68f5279272ef7725c4fa0
TLSH
T11DB0118880E02802E02A02B020C828C02A33CC200BCEC32203A028A88AE02A00A08230
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 157B
SHA256 5b78c47292e6a722aaca65dd7036d299a719f017132fc10c00337ab2480fe2d1
MD5 81a314773aa9f5fad5969ef7930d2794
SHA1 bb4f7610a71658fa4e6ed37f0ef3cd69039a16f1
SHA512 eacc0e43ae0bac55b4202aa6360c492a363b03af8debd2ddc55f163f3f4b05fc5c883a84a75485d723d89215fe6805a09af9b5f6e1da09400862cee358d8d6ab
TLSH
T1D5C08CE3282111A74F30A6CA3028710DE9578DAC4CC8CCE889063042203493784049B9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 234B
SHA256 e243b2603b54ff3c6c851dc401d750ed66d0c1a07f76e3784acb4f9827375088
MD5 78c8dcf18dd52f7b2e3c75673bbb06d8
SHA1 7c2a402fc795f8a609d7725c6df3fbfd688b6584
SHA512 8f9df07a441ded3ac9e757f815ef5000452fcad2bf3f692fa787c58b0be4438a9fb45c1e9efecbacf8ed6900bd0fe1fa4637b04e153d5362b0759629d61feb90
TLSH
T173D0A7E75B71687F9BB0AA887029701D95164D594D84CDD88B44705331B8532C4159BA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 150B
SHA256 217b07b34e5d2801ffb0ff6f40cadcf2807c23d020513c611bca896b75729972
MD5 2eacce070891f692f1ccd50234352482
SHA1 08aab7a17425683de575cf03f9417073a5209f63
SHA512 6470914519ebf9f2c6abde6c245be28b477d91b30159ce0eaa8d7acb9777a48a4c15181ed13c7ddcf37682278cdabed3a123887e8901b0b46e1fc9024978e1ab
TLSH
T123C02BE33C2151AB4F30FBCC301D711DE94782AC4CC8CCE88A04000320349374401DBE
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 234B
SHA256 4f6b484cd4a1225daccf22e6722a9c8bc57fbe30d109e426c00e5fa3d114d06f
MD5 74de09ccd791bb1d5b0c7252d4c1adab
SHA1 43bae0afd45a0a7a8964706d618eef9aef41e17f
SHA512 ac8b6cd0dc0bc8f1258a4645eede64d262086d093647714b607748ec92e6c137ab1b9e41bb30ba2a56b1cc28e38e0d39b0a3bded29d82d60426ba9c5ce8dde1d
TLSH
T161D097D31831582F4B30A688302D300DA41349688C88CCC44E80709220B5932C8008FA
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

b3afd90a-7062-424f-8d04-d7024a836a78.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b3afd90a-7062-424f-8d04-d7024a836a78.tmp
Size 13KB
SHA256 d1756407670451cadbd9aaa841f79cd03702c344cd7bddb7c8d6ce34ad69b6c3
MD5 18507c65618327c877aef2c8e82b9ebd
SHA1 4685abd1b88b7b073c8c9daaccf708b6f5c26a13
SHA512 327ee21bc72bcfa7b798c952a56b19b3b164235bafdd70ea364968fcf79f04c3278d567251c8906a0637b5e92dfd0d633584f6465d4398ff87f3207c668c1223
SSDEEP 192:nRs2cBh+w82Pv7ahbPRp3cVM4h9/Hsb+WNhwfcuSfWflwPM3T2PRTai6TVyIsnAI:nR3mh+UHmBXKhwGki2Y2Ba7E
TLSH
T1F452952EAC10297B9CE7D22AF9127B66E3F5202164D41E84E7FC8D3D19E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b81eccd5-05cc-425c-a708-e8a88fffb664.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b81eccd5-05cc-425c-a708-e8a88fffb664.tmp
Size 17KB
SHA256 6f62105957722b267cf4e2f1062faa5c8dce576d335f5320bfd2b9499808042c
MD5 5f2649fc94604020017930263172e5cf
SHA1 f250cc4cbf79fcaf35294f9df8b61970cf66d409
SHA512 fe02be63a7cff8aee916e36490f1780163f58c9bfd3ab656d08c69c61bbcb86efebbc7c3121974cff0e53291776efe649fd50c31d854cbda41717e5c4a8660dc
SSDEEP 384:0Ramz+haWmEXS1rw9+5rbXRcZATKrqxnBa6E:bmz+hax/Vw9+7xn4J
TLSH
T11B82C85AA8202A7B9CEBD226F911BB6AE3F5202159D41E84A7FC8D3D18D76CD3207443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1aabaf4-77b2-4547-91e8-ccc4e0be859f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c1aabaf4-77b2-4547-91e8-ccc4e0be859f.tmp
Size 14KB
SHA256 519f03fc47e166aef65a9b57cd6d1cf496098eac5c2a1cffc7bb90e9a496d41d
MD5 a8ac940e8fec7f8e62f271c61270d1a1
SHA1 6cc35b90bfdc62bebf6fc7a4a8c6af3d04dc262f
SHA512 6830c26bce59a55c1077d2baebe4e3ef2ce76b8d7f8b7379de2317b4ce7abd09078f34070ffee408982612824b04e0d242603d30e519bd2a6451e1e71579fa31
SSDEEP 192:wRs2cBz+986jv7ahbPRp3cxOTT5h9/Hsb+WNJrXwP/VPecl6meSgY9nw0RTai6TO:wR3mz+BbmBXbhw9g19xAY9nBa7E
TLSH
T19E62B75EAC10297B9CE7D226F912BB66D3F5202529D41E84E7FC8D3C19E76CC2217513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2f333fd-d3ca-41bd-b449-1e9345b2dd94.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c2f333fd-d3ca-41bd-b449-1e9345b2dd94.tmp
Size 16KB
SHA256 86998655eda0b0d1c1e16559f0dc1d8040e307ada674d39c88bb2e2d6b48124f
MD5 706e5d5862254a488025fe284cb556a8
SHA1 8709dca90bc7b984ce686459a515698ce0148417
SHA512 c76c0db1553db7fd38a00c94ca44320203efdb276f675b3465e034f33182de198b88044dd39edc3a46bd95ae6452840f6d7a401b6660add7a6300cb9044601aa
SSDEEP 192:0Rb2cBz+hnd8kOv7aIbPRp38mtOHT5h9/Hsb+WNJrKtwP/Vlo4P1dt0AgcA6molY:0Ramz+hDqmEXwhw9n1lXRcZAaYBnBa6E
TLSH
T18A72C75EA8102A7B9CEBD226F912BB66D3F5202169D41E84B7FC8D3D18E76CD3207543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c652b2b8-e996-4beb-bd5a-6877d610386e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c652b2b8-e996-4beb-bd5a-6877d610386e.tmp
Size 13KB
SHA256 b0a8a3960c7fcd45cebec0950af93a263d5a63e6fd603697ee50b0fa675eca94
MD5 1c7127b030f172c3744911080ab056e7
SHA1 16d98de0d077be15d1a9d09b6df1810882806e05
SHA512 d44d5d9f64f3099a3773d9964c06553d8cfde022a7c246f20a7c7cafcc72cc88fa099de7fc5dab4b350aae2ab80e86728b53504eee8d4462963b9e12d0e75351
SSDEEP 192:nRHcBh+w82Pv7ahbPRp3cVM4h9/Hsb+WNhwfcuSfWflwPM3T2PRTai6TVyIsnAU3:nRHmh+UHmBXKhwGki2Y2Ba7E
TLSH
T1F552952EAC10297B9CE7D22AF9127B66E3F5202164D41E84E7FC8D3D19E76CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cba3447d-2c5b-4a0c-9727-8d054e6097c3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cba3447d-2c5b-4a0c-9727-8d054e6097c3.tmp
Size 16KB
SHA256 a28cc013a7d85df3e444c9270115275eb9268af33116dcba77d93f58297b1815
MD5 9a31ca31aa6eb3df709151f6d556bc01
SHA1 4ef59b1cd546c7133dbf6bf0e28a3a95571dd151
SHA512 bea0861d337b02626d86ecdb3fcc53c75bdacbde62fbeb1752e96b9cf6afb97c795c4287df5dcd7d6d6fbdd281a47d64b9a1316d4b8cbd660647b95d2b532742
SSDEEP 192:0Rb2cBz+hnd86Qv7ahbPRp38mxOWT5h9/Hsb+WNJrKtwP/Vlo4P1dt0AgcA6molV:0Ramz+hhMmBXBhw9n1lXRcZAgYknBa6E
TLSH
T12272C75EA8102A7B9CEBD226F912BBA6D3F5202169D41E84F7FC8D3C18E76CD2107553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da3fa73b-0951-49f3-b87a-6709f02be05b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\da3fa73b-0951-49f3-b87a-6709f02be05b.tmp
Size 414B
SHA256 48f0784f9386fd10a24ebeec1dd71ebdbaccb14657f69646e47530ed614b2a46
MD5 bf8b3a1c9c86599b8315d70b952ad4ea
SHA1 c103cc0a950475eb4a33dca6319eb51b038bf76f
SHA512 1e3e0655313c685808563a432e718024ff214bbad4a2b746a324b28d4bfc4a015d7a83b1b8985d7f021fdc54b953c61b29fe1a16d2cf2de02217cbd2acb5c1df
TLSH
T125E0ABAACC609CB70DFC032810550782E6A0234B2B41861F3B3D9D0D8FF823A018186C
MD5 SHA1 SHA512 TLSH

Submit Download

e0218744-d1fb-48c1-b3d7-b68a276f9059.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e0218744-d1fb-48c1-b3d7-b68a276f9059.tmp
Size 14KB
SHA256 2a3a176fd35154ecec19ab50a66c779f5623d00c6045797f1835f03129617b99
MD5 3cba8c23972f767bb7c846d02d13fbff
SHA1 4429a01cf5b193d3df2a83d8ac07270fb11af171
SHA512 5233b825d5bf0ba2331230ed752a043e4c1ba1edde3cd33b6d784f0d6648b3296bbc2857b63eb586a7c5773c5c7d29af31ff4d223affe0f8dfdc5160821c6a83
SSDEEP 192:ZRs2cBz+98yPv7ahbPRp3cAZxT5h9/Hsb+WNJrXwVSxggK6meb3WYRTai6TVyIsv:ZR3mz+BHmBXBhw9g4xOOWOa7E
TLSH
T19862942EE810297B9CE7D22AF916BB66E3F5202165D41E84E7FC8D3D19E76CC2217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4e38f95-fdc5-40e4-a0bf-0fce58554b60.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e4e38f95-fdc5-40e4-a0bf-0fce58554b60.tmp
Size 17KB
SHA256 c74ceef5817885da4153c88da3ed734d5f9d24a337a4d3bf068d6254e3a0ca31
MD5 0f88f069e57e209e33c904473eba0132
SHA1 96b86c48f0809a3a335cbc28a9abe4864f97ce50
SHA512 cb619b91738e8b851796f13f2aa295fe8d2ae1c80b922dc229062679d5ba5fdaaec69086c121f03daf24f9086b64d508110e987465ed332908fe46e67e2306ff
SSDEEP 384:uRamz+ha/mEXS1rw9+5rbXerjZAM+rqYnBa6E:Jmz+hae/Vw9+gYn4J
TLSH
T10C82C85EA8202A7B98EBD22AF911BB6AD3F5202159D41E84F7FC8D3D18D76DD3207443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eba47656-c198-4677-8b75-c5a646dffe26.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eba47656-c198-4677-8b75-c5a646dffe26.tmp
Size 13KB
SHA256 2ae79ec044b3c05deb9520687621f2ac7a0e6f3030d6fdcacc14401a4a6f9aee
MD5 6563173d5d2b7fef82f89ac9f093962c
SHA1 e11a3299c4c479b9a0f93d4ddfaab28b2f877a77
SHA512 c27a13023e19888ec71dfc1b5732b1e738ce615cc9fd3aefc8d056395ed96373207a1666ba00705b095408aa6b83b35b731fe9eac9a664cf2a5215c06eb40927
SSDEEP 192:nRHcBhhw82Pv7ahbPRp3cVM4h9/Hsb+WNhwfcuSfWf43T2URTai6TVyIsnAUgE:nRHmhhUHmBXKhwGkis2ya7E
TLSH
T1E352952EAC10297B9CE7D22AF9527B67E3F5202164942E84E7FC8D3D19E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed6339c2-cde6-4c62-b6b8-ba8697688db8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ed6339c2-cde6-4c62-b6b8-ba8697688db8.tmp
Size 17KB
SHA256 fbaba9d43d9851ce6d7bfade3926e867deff7a3f5994809e02c3c317dc00b229
MD5 3213a3e65cca8cd5af557c95ecd3c59e
SHA1 c5e19ccc3269c7518ed26b2aa4f2db6f7c56d415
SHA512 dd26a26e390e294a0c4b09da0711d9903e8899c314b9f06cba249a3905d22623697028458db82ac6c5cf4687221ac438a395e991b35a3e40c755b6ab231e05f4
SSDEEP 384:0Ramz+hacmEXS1rw9+5rbXRcZA1orqmnBa6E:bmz+haf/Vw9+Dmn4J
TLSH
T1F682C75AA8202A7BD8EBD226F912BB6AE3F5202559D45E84A7FC8D3C14D76CD3207443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f98bec89-6fe9-4dfb-a7a0-60bd7acffe6b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f98bec89-6fe9-4dfb-a7a0-60bd7acffe6b.tmp
Size 17KB
SHA256 c636b880d4b4e256c91beba1323219fcf118b91ba73e6a6938e0e98108feb718
MD5 c96007ac7d5061920dcfeb972a334e42
SHA1 4b4ce36890eefe27d16ec6620d42c09f62a2ce73
SHA512 f7e19fc0d56b0548669037fcb5c16ca70a51c4871ee91448b4cac5e450d8d668c978088838bf989d6bb5f4336aa0c23925d4395f85811947743c4a2de456c2b3
SSDEEP 384:0Ramz+ha0mEXS1rw9+5rbXRcZArCrqmnBa6E:bmz+ha3/Vw9+Tmn4J
TLSH
T1C682C85EA8202A7B98EBD22AF911BB6AD3F5202159D41E84B7FC8D3D14D76CD3207443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa1d67e4-241f-417f-b074-ee0bb727a792.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fa1d67e4-241f-417f-b074-ee0bb727a792.tmp
Size 13KB
SHA256 46b371462f9a04e21bbcc69d0df4295ee8df44dc31afe0c127952a452ad312aa
MD5 2c5a8595887cbb058321552490ed3568
SHA1 e36b24b369943d54583c95c1b94b61df9358c82e
SHA512 0c7b5d5f46252de4ba19d4536ec9726bcf66882d093791584ec60a4dadba62e28dcc48fa239f58f4e8062fff7a83e10a93cc33fdd93f2544f084db55ddda709e
SSDEEP 192:nRs2cBh+982Pv7ahbPRp3cVM4h9/Hsb+WNhwfcuSfWflrRc/3T2oRTai6TVyIsnv:nR3mh+hHmBXKhwGkirE2+a7E
TLSH
T12E52962EAC14297B9CE7D22AF9127B66E3F5202164D42E84E7FC8D3D19E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdmpkpjlmnndlfdllmnekbmgjikhghjg_22531.crx

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Webstore Downloads\pdmpkpjlmnndlfdllmnekbmgjikhghjg_22531.crx
Size 10KB
SHA256 095f207a918b0789acbe2d553b4b595891ef809b1002f833986b7d671b36787d
MD5 59d3adf323a0c0ba9115f34147ccd760
SHA1 0a9067283607e12eb5e0cff68471793d9213da13
SHA512 ef45265c3250fa6b5aa084aa798bead39e04e98aa31c2344bafd063a04ca5e864302cffc14746dce5abe47aa9df04546fb9da66e1b56e1c0320e5346f661313b
SSDEEP 192:YXl83wS4mk32Doi+jvvQ20kq80t+KXNY6gLZRerH8UjGbZQgTMdzWTPfv5GsgGYv:xgfmDzG330kut+K9YRdRerH8UjyZ5TpU
TLSH
T1F9326C2B1D2D645AC053823988C4A257A372CECD1860BB3F6482706D0DE0A976F43FED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0680f83-5605-4206-b0f6-23c5b763c9fa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a0680f83-5605-4206-b0f6-23c5b763c9fa.tmp
Size 131KB
SHA256 925d5823966f35089f945c73c3dd71dac648d7e2e893cfdc7ee84984fc942a5a
MD5 b809a1388c7e52304087a0b5389597f1
SHA1 8a7f3ad6774b90c598d99c7f3d8fdd8b6e32a7f0
SHA512 a2f48e8c769ce00df0e631ed5c429fecf92c71dc0e26ceb6faf9b16240c378b7a27f7c14c85c85bd13205eaef32e459b276f76500158e0d2056777ea70c8e35b
SSDEEP 3072:2AeF+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:feF+hFD+7t56OD9ZfSApprE
TLSH
T189D30232AA95D877C9FC7541F147A300DEB668ED85DE2A0D444A9F8EA09F84C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c79d4b36-a710-439e-84d7-369b590864c1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c79d4b36-a710-439e-84d7-369b590864c1.tmp
Size 131KB
SHA256 781c0119a12a87bb4f1498fa8fbe8326e3fd6a837e7d74bb8296e9d054a360d6
MD5 a3b9d3befa79863c2dee7c70478a3848
SHA1 b6ea58e94a77fdc9b7645c49d3cecb695303b9f9
SHA512 466a7e425c717321e87646bf1787ea4512e40628ad96488db28d5530b9c9e2cda9ca40ab11532f3d6b021363860b27d7dad45ec711bf5b7e0f8aa4762d42a1f9
SSDEEP 3072:2hWF+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:iWF+hFD+7t56OD9ZfSApprE
TLSH
T100D30232AA95D877C9FC7541F147A304DEB668ED85DE2A0D444A9F8EA09F84C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc09febb-08cb-4357-aa96-3f1981c93940.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\dc09febb-08cb-4357-aa96-3f1981c93940.tmp
Size 131KB
SHA256 792f388a647c84f09456bb1a459e93adff50475a64a89320ac817c914f618445
MD5 110580d3bb2f6e2707bf812540d50ac1
SHA1 1f290435276fefe249aba9597187e5fbe0df964c
SHA512 b7fb0dae5bc4f3dd96fe62defa79f07bf2e84fde08c82673300c5c0bdc300fcb2fd3acc5ba6a46b6b3e9b407082abbc7ffb8409a36c0f215adb2577fd3d8c107
SSDEEP 3072:2peF+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:eeF+hFD+7t56OD9ZfSApprE
TLSH
T1C2D30232AA95D877C9FC7541F147A300DEB668ED85DE2A0D444A9F8EA09F84C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfe79c1e-ed1e-430d-8ef6-838885c8d613.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\dfe79c1e-ed1e-430d-8ef6-838885c8d613.tmp
Size 131KB
SHA256 85a41d7c8c98bfcf01fb21fc141167c0763c497ea4db3be70a69f5d885cfc78d
MD5 58f14538be191976c09e210bf36cf5a8
SHA1 d00c3de8cd2c995966e4a7408f9c75c5c37372bb
SHA512 3dc5a0dfb15c82978b74be7b6a75f8799915caf734bb370340a8d64d87aa3786bf1c329b240418c80384e4438e910a3baa411126cfead0a7f1c80496b3371299
SSDEEP 3072:D4Jg+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:UJg+hFD+7t56OD9ZfSApprE
TLSH
T103D31232AA95D8B7C9FC6541F157A300CEB668ED45DE2A0A444A5F8ED09FC4C0763A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa045c97-fb0e-4191-9c3f-aa37cf4d4711.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fa045c97-fb0e-4191-9c3f-aa37cf4d4711.tmp
Size 131KB
SHA256 52e15f2849988ded4bcd3cca21c3b649ac970e8fad671666ed5d63e394901cec
MD5 d8dc10fe749e1a62a6a29572d34ae6ad
SHA1 37b934f277cddc618ae1c4e60b23f6c83174894c
SHA512 7f10d8e64e6a4d3850eaf09aefb0b98b48d3b3e99fe464be750adca03c032297c863ab451970dadccad02d316058731d602cd55b846374b95544b640574f0dc5
SSDEEP 3072:24eF+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:neF+hFD+7t56OD9ZfSApprE
TLSH
T16FD30232AA95D877C9FC7541F147A300DEB668ED85DE2A0D445A9F8EA09F84C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d9c5347ed06755feeb0615f1671f6b91e2718703da0dbc4b0bd205cbd2896dd4
MD5 0774a05ce5ee4c1af7097353c9296c62
SHA1 658ff96b111c21c39d7ad5f510fb72f9762114bb
SHA512 104d69fc4f4aaa5070b78ada130228939c7e01436351166fe51fe2da8a02f9948e6d92dd676f62820da1813872b91411e2f863c9a98a760581ec34d4aa354994
TLSH
T141417B303125B5D84D435F5308286ED5A3EF874AAFA89F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 01077fdf837ea50d927e8d65d6446f183211f201fb4be0cdb81b145a2e2d7189
MD5 f45449b7ec4ef6909e4a3caecf087385
SHA1 c8b1e50c9767bf6d90d4a1319515f53a6b524d12
SHA512 3e2e7eebed342f50b74a45c25a5bd9cdb7fd5fabb5a48ae85b7417f333ec1efafd1f4752320c1a897bee748556461aa0e30ae4bbd8fcff64bb41cb3ff2d8243a
SSDEEP 384:trfUJWF9p+ImqHZPBitJk5WL4NoRBEGm6seYr+Ew/Di3SoZZfKjEuP9iANLx:lfp3mmdo85W4oRmGB13iSQgEuPpV
TLSH
T1E182A4AE610F16C3C4D11378D10B451FE8F2DECD131A07D8BB5A9F3B8EA9A5E612C158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_rtan3m0r.4wt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rtan3m0r.4wt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

VSCodeUserSetup-x64-1.146.0.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-K61G3.tmp\VSCodeUserSetup-x64-1.146.0.tmp
Size 3.3MB
SHA256 88cbff34a87cf9f316ee3c1462f213b480adb4f4c05862b81d212501a517bb92
MD5 149b457f93962b13d24a7d029c44467e
SHA1 135b3460939274996ddc635b711646c9e759ec97
SHA512 d5693f50da7256947b7444a8379286d7d3f28ec52108a26c3127135f8f2dc68c73e887e31f7e397cc491407d2b5ff757c1747ca78c2c11221416ef9e4b0187d7
SSDEEP 49152:AuAKxvISKIJhNRQSJ3MhjxIXhEzAWig8l1sXyKFz0ool5+UKLe333L:AuAK6XMXhKAWwLsXa7333
TLSH
T1C5F55C23F34D603EF06A1A3A9D379658583B7A606916CC5797FC3A4C8F361402E3A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README.md

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4224_441048841\CRX_INSTALL\README.md
Size 38B
SHA256 5d588d9038701bef0ffc1511f951d72dc5eb12e7b53a2e92524120bb22c5f04a
MD5 80bdb8ec2ea4ec47f969976ae727ba5f
SHA1 9959bd2139f35752657f5f732453741b78a8ac95
SHA512 f8e28b2811dfb0067725e9850122f06b4850ce7fb4f0840432170848c64e3df190554f7ab8a9f46daa90782da668d9515d39ea80d15516a765e3de3345d7bfca
MD5 SHA1 SHA512

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4224_441048841\CRX_INSTALL\_metadata\verified_contents.json
Size 1KB
SHA256 a6077658834971edfd2f6e0c4d53a2b9c2c160a67848c9e0442a0a7d7bbc4408
MD5 5de9c8008db068f31749de531d700126
SHA1 82196aeae105aaf2725d01e87786cbe58d17b2d2
SHA512 7f0ffa68f8eda78ae70927e7cf4451d288221b33a1c8df107758dcfda3e22d47663e294e0ed42f48cfe4fa73b7758333e36516883dda0388e2f1c43a49e4f3b1
TLSH
T16241EA17D449B9CC3444D42896D93383E74F76F5F79C7B162AD4004D74E852D825B01E
MD5 SHA1 SHA512 TLSH

Submit Download

discord.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4224_441048841\CRX_INSTALL\icons\discord.png
Size 3KB
SHA256 3febf8b0ad4fead623fccf0b97b3843670333b77838c4aeecebfab401ee995c5
MD5 fd02cb1bfb70dfa4add60ea47562c7fb
SHA1 ff70013df15535086145d14aeef8d080561ee419
SHA512 84fb34bd9f9004622acc02ce2265f216d3e73226228aba4e5d54e0787b3eb641cedc292808062a5ef638866b60f428a008d2aa03f63ede8f40b7029832256e47
TLSH
T148717E6E49FB15CCCD6CEB05C523A142181B7B2D9BB5D0A2221E6E541F039B2C1A4C5B
MD5 SHA1 SHA512 TLSH

Submit Download

discord.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4224_441048841\CRX_INSTALL\icons\discord.png
Size 3KB
SHA256 525d08f035c229b27d807d5f1e9f421fce9d0de3c8f4bfa7bfb0e53bf5c36111
MD5 3ba099e9e157c8203075c1110ca8b45f
SHA1 bb9e4ddc1d1e743c250e14146f590f982e2aafed
SHA512 5c750540c12809f11f5b765c40b4f0c6fa0317050424d4a7942192cebf0560e9027d12d9ac11f73294198bab9e3c364d4dafd72623a92e0350db552f74fb1b22
TLSH
T1E4716DF4D6F658DDCA92D1337052743DD21D4232928C934145B4D4951F5ED9A28B6F11
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4224_441048841\CRX_INSTALL\manifest.json
Size 928B
SHA256 6561e9133dd18ae7e0d1a2fcd9d04fe6f292e2deb29bae14632d17d122740808
MD5 8f8f59c5ec719bbe3f67155d42f128e3
SHA1 91866ee337472678e3cd845cf01d2c10f2b70eac
SHA512 ee661f51b5fefa54b065ae2392e4759c5df8fe7eb050f6fc5543fe4722c55e09a0a280b723381f77b2b37758997f2bbf0853871585129b7de5214da9d5ac0daf
TLSH
T18B11BA2B1910E07A02786A6CAD7A150BE370126E254AA85F387CA08EDF7252B1689B5D
MD5 SHA1 SHA512 TLSH

Submit Download

popup.css

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4224_441048841\CRX_INSTALL\popup\popup.css
Size 1KB
SHA256 666ad5d25f9d557c47a51a174dd2ff353da413ad4ed2724935e8919c85ca4bc4
MD5 4e6f05b5c09616a55f7718e660c0f684
SHA1 244a93e451afad80da112a6559b391c7d9d30fa3
SHA512 415c76279944f6a47955a65e4971d13206815f3686686fcf7278844b9d4e0329aa228600109e4b47e64024baa01d58ebda900acfda3161cdb5119fa8df5fa3de
TLSH
T1BF411EC1EC0A2F033102E57834B185125B68A70F84CE5CFDEF9518EC9CC9929C5B1BDA
MD5 SHA1 SHA512 TLSH

Submit Download

popup.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4224_441048841\CRX_INSTALL\popup\popup.js
Size 605B
SHA256 aad6ccdb2d06a2d7a9a4a8ab715ddb6d941dde3d4ccdc42d41bf87d20fa461c8
MD5 6a2e47359c13e5cf4af6cdb14c8f7119
SHA1 967706af974d680c0868cc2e73904d66756009e4
SHA512 63b2f7fcf4397157840e6e43c9287802b19e957f7974b9d5a2f0e25b756d68c2f1a3f3da6162b2c97f2d70dae4cc4f07c49a2f00a11c2fafb28aadf5c59070a8
TLSH
T13CF0412B4C358978033FC565167BD58AEE32008A2400A082B80C4C301F486E901CF2F7
MD5 SHA1 SHA512 TLSH

Submit Download

script.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4224_441048841\CRX_INSTALL\script.js
Size 270B
SHA256 e7a85222927ba04eff4f4be9492473fa351a7f87ad67660321ee7ada6642ebbb
MD5 1a3fbac7161c3d4a4ba8883814c2ebed
SHA1 6a32a9e888d6eb61b641978e54d4864aef48d48a
SHA512 55671b929b93ae82384cecc02956a48040c46f03e326345684404a544efa9932616fc8e68fed1bf0f702a5d739e5c49ba8943c4c0307a08408f26c2bb98678d4
TLSH
T16CD02B6611620AA40B90C9577571532D3A33005A18D76052354AA85CEEE6F272096FDD
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Code\Cache\Cache_Data\data_0
Size 44KB
SHA256 be1262b3136157161ad2b3e5895152e66e7cdcd7d87ab43fe2a4cf054c674216
MD5 a22d178bfe06492e1519a5133315d40c
SHA1 46fb5e34849dd6724c407874a533320da9763c92
SHA512 8460f7808967fa82d30d7b51ebd48e42aa45b4fb44c898d677f8341595c4177b9c9749b5842b5d5cc6b0565be03e3d9f7aa6c8809297a43c40916ed172b242cc
SSDEEP 3:MsFlTlrllkl2tLRe/1ikflNRQQIO11MzvA/t:/F02tLRe9ikNMZaD/
TLSH
T17A13925DD4AA6802C260053876CBA2701271D408820F430310AD242A6A023210A0C800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Code\Cache\Cache_Data\data_1
Size 264KB
SHA256 709346835c8948835d3acd3511fa81a549960ab3cb870cf6335923c5ac81b4ab
MD5 5c608c2c2ec6cc09967cfe775bb1c3ad
SHA1 d27179d4d3ad9b34bd4b6460790e766d0723a2e3
SHA512 a78e867fac07ff52bf697a48df76c44701ff984aae315a6916acb17da53a7cb76254c65d8ac48061c9056d92a72486b3d8c63a7b01b7b582e19424fc3eeae0d3
SSDEEP 6:/M/LlE3n0vCXnlJoLq3bl20KaNLF5stbPXgLWeA1ylg:U/NK1JoLul2TaNLsJPFw
TLSH
T1FD442BB60585011AD7559134C08603DC637AFD047B73AB5AB9A966BA680EBF47704105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Code\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 952f600b8c2d5f138d73513e82926e80fdae356f4a42945f82694d3e95bc57e0
MD5 f84ea4452bc3f77dee56a2452df81eaa
SHA1 0e8f7aaead0ba7fd750b727c13f3bff52631043c
SHA512 925992bfe8553dcc34e3154be9262305ede33067c624bbacc4f96181b1ba3687608f7b4f8aec45d22fdc97414a9e42b05b79a8c456efb436f76fbb95b76aa954
SSDEEP 384:tuUIiIDFkWa79iqBKHyoTuMT3snnqb1W0ix9ovYL4BDb9oU7cKgNJt:tvIYBiqBKHyOonn0WovYLODsLNJt
TLSH
T1A3163B9B892C9DF3CE91CF78B95CFBC36E3E2BD2919084F3D81C5564069D396221A316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

configuration.json

Path C:\Users\Admin\AppData\Roaming\Code\CachedConfigurations\defaults\__default__profile__-configurationDefaultsOverrides\configuration.json
Size 529B
SHA256 2176d256de7138e26d98185e8035712ea361a14184e1f7ad5028aac5cd6813b3
MD5 49a73cf117a847a4ebccafb9565d2536
SHA1 2e786703e7fe1e0d860192dcfc0c08d7f5a56452
SHA512 c1f372d0062180f997dd88cc997408b33187149ba2445269d5c7f32bbb6dfc441ca6bbad80e378383da525d435bcc43814da924e2796ba37a73d30bd94d59a8d
TLSH
T1A0F02450840096B0A35AD382BBA05E225E3D0C3621C0B878769E09F804BFA5E1316DA7
MD5 SHA1 SHA512 TLSH

Submit Download

5a4ec3d363ec227c_0

Path C:\Users\Admin\AppData\Roaming\Code\CachedData\69047191fc427f2f92828279aae1d90d8eeda7ab\chrome\js\5a4ec3d363ec227c_0
Size 307B
SHA256 70d8a42184f698cec35521e242061c3a8e9b872220c8a459d3580583341e26b4
MD5 0cdab13cd8f17ad727b04f2a8d80c4a5
SHA1 5bb7406cd94559855b797e6b03e7e9a6b5f6cab4
SHA512 8318f9243ce0a8742cabd3a15b342b48f8babf9d4af9f2d20b1a3463385df1dd80220f2be29bfbe47938b67f0cdb2531a5cac56ee457425abbf9e48201162346
TLSH
T110E07D8648671462C86BC03AA6E780803F48B68110D84610F82899DB31075722494124
MD5 SHA1 SHA512 TLSH

Submit Download

ea838fa553d6c754_0

Path C:\Users\Admin\AppData\Roaming\Code\CachedData\69047191fc427f2f92828279aae1d90d8eeda7ab\chrome\js\ea838fa553d6c754_0
Size 306B
SHA256 b68f40af14d0ffc376f486ea42f5714230ec898881625875b57be2b7622c10bf
MD5 bed33fedc568468408b7047701e409ae
SHA1 37ea0a2788060712b7c532b5338065083555aab8
SHA512 ce005bd05de50462b66ee548e198c910f1551a086bb988348dce125d02e2107ceafb25a9be698243ad2780c0a8426484a67be8d6f00706d81875f514c547779d
TLSH
T1D7E0E741CC9F0422C87B8437F1C740D03F54F18005984610F43C6DE652415721D9541C
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Code\CachedData\69047191fc427f2f92828279aae1d90d8eeda7ab\chrome\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Code\CachedData\69047191fc427f2f92828279aae1d90d8eeda7ab\chrome\js\index-dir\temp-index
Size 336B
SHA256 da93bd63accdebe5fb579d7249380310728c1f4ef373ef544ff905f1392e159e
MD5 188fcb1fe59a2c810fadd2073fe559bb
SHA1 e31d78b99722ff22b350609837cd31d17d775839
SHA512 403d564c6157f041f17c5a81fa7ff611aea33f0b6ec5d9a03ac4fa5d2516f0b472940d27a72a699d15fbe4820e1e0bb27372063ba6dbd51d1adac7fad6c56771
TLSH
T1B1E0C27C86CCB721CB41A6F0C1211603A55DC22422DB83436868246C7726196EB448C3
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Code\CachedData\69047191fc427f2f92828279aae1d90d8eeda7ab\chrome\js\index-dir\temp-index
Size 216B
SHA256 a342f35c3a10d7ccfa3df13e09d11eb01be6ea1b225fda64c73a79ec89998c58
MD5 5d269b9e60ab7b916ce3eb8c47f53c5a
SHA1 06aefb25514f87eeb4cabaf017102bb18de3c560
SHA512 ff4826e4729feb7651fe4e23523def1c36e2126779f2ff700a4154f49c6d9e06f3d5e2230c14d652f5c1c4f1a814a1d39f3a19d8aefd4d8aea89327bb19fd76a
TLSH
T154D080789F8D71D0D301763156691247D45D8510A58F43574544947DE4111C1C39106D
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Code\CachedData\69047191fc427f2f92828279aae1d90d8eeda7ab\chrome\js\index-dir\temp-index
Size 312B
SHA256 45718587cd553a971116db61689fc92a4c7d689b0ca82c61b0fefa81fa3437d6
MD5 a12fe086c06b4084c7fa57ab542cd05b
SHA1 9e0833438f10065568eeec0b12142635324ed8b2
SHA512 0d8079eabd8f626aca4eeb05b2557c07e666fc8f1ee3825f5ea0acba38d9eca7094d618f23d4353391ddeb0fef8fc24ff25e66ad4c2e2626fa1b998ffb885bc8
TLSH
T1F2E0A77C9ECCB664C346AB7185259743C45EC520309B9303585C9C7DBB121D3EBA4446
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Code\CachedData\69047191fc427f2f92828279aae1d90d8eeda7ab\chrome\js\index-dir\temp-index
Size 240B
SHA256 dfc2b52d654dd951bc521984a49517e1249fdcf6c982ba584069786dc663cbf0
MD5 6f20ab93d4c5f5994436c13a50f7c05c
SHA1 b19716b15059ef81f004d55e652a71d10a66c86b
SHA512 a9229015f71a9c9e57f22b0cfd45381adc2c184834a55b6cce2294804dd497988611a45dd1f3af2c744ec1ad5f2dd7aa0b19f6998ced6d8f02a300dbe274902f
TLSH
T1C9D0C079CECCB2A0C3027E3355588303D81E8400109FC303488480BDBD101C2C39005D
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Code\CachedData\69047191fc427f2f92828279aae1d90d8eeda7ab\chrome\js\index-dir\temp-index
Size 336B
SHA256 a2dc0e00ffc62a5ef746dd8f255b6a19c40e93a80e9400103035ee4cc0ced8d3
MD5 c5ee5682aa9d6fe5d42c47d855338924
SHA1 db69cca59abc362cb8d78d9d909c545bbfd1b4dd
SHA512 60453223493440dbb9bcf7ba53e591bd91a2bb6f0ee248d91700f54add745ec4cb657c2e60ea7e5a2d6f9d3ecbbf0a85f2bbaa603431f115883bf7e5503d3b9e
TLSH
T19AE02B7C85DCB310CB01E2F0C1515503D55DC12861DF8343745924BCB722193E7488C3
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Code\CachedData\69047191fc427f2f92828279aae1d90d8eeda7ab\chrome\js\index-dir\temp-index
Size 336B
SHA256 aeb5705aa6e3aa50668f1aa7ca878c62eb9f834b92b6de41039dd07194b1a08d
MD5 d6df53eed49f954ba59a063a4f900bf8
SHA1 91c764e4e10f17dc00b4cf14dfec87c915eff4d5
SHA512 03b5de5b09841ce7222686b1963aee5bbd561ea590d37e73a38d3af26cefec3da000895218f464142600051ce9168cb6b8ca8d188c7d04887e5639a72f95c792
TLSH
T1F4E02B6CCBDCB710C741A371C32446C3D96CC624249F8313145E147CB711093E74C442
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Code\CachedData\69047191fc427f2f92828279aae1d90d8eeda7ab\chrome\wasm\index-dir\temp-index
Size 48B
SHA256 d475cc3f6393dacc76efeb8d57d50dd95f5a7b560f8a9ec741121a9025ca4897
MD5 7fd0d1527729f36eab247559b749a4c7
SHA1 18a2f5159ab53552e94449114017bbea766f960b
SHA512 7ef0eec30dc9539e7193c077f9b57c374aa37432bcc6bb71f4b109790d1613cdb82c9f95802ce8df25be13770341d00a44c19490a0a2565ef7e8b342dd57deea
MD5 SHA1 SHA512

Submit Download

extensions.builtin.cache

Path C:\Users\Admin\AppData\Roaming\Code\CachedProfilesData\__default__profile__\extensions.builtin.cache
Size 1.2MB
SHA256 6441b1a3e4492094741c96648cef99dc6253dfa517f63d87354cd376033cb165
MD5 0ca0b5aa44e2ace0dd6f82d3a28384b4
SHA1 cb96c1ebf26bcbd186d00248088d230125438bc5
SHA512 154ff5787dc478d5c311b428ca91db194c4f8c22c089790ed31f2f3d042c05127abc8e763debf6ddcac856b5055f4b8385753ccf63416ff02a6a94cab7b45980
SSDEEP 6144:f+Y9jBNmRGBLwVRjIzxcXxnRwT2ipbX7upmAOducKX6iXU3GQ8xfqPgft1e3iILg:Q3yT2ipbiWukiXU3GQ8xfsl/q827
TLSH
T1CC45F90B6D04E9350F8A1392ECEE9C06EB79431DD150F425D8EAC93C529EAF841B77B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.builtin.en.cache

Path C:\Users\Admin\AppData\Roaming\Code\CachedProfilesData\__default__profile__\extensions.builtin.en.cache
Size 1.2MB
SHA256 9721089da5c869d2475d93702de83f15cc2004d5dd48a1a85a6fac751162b614
MD5 2192e8a179dae359d14080686c8179a5
SHA1 f9d35d39199b3bad6fb9842f515195a3f5505f8f
SHA512 769b46390a169912c825d5629af2eec5474da0ee2bbc657fda448d43c94d931e01918784ad24a71472adbcd87630a60a38b9e0d903d64d162b39add0a3a83eaf
SSDEEP 6144:D+Y9jBNmRGBLwVRjIzxcXxnRwT2ipbX7upmAOducKX6iXU3GQ8xfqPgft1e3iILg:E3yT2ipbiWukiXU3GQ8xfsl/q827
TLSH
T1C845E90B6D04E9350F8A1392ECEE9C06EB79431DD150F425D8EAC93C529EAF841B77B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.user.en.cache

Path C:\Users\Admin\AppData\Roaming\Code\CachedProfilesData\__default__profile__\extensions.user.en.cache
Size 503B
SHA256 163d7b1e7ca931ae0119bafe11049fcf2af9d654d17749b6683c7b61006377e9
MD5 553938c4e3a9e37b3dd199d66fb29870
SHA1 d71ec220985fc1607ddbe8a136b548dc0ad5c6c3
SHA512 3bd657966068eb2f305f88599f67c81dd8deeaca2f7fe9dee1123917ab09182f86eadd6f5c8e281f4676cea3a98210171c1ef70399caf84472c8e9ea8656b557
TLSH
T1CEF09EC2D51C0773D19E2719C9816844CFFC62AA74C501643AE8BE9481BA50B296BD5B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Code\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 83eea56e26f53bcddccb7e60b63605efbf4801ef47668429b2188d8313281e00
MD5 09de32c6d7e3247a1eccda2bf45c6929
SHA1 9f66d030f2abb10e1958493a9d7a4e98677ae7dc
SHA512 7c01aad4e3a13427ae77bdb823e88230bac9abdddead579a88730ab71ef950903ae262bf769141cdd525f232c460252253b1148fe397d509f8fc2ec3e41ecb89
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Code\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 fd21cc72c108cc1beb67eb94845e86a65bb267e887de9d0a576d326ffcde06ed
MD5 cb97d657c1ede17872fb3bdee037ddcd
SHA1 e292d6b7836aeeb80bcb2bde0abcccf65a8afb0f
SHA512 c69badd3e24c8d1276d1f83547e27054bb2965da3a7129cf4c5dd18d4b6eda0ededee5a5bb1cdad632cde3e5c4f2bb33a83cd9762ef01e3109b4cfa5d53d1083
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Code\Crashpad\settings.dat
Size 40B
SHA256 4bfe71985c10f349bb6315c44279970f87a56133e78fce1df07adc82592553e4
MD5 9f8a9600f4be8be37e259b124d743c1b
SHA1 f9ab7980d8645d925ddcf046ab11b7b4a72847bc
SHA512 a6f075257e3f6ba2cb7c207255cd53c62fceed34c60da0eba9546685639c775f163d5c38fd48ee8867b57a9e3c865651e16bf084ea26915d99eacbbef5fd9ef0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Code\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Code\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Code\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Code\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Code\Local State
Size 490B
SHA256 d27b82398b96ff4085eb2fd6230fe1e94319fcf1aa79e2b818bddc9b9a43ae60
MD5 72718f41146a060cb24b018d9f014c81
SHA1 fa1c499c74c1e01c57b4906e5aa9110124f9e21f
SHA512 3eda08035d15d3352e0e7c4a047d8a666d5a947f882553ac52713ac4fe844401e3212890a697765c0be79247e641395462d32ff140078a10013f2bfa5886aa6f
TLSH
T1DFF054F32CA027B4A711965543E67E230C3026BB1E02076877C4932150B3CCC860EC30
MD5 SHA1 SHA512 TLSH

Submit Download

08a91e1a-0fe2-4816-aa55-45117c033571.tmp

Path C:\Users\Admin\AppData\Roaming\Code\Network\08a91e1a-0fe2-4816-aa55-45117c033571.tmp
Size 354B
SHA256 5f3b8146d2cafd96d0f789a3ee539090eb359116cd5afaeaaa6721ff0099e685
MD5 179f28fb1bec43b1c95d647161a7a0fa
SHA1 1019b951f64752e33481b47dfa53728cef43f255
SHA512 3c99531f4cdf1eb3dffa8aad5e027d2000e0c8bb609ecd25826f344b3e5f40f38013f7ed3b31b2669ac9947789983003857e697818a18363e3c5a3cc9b50e6d5
TLSH
T110E0207381BD6CB310B409BA2B08FC056B7A9438495354F5DFD7452C70D20F64906C77
MD5 SHA1 SHA512 TLSH

Submit Download

7b13be1e-6df2-41cf-94db-cd9c1f47e484.tmp

Path C:\Users\Admin\AppData\Roaming\Code\Network\7b13be1e-6df2-41cf-94db-cd9c1f47e484.tmp
Size 356B
SHA256 e10238b0a7a70545d169f6b3be00252f81f0285b6c64e52e954ea268e82c48d0
MD5 be32df302ed79436f7c9acee11380d9c
SHA1 e71e82afb58ca2e372888a5837ce2132d964bca7
SHA512 97e9201a5ef3cb4fff8565075356494378a3651a98827e86ccfdd29b416ca1ac411b4a45636bf53cd857610c82f62470caf2f8aa1c91fe2448d36c0cc4737ec5
TLSH
T17BE0D863C2AE687754F545A62A44BC051E769435465394F4EAD6412C70D11E60602877
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Code\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Roaming\Code\Network\Trust Tokens
Size 36KB
SHA256 8b5a62a399e316009e0c0ee1727ede327893d7f82f38a136e795422b3f9c333c
MD5 a0f27d9946f49134d0d23e62d1882541
SHA1 9a39769dd453efb04c526dff62a7c7770b3a3d13
SHA512 392ed08a0cddd45589041820792d951658fe0c1ba0b00dc57e88a97ebb6f579c10e92109cff7126cdc62c34f00b9b82f3a85d0dd96b797cb0cd5c56f37030af5
SSDEEP 24:TLY3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T031DtX5nDOvyKDhU1cSB
TLSH
T188F2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b10ce49d-e0bf-4895-bc40-2fb9cb10f6d8.tmp

Path C:\Users\Admin\AppData\Roaming\Code\Network\b10ce49d-e0bf-4895-bc40-2fb9cb10f6d8.tmp
Size 362B
SHA256 7cf1bc101b70dc345df108365a278bdb509d19574d3a498fdefecdb36db0c3e7
MD5 3ca8aab5d467cf6b1183584fcdd9b30b
SHA1 7f6c2e9339165d6ba7f8c8cb26bfe45dda31a850
SHA512 e55270b34a8ea2317d55243df934743234e1beedf7944f4481258492d872465b710316ed3b6176e06ff9fb88c9e54894a868438f3e8df16d6ff427ed93eb6568
TLSH
T12AE022BB437418BE0322E3F85E142E23C6FE0015236CA89289942F1843728B9540068B
MD5 SHA1 SHA512 TLSH

Submit Download

b1e9e1d8-605c-4d90-8a8d-c51f5ee57825.tmp

Path C:\Users\Admin\AppData\Roaming\Code\Network\b1e9e1d8-605c-4d90-8a8d-c51f5ee57825.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

eba222f3-efae-48ed-9a3f-5cb2c4f94351.tmp

Path C:\Users\Admin\AppData\Roaming\Code\Network\eba222f3-efae-48ed-9a3f-5cb2c4f94351.tmp
Size 362B
SHA256 7af574bb20110705cb8c4d4d3c933a683a802379f3863ef82e8b3314776ca4de
MD5 ff61b6bd12e0d6322fedb8ebd5f9956a
SHA1 939b6a316a6197f11bc08461f507f2c57def8908
SHA512 b4a7a9d56897b2f2016469f92bcba2dced85e2f548e86b4a947e99b790b72ac8d2c800ac229dbb11b9d942e5ae472cad30543ac0993fc61179594fc14693de97
TLSH
T199E022BB437418BE0322E3F85E142E23C6FE0015236CA89289942F1843728B9540068B
MD5 SHA1 SHA512 TLSH

Submit Download

fcc2362a-61dd-474b-8799-8ce7c4fbdfc9.tmp

Path C:\Users\Admin\AppData\Roaming\Code\Network\fcc2362a-61dd-474b-8799-8ce7c4fbdfc9.tmp
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Code\Preferences
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Code\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Code\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 486c2e88d9a665223658d277730f2c19b6b026902d09c5d0fa30effe08ff8a68
MD5 36ec08c556798f89483c23942bcc3795
SHA1 70af1e5b3ca89f6ca59fd5c904ac889e493a00b5
SHA512 98035043a0cc9d56cca2bb278b54f0b6b2562ba972309bcb9c0c46ce17a05746470cc6af1198b54ed434409e4a2eb1f839a8afc06dc59333a86063a3c8e5246d
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\Code\Shared Dictionary\db
Size 44KB
SHA256 fbb86c665b2fed35c372ce8996eb1c4e31082aedd6ad5fc6086cfac889c3471b
MD5 3dbd7f6297feb0b5b14541072081233b
SHA1 d48400e771c013867225e49e3a6d5a6d917d3be8
SHA512 51fcad55e0aed1cf9e95e14444e4c0bb20095afc406a290105dda2aaacb6cbeba7efa29e83d89bbccdc3c07ef67421a79da9e259e6727abb9e516e79416cae66
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:TROIy4m1b3fbUdeqSB
TLSH
T18913BB0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent-host-config.json

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\agent-host-config.json
Size 4KB
SHA256 f8f5e9ae9a4fecd59e31ec7567852133925e568163d3c995d4c44f5059d885da
MD5 76b7fead60876a4b53dbdec3f5a5b229
SHA1 3068788e0a975d1a9044701c06147dc901a5ca19
SHA512 02e0f30ac93c929f03f54ee43aac6042df7aef34c7da080a0626f189efb36c2652015e7ebdce576db30ddfe093c3af4cb2e77a1faf71bbbce06603176d57dfcf
SSDEEP 96:cRsdEHW4xlMumtgchbgzBFOgjjjzsNGsBa5CxJFKGnUpaua:c1HW4xlMHjYBeGSaUjkGn8aj
TLSH
T17991FE12C53569FF03D8A76EED6CE0538B348666504FACB9E814B918F18CA7610F7EC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent-host-config.json.4436.tmp

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\agent-host-config.json.4436.tmp
Size 3KB
SHA256 694e06623c03c2ad01632e39b7c7af10258567db5703cb164ec066b9795e85a3
MD5 ab1a4a8f163b26caeaaa5ba62f572346
SHA1 d2d9b6d7bdd2cdf3217d6430516633f6c5f96cd1
SHA512 ea019553c1e686f5c1d10c1e8ddae815c0f0fdd2198290df6f800cd055b794f3c7475f515d6a6cef2d3acfd9338bc30640abcc19a0fa3370214d0d56d102529a
TLSH
T12261FC51813A41FE03D8FB6DDD3CE4138B388426108F8CB9E4482A0CF59CA7A01EBEC2
MD5 SHA1 SHA512 TLSH

Submit Download

agent-host-config.json.5372.tmp

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\agent-host-config.json.5372.tmp
Size 2KB
SHA256 2504fb731a00a65f3249b8b470e70deb6e3b3c08186b63697f73978bb110399a
MD5 8c1727101bff4c08f59c6b6cdc18c9a0
SHA1 dbb4f15c248544287639ff4b5ff9ed07daba650f
SHA512 03bc0bb0c130c93156adc9f9666a255cdb2e33ffece8bd2b9a6c9fe89ad40928ada60ff90c37bc19e772fb448e80bd5c4157e94af78b0006c1d48ce9a86bb6d6
TLSH
T106515712C53039FE13D9AB2EED6C90138B34C9A6544FAC79E810EA19F15C97211B7FC6
MD5 SHA1 SHA512 TLSH

Submit Download

agent-host-config.json.5372.tmp

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\agent-host-config.json.5372.tmp
Size 4KB
SHA256 605ec5a0402f68754efa1dd61b014c9165ad1a815d9b9be59ac09a6a0f04c6b2
MD5 a13fff7361594dd940713b8a97b030c8
SHA1 637bca09fdb1bd82b469057f370e125ee96bad51
SHA512 376d45ac994eab6cdf6d836a52361424047151de9f0e7de895e728a227d44fb260f8c2fab6c8231cdc675ce1f4f36734a6414f5868de3a2f3477622a37a996e3
SSDEEP 96:cRsjRp4NmlMFJFKGnUpau+aBdoQtgchbgzBFOgjjjVIo7hXE:cCf4NmlMHkGn8adsdZjYjIwa
TLSH
T1A8A1CC12C53569FF03D8A76EED6CE0138B348566504FACB9E814B918F18CA7610FBEC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent-host-storage.json.0b542d72-0814-4c4c-bf65-647970d8ec88.tmp

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\agent-host-storage.json.0b542d72-0814-4c4c-bf65-647970d8ec88.tmp
Size 122B
SHA256 6e004f743d7965a56933c9300cfd507b5fa49e39b429e8d8b343929752b792c7
MD5 5ab02b3354c656b427d2d4909b71d86e
SHA1 b5d9fe82469c1bdcf79f4fb5e9c2f2be253490c8
SHA512 af3aab14b446eceec04b81d0b9846311ff4365b6ad5403b40c6093aa4ace5789a7095388eb43e76597f68f35942d5e7ca43348d400c71af9673909f875a0724c
TLSH
T176B092F9086F17B21BFA832B5A84329851328AC47D576170198B0588E0ACA1D931B6A0
MD5 SHA1 SHA512 TLSH

Submit Download

state.vscdb.backup

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\state.vscdb.backup
Size 188KB
SHA256 9a114de909d8aed2bfb2af90a931a1263834795f3b11320c77d4123cf6bcd9d7
MD5 9248be30f018d8e7dd6cf662f3e2b74a
SHA1 7841f29d20b3198419880b2922d09c912222d4f0
SHA512 841d33eb8baf8394951cd4229704307b56db1146bd7c691639f3241cbf1b51f380aa4a0be79a27c4206c1e2fbc151201b3225ecc2524150192a3fb3c5c938d08
SSDEEP 1536:hKfMRvNP8LGLKkVkoE+LkvGDREzDC5p2ebVJ6gkDnF:hrRvNP4kVko/osfkDnF
TLSH
T19F14CB29F64415FBDB6799376CC66A26191FA8D3ECF0EF28F21A2E5840FE24014F1572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.vscdb.backup

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\state.vscdb.backup
Size 188KB
SHA256 f5b266ecb84ebdd9a528ada7594a9081ed2875c2a3f134eeec4c728669a15a4b
MD5 e0a4956d6d7e7d1bad9b315a5128bcb7
SHA1 d43db18372c4cda2007c5e79b044c4d1fce061af
SHA512 b6034b186c0246517c298a8d2441d1aae78715cb2c59962edcf4fef4fdc151dd3e6d93a4d7a48001761ba89a1743e76cc1a0b228a54f24434395be6864274fb1
SSDEEP 1536:jKH8YbNP3LGLKkVkoE+LkvGDREzDC5p2ebVJXApkDnF:jvYbNPLkVko/os9ykDnF
TLSH
T15214DB29F64415FBDB6799376CC6A626191FA8D3ECF0EF28F21A2E5840FE24014F1572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.json

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json
Size 606B
SHA256 23bfd8baa7100492b77564c36c95ed4b0cdec1a8af51692da75687b9af2fe2b2
MD5 b4431357fb9fba4a5e1e31a2db1257a6
SHA1 0f1d92187afb6c57a7625c6b46494ea915abff57
SHA512 2a5a52886cf990180dc22c74d9594911b8a78e9125d1630096051e3c2770de9b15ea60660743f5c222b8266160ee9dee70a195c31b8566bfb3403e9208951d46
TLSH
T1A7F02B18D5340D8762FAFA1B272A06099574901B86947C04778C196D8F8C21F56EE2C9
MD5 SHA1 SHA512 TLSH

Submit Download

storage.json

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json
Size 4KB
SHA256 3ce6d2f8958278ca354e0ca1c487603c2b4df085605b81da9e8787a5e3cadacb
MD5 4046fb9abad8042dbdd5f3b00632ef79
SHA1 4e4d4cc2dd5432e80b51c718f0babb7d758be8b0
SHA512 e03b7e35694aa6c729d31820994b6cb04eb925db0fbe9b23ca636de554755786e4699c457685f25ff2a7cba7ca1cc7c6c795d81a840f4572427544e013f6402e
SSDEEP 96:plSioMpK8vRwfwFgGbMPAjLk7rL/NLXpLSCyT9MY/4MCyb:7zo4K6BFXbMP6kbJtSCyT9MYZCyb
TLSH
T157A1BD19CD602D6B3295B4234D3C1203A625421B8F0E3E183B5C66AC9F1D26F19FE5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.json

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json
Size 4KB
SHA256 715c1dd827a19eb18b3d6d946a8222be651e6fe3b10ff919dbe17008d22fd3c3
MD5 86c4cf2b72a9cbbec29c033b357896af
SHA1 e63f4c44f875dc10d2c8c6867b048701726fc05c
SHA512 e6dfea2853074c8cbe403a67b263f34b5e38f9a7c7f862348df7ca5350173b5dd54babbb2ba8c50ddb294f716728183e49f98161c325c85d9e7f964cc4714b33
SSDEEP 96:plSioMpK8vRwfwFgGbMPAJRLk7JxL/JTLXJjLSCyT9MY/4MCyb:7zo4K6BFXbMPyk3RhSCyT9MYZCyb
TLSH
T1FCA1DE19C9602DBB3295B4334D3C1203A625421B4F0A3E1C7B5C67AC9F1D26F19FE5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.json

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json
Size 4KB
SHA256 91f007fa485cd9d68597ad12a4a2a71c1c734a7fdd93f8fdd0e4ffa14f7ed8cb
MD5 9e2bd07544a1241d9506af47fc2b8452
SHA1 b9dfd5c64b1160e4d7e4fb86054193ceb09febbc
SHA512 a2303d71324e9559c5354764cfc839f3e263a6b49dc953ba69bc1b75eb4382cefad7167a48485881edb0e45db3bae0dc7ac11e86e27c051191c04cc40bf23a16
SSDEEP 96:plSi0pI8vRwfwFgGbMPAjLk7rL/NLXpLSCyT9MY/4MCyb:7zgI6BFXbMP6kbJtSCyT9MYZCyb
TLSH
T114A1CD19CD602D7B3295B4334D3C1203A669421B8F0E3E183B5C67AC9F1D26F19BE5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.json

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json
Size 4KB
SHA256 828edc5201edb8f5cc8a71d2d1bd2ded3eb817c751da5b5a4d7af8f9f7eb4f2a
MD5 fd8a0c59f63a09ea02181cfd7026c1de
SHA1 4b86d9c3a8d63248c14def949973937b7d6c121e
SHA512 308024433042efe8204916f7f148840a5001dd215729c3ba94a3ba1a2eac17cee1679e6fed5bf10d289d94dcbeb6270cdadfa7247f9fa455dd9ba6ef31bc4a55
SSDEEP 96:plSiUWMhH8vRwfwFgGbMPAJnLk7JHL/J/LXJjLSCyb:7zUWq6BFXbMP0kBthSCyb
TLSH
T1AEA1BD18CC602DA77295B4334D381203A629861B8F4D3E1C7B5C67AC9F1D26F09FE5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.json

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json
Size 4KB
SHA256 6dafb001e71fb461377a6ff325313c469a48cf88e2b45911714289315ba77cf5
MD5 2cf46539916a285195fdc8b8aae541e6
SHA1 7b836d9191af5c39899427176e8dac56af3bd17b
SHA512 2ad96e1797a7404de0758073ed55215a971a2b5c7faff522ca758b58aca16fcef187d82b84b9b92a9068df4b986313fcde21965b19423290f0dab00dbaae020e
SSDEEP 96:plSiUWMpK8vRwfwFgGbMPAjLk7rL/NLXpLSCyT9MY/4MCyb:7zUW4K6BFXbMP6kbJtSCyT9MYZCyb
TLSH
T189B1BE19CD602D6B3296B4334D3C1203A625421B8F0E3E183B5C66AC9F1D26F19FE5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.json

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json
Size 4KB
SHA256 b3223260c88e32d4dadedd680ff2cf4cd0d70db7cd452354d5eeebe54027b735
MD5 cd3d3b9cc2ba6c4fe75b8780f529daca
SHA1 c81736f24aba53fd6a5df8ffa18f2d4097c64afd
SHA512 02b41a710313cc839d171c9d98227f3c676391465b12f5061eaaf57cd9f72a2c0ff4010c14f5e8264b4c8d9d619f94fcd513f33c0c5e5428c18201b7229c35c7
SSDEEP 96:plSi0pK8vRwfwFgGbMPAJRLk7JxL/JTLXJjLSCyT9MY/4MCyb:7zgK6BFXbMPyk3RhSCyT9MYZCyb
TLSH
T15EA1DE19CD602DBB3295B4334D3C1203A629421B4F0A3E1C7B5C67AC9F1D26F19FA5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.json

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json
Size 4KB
SHA256 873792ae985826992de62ed3745f5b7a037a445ac9097aafca465bce5da0c202
MD5 290741c9946360eb1af02f91becf6061
SHA1 f312d32699d519b93b100fdad33fc83510be981e
SHA512 a9e0df95cac7a5461018c82ceccf87b2707a1da6003dfb185293b484f44bb4ffeefaa90f38bbe8aaf50f4b81d61d16454d66707c2ea435203a38344b97d850f0
SSDEEP 96:plSiUWMhH8vRwfwFgGbMPAjLk7rL/NLXpLSCyT9MY/4MCyb:7zUWq6BFXbMP6kbJtSCyT9MYZCyb
TLSH
T18DA1AE18CD602D7B3296B4334D3D1203A625461B8F0E3E183B5C66AC9F1D26F19FE5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.json

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json
Size 4KB
SHA256 91dc3b28c5a0cb5595a6db9d081592129d7ff89d6d1ad36e9162d9cbcee84586
MD5 8a37c283e2bcefaa4963d5c1238bb747
SHA1 bd4be2239137cafa541c6c29c32e57da290399b7
SHA512 18589b0003b74ce991e16d60ba7555f20488c7ac02565f3170ddeca8aaf57b208139260190c1c8074c1fa43c2b9a7211f2deb81e1cbbc9502c42bd38f2e7f0dc
SSDEEP 96:plSi0pI8vRwfwFgGbMPiVjLk7u4L/NLX6LSCyT9MiF/4MCyb:7zgI6BFXbMPixkCCJUSCyT9MiFZCyb
TLSH
T141A1AE18CD602D7B3255B5334C3D1202A765521B8F0E3E183B5C67AC9F1D2AF19BE5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.json

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json
Size 4KB
SHA256 90e0271c25a65452ea3d038eb85e49877e5356192f8b5290d9759708db12b81f
MD5 58ee08cf21243733c6c4b2e4a125de3b
SHA1 5459ce41bde8d6da5f839f7161ad2ff23d8f2e6b
SHA512 b61d5663a108de653fcd942c18cd428847321f6fcf78eb241541d6300e2d1cd3f53fd6a4b619aa4571e119ddb50eac8377eed690cfe6152371f578329ae0d041
SSDEEP 96:plifaMhH8vRwfwFgGbMPAJnLk7JHL/J/LXJjLSCyb:7iCq6BFXbMP0kBthSCyb
TLSH
T16191BE28CD602DBB7295B4334D381613A629461B4F4E3E1C3B5C27AC9F1D26F09BE5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.json.vsctmp

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json.vsctmp
Size 3KB
SHA256 dec201c9144853832bb9ce1dcf401ba0cde46516cb85730cc571a55e349e75a3
MD5 16e6ecb4b0241bd85f2bc81e9273eada
SHA1 8044867183ef0c23facc363c5d575d38a563d73f
SHA512 ce7a9265533369ba7df4d4687c0d4c44e425732f509e7c8fb4817615e1c7e2bbd4eea79b9713ef57a5e3c06c60366719e2c2286cc80e87f3ed13e360c5b0c80d
TLSH
T1EF819C59CE643DEF3296A4338D391603E214412B4F4E3E183B6D26AC5F5C25F06BE5EA
MD5 SHA1 SHA512 TLSH

Submit Download

storage.json.vsctmp

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json.vsctmp
Size 4KB
SHA256 9c4b8dd76f562cd2ca860ca078bd9a89a46c88e2a5b903a43bb71c11f52375de
MD5 72f35266585288a7588f8599383640ec
SHA1 134d86cf17f484a67c24e1e7a3ec359b05a773c6
SHA512 b375f1a006ebcbf9a5c7ed6983b71a517f66a9bcdaeefe532107827fbc1f13d7eaae5dcdbdbe61e6bd1a35ee588888dca074dc847816227a1a381864e959c673
SSDEEP 96:plSi0pI8vRwfwFgGbMPP2ljLk7T6L//LXNSLSCyT9MP21/4MCyb:7zgI6BFXbMP+k8b9sSCyT9MUZCyb
TLSH
T185A1CC15CD612D7B7265B4334C3C1202A669421B8F0E3E183B5C63AC9F1D26F19BE5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.json.vsctmp

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json.vsctmp
Size 977B
SHA256 9a458b7199046d4abe74bd0d0d9abc0b8689b9847c485ed8f5a46aba1dcffdc0
MD5 124f5b5ee1689ccd2058da4b99d072a8
SHA1 69e8149471f4c6525c300eb468c8aff4ced30167
SHA512 168c1b95cd0d0f411a603d5fe8984881a6b09c64a6e2589067bafe046e4fe44165ba19adc48390319ab446ffe9193da2edc0b83dee19cd2826d2ef7f58d197b3
TLSH
T104118928D5740D87B5B6B926133E024E9674911B89E93C18778C165C9F8D10F5ABF2CA
MD5 SHA1 SHA512 TLSH

Submit Download

storage.json.vsctmp

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json.vsctmp
Size 4KB
SHA256 e69026a9646260fa73a11993335be3d009ec686804ba325e6444f5716b9deec4
MD5 6853759f4f4c8c73c7fba613ee18177f
SHA1 53e8738000e033afba5aef33e0bf16616aacd163
SHA512 25e506c53364618977320922ab2a761f81b2ae1739dc0272a04da64ee22c7bd7a6fa50be9729de338dc7da50e2b63157c49001eeeff55130f93327832d4d6fdb
SSDEEP 96:plSi0pI8vRwfwFgGbMPAJRLk7JxL/JTLXJjLSCyT9MY/4MCyb:7zgI6BFXbMPyk3RhSCyT9MYZCyb
TLSH
T172A1CE19C9602DBB3295B4334D3C1203A769421B4F0A3E1C7B5C67AC9F1D26F19FA5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.json.vsctmp

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json.vsctmp
Size 4KB
SHA256 ec199a83d20b62f520d3532bfed91b6431a9ef8be688d742ebd5172b29049717
MD5 737fa9f2780f7742e6ad79b542586b02
SHA1 541e8acea1c2bd31635366f92fec081ca0c68c8c
SHA512 7e660c0663e1518fcc1ddf39c925b1ec38be324f989f9171a45e3fc9b35e0d00463945abe904ffc6b93b3942b662d54af3e394a1e08b76332ea5e152baff2d86
SSDEEP 96:plSiUWMhH8vRwfwFgGbMPARLk7hL/PLXTLSCyT9MY/4MCyb:7zUWq6BFXbMPwkhr3SCyT9MYZCyb
TLSH
T1EEA1AE18CC602D7B3296B4334D3D1243A229411B8F0E3E183B5C66AC9F1D26F19BE5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

storage.json.vsctmp

Path C:\Users\Admin\AppData\Roaming\Code\User\globalStorage\storage.json.vsctmp
Size 3KB
SHA256 26ef0370672b339f440452a69610cd7c08b0418b244b7dfe51d3ab6cd2040781
MD5 294a708a6f74c73ffe487e4b4efba9c5
SHA1 b781a3a1db41d224cf5b698ccbd60dec6cb2cf28
SHA512 bc83d66767fd109df4e843f0c70800a852a8bae0a6ce25cbd3381e3faa6a99d005d3d4558ae1d1b2a3b833d5de924a3d55c41ca737d475c29c2f484ec3f78f3b
TLSH
T19481B114CD602DAB7259B4334D381613E619421B8F4D3E1C3B5C27AC9F0D25F09BE5DA
MD5 SHA1 SHA512 TLSH

Submit Download

state.vscdb.backup

Path C:\Users\Admin\AppData\Roaming\Code\User\workspaceStorage\1794532609564\state.vscdb.backup
Size 24KB
SHA256 ebf699d428ca29b2e2a498c772349a9ee8d98414a64566db715e491aea5f0d96
MD5 92e5cbe0d903eac1db44c24f7d69ea7b
SHA1 20eab30f61e20c317d887519743b009a8987be0b
SHA512 20d072245ad9c0482747d1b6e3d58bd4b0f6d913b7bfeef0d9c0f6eaa5ee6b7f4aa0f69f04b51727a24df3a6097ef81242c161cbae57bc4cb3b25396b12daf75
SSDEEP 192:Fd5BsSwPV9dKLcB34xdsn+jKf8mZhJPVxpvEw6:3DSPV9dKoB30dsn+jKf8kJPVxpb6
TLSH
T115B24309B8242DBBD19763B8B54D0E73163D2062FB071359A3BD493296DB3DD22B6837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.vscdb.backup

Path C:\Users\Admin\AppData\Roaming\Code\User\workspaceStorage\2ecfa27e11f7e84e2b9cb0de0c9db384\state.vscdb.backup
Size 24KB
SHA256 90992ee425c09245b3d838e60311198146fe3001b3e0aad5bd6c1329e82836b1
MD5 a773fd21a8a4e3295a66bb8c2bd86d20
SHA1 3dae1c1d38f61ec85ba327ea2bdee3d638b78e6c
SHA512 b5d97d713c7ad333912ac631c1721e7c38b4932b9588c96495bd17441253464b592827d1f771b3578458c7b243bcab1008e19d93f7a0e0a17452486642c069b1
SSDEEP 96:H1d5U0MAa9l9K9vNMZonjydnPJnjyX9K9uNCi/09BWhFMAh9UiQZZglYanleLaar:Vd5U0MA2K9v2ZPnMtK9uNSmMAWmYQGGM
TLSH
T1C8B2421AF815197BC1972375B58D2EB31A3D2432FF021319A3BC893595E72AD22B7837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.vscdb.backup

Path C:\Users\Admin\AppData\Roaming\Code\User\workspaceStorage\2ecfa27e11f7e84e2b9cb0de0c9db384\state.vscdb.backup
Size 28KB
SHA256 79baefa8320084be1bc5d3eeb79363e249eb3fbe89818d572e5990425b54d940
MD5 8785938d6261c4b1dba796f353a7f4fe
SHA1 47fc32b3e4b5b54d94bd19971d6df693e9159fa1
SHA512 cb6c550a8a9d693fe5aace99e1be936332e9f21b44d7ac183bb9c3d1962743af65453e525750eb97f2757d56dac4f857b75641725ce1edae888c98cb8a908fae
SSDEEP 192:2d580MA2K9Km2ZP48K9lUooM53VGlykYQMGqtm:CK0Z2K9248K9G0qXYQMfk
TLSH
T165D2501AF8150977C5976375B54C2EB31A7D2422FF021319E2FC892595F72AE22B3837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin.zip

Path C:\Users\Admin\AppData\Roaming\Code\agent-host\computer-use-plugin\0.1.97\win32-x64.tmp-QF6gMn\plugin.zip
Size 2.4MB
SHA256 6ebfb26420db67f3eaa2a9901240b731933a90060d291ab3197b5533296d0b0c
MD5 5b64459ebfddeec326345bfe84317803
SHA1 85742557efec16308e7ddc9e885709235f2d0ef4
SHA512 e42b8872f63feb175edbbc6e34d7d214c83e4c25e47abc97cafe7291c2dca87cb9cf173e9639172e2eda79e8946a8120f3e1a7c8265cac33487904da78e454dc
SSDEEP 49152:DnTi0TCGmabfW1QOuPlQGoQLab+HcRmY/8dV0Ix+3htpVYUb:DTi0WGmaa1QPQGo1b+8QY/8dV0aaHVtb
TLSH
T1C8C5334333105F9AB4B2378B698542CD6C05DF1A75D7ACCA89BA7E4B2D5B4B31E0AE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopilotComputerUse.exe

Path C:\Users\Admin\AppData\Roaming\Code\agent-host\computer-use-plugin\0.1.97\win32-x64.tmp-QF6gMn\plugin\CopilotComputerUse.exe
Size 3.2MB
SHA256 1e08639b8b9c078696382e7953ad9c60be7a9a9f434d4ec84d3c16d9015632f2
MD5 7369ad04ae347e04ccee72d04814fd39
SHA1 9d69364f63149a5b9b732fffb94dda29060a7e09
SHA512 739b22134108086341ed579d914356afec920c166bb3fdc89f0bc64cf9a8e6f0d4e98cc1678c54d609048b9f94b70396ce91e3c4f12c0c77473b802a606c62be
SSDEEP 49152:W/6WCvmWVeZPdYAG96jd5hY8wLrzkjs7Sckst:JB4jYJChckU
TLSH
T172F50711BA5B68ACD55AC874834A4A635E3130CB1B36B9FF44D895783FADAF41F3C218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

computer-use-mcp.exe

Path C:\Users\Admin\AppData\Roaming\Code\agent-host\computer-use-plugin\0.1.97\win32-x64.tmp-QF6gMn\plugin\computer-use-mcp.exe
Size 3.0MB
SHA256 bd788084bee151d3c70580c73b7efa135c36a7f17c398de03f6c529ec74c0140
MD5 5e77be8d91d405d8bf62f147441077b6
SHA1 0e79e24fdb446fc3655c6dee1e999c196df215dd
SHA512 db880d1befb6d84651c9a833552670a4d0dfacbf965092b459189a5c39929f3655700f3b78fb86e78ae1a1ff1dc60b6ea7ec72c8fa58e32ad349aca2f5e43b06
SSDEEP 49152:l4e4M4fj278TtEI2H3yzfCiu9Wgkw1yMG6KkqATxJtUnpjLZP5AeBNV0AzxWlJpU:l4Bj276lO/4Jv
TLSH
T123E508157A9A68ACC09AC47083068A725E3130CB1B36B9FF44D956753FBEAF45B3C319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mcp.json

Path C:\Users\Admin\AppData\Roaming\Code\agent-host\computer-use-plugin\0.1.97\win32-x64.tmp-QF6gMn\plugin\mcp.json
Size 240B
SHA256 e4312d9f55ea9027d415759d7bead87031da73a8f46b4fe374c6f5c5c10e7b87
MD5 1956ef1ba7508382622f57709f3c1dd9
SHA1 99a6d686bd5baa9c46ac25a808880260bbf9bb30
SHA512 2817d8dbdc4adf24a4f27bea2622370e4da6509b5c9fd7da7b817dc8b8b8fa87418e92be868b2f9b72f5224f61851968cdb1af117fd199443d9abba2829d648f
TLSH
T126D0A7F1E4950C9341C95291453C104192808A234AB6ED3AF75FA83CCF5C469027844C
MD5 SHA1 SHA512 TLSH

Submit Download

plugin.json

Path C:\Users\Admin\AppData\Roaming\Code\agent-host\computer-use-plugin\0.1.97\win32-x64.tmp-QF6gMn\plugin\plugin.json
Size 185B
SHA256 6de76c9301852083de69abda240b47f5cbfe14c8f34afe497a512dc519e59053
MD5 5151bd3cd78edb5a0b142663aa606e92
SHA1 2ea314645396d68846126dcdf3f5588197cb5c05
SHA512 098cf77d44fb6f0bc8ca439904391aabae9d36b9bf28afea5710ceeec747c561f5f6e8d2eb7662f076c1fc4f0ce74066b376a4b79a5271642cc862c1bf97a683
TLSH
T1FAC012F19C40053795CC42E55E6441D9B7A90F5E2FA1DB1ADA9FA528E4394F140B1509
MD5 SHA1 SHA512 TLSH

Submit Download

401b42c07c78bf6719b6474d0b741dcb8215444b81bca9981f6352832fb6cad2.json

Path C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries\401b42c07c78bf6719b6474d0b741dcb8215444b81bca9981f6352832fb6cad2.json
Size 331B
SHA256 236055d26dc116d849d5a65f89edc096c6228a0725987196eb634a384d0bac20
MD5 9408b44b6468c1b3dfc20360203c3146
SHA1 215ce363911a23963474edaf74cf99495ad859f3
SHA512 8cb5d4cfd6784b87ea02217c6a82d608318f8a0f480012c3a83cdb9e17c08f380bfcce89be1a09e1ac3810621d5b143b830894b6f6e253977f300fa812b97190
TLSH
T160E02682512999F335591B803404E407C36E2A18F1B34A6C95898890C35B4A8582770D
MD5 SHA1 SHA512 TLSH

Submit Download

83307e85d637d15ae9e5ab99eaba64292f619f7235cfaeeca0c9ebb6d020f33b.json

Path C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries\83307e85d637d15ae9e5ab99eaba64292f619f7235cfaeeca0c9ebb6d020f33b.json
Size 331B
SHA256 904a960c7b4aa24fa23ae0fe3d2157e425422578107fa12bfbb7a92e77d65191
MD5 d1383694554707dea66c1cdd7b92484a
SHA1 9bc818a908e7cd0317543b8e5408ea75ea25e36b
SHA512 b386f6fa4528e56a72d0e94fce232d9258f7a46ca4ddaec03112e3c06a6c7986fa5edfa1fd8856bab01c5f198b5a8e638510ae3d2ddfdf7b17c5bcd86a7f59fe
TLSH
T123E026538659AEA02B490BF43009A403D16D6E00D6A203989848C8E2C2AF45A2572B1D
MD5 SHA1 SHA512 TLSH

Submit Download

session.db

Path C:\Users\Admin\AppData\Roaming\Code\agentSessionData\3af17d77-5480-4a47-9831-cb53d6d82ad6\session.db
Size 136KB
SHA256 cfeefb4b81d8ca7bad25f967b9c84359ad2264c844041e507c6a277681513d40
MD5 b245ef132045415a1c38354232f0eca8
SHA1 ce10f3d14fc4cdfe0b5c8361a35294820c284666
SHA512 63f80167e8f10c814a01c41f80caa76532cbb4b84b276eda885d156d059bd59d3cbd4e229f48d908627637e1c392b74d5a244a9fd61cac1bc4e7aeec06e2ef1b
SSDEEP 192:fxy4LJZGtDqtgFFU4FCySxxy4LJBM+/IEIhFOFCMRjlAPmlxy4LJBM9Sc:fpXGhqKUaCPxpHM+LS4CalAelpHMEc
TLSH
T13AD354CEAF0D7B10CAA3E0B0D6E65D205C7C524F974C729635BC22959BCE6C1F239A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

languagepacks.json

Path C:\Users\Admin\AppData\Roaming\Code\languagepacks.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

machineid

Path C:\Users\Admin\AppData\Roaming\Code\machineid
Size 36B
SHA256 f170062b1f7d97fa37e059c195a91c82eca435c291ac432eca9a263e88990279
MD5 87f0552fd06778e96a2ffbe27751f0c7
SHA1 79438073b2c387a218d3b32e6b1101be3b7399b2
SHA512 bc720016d9b256fe36abf6e7b615108cbbea4b138aaa45b93a57984ac9171f8e30de9c6e71dff0ae0dbc094b112fb1e65dafe226bc173bee6b8e5f9a4565b2c8
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

1ced32d74a95c7bc.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1ced32d74a95c7bc.customDestinations-ms
Size 3KB
SHA256 9a0da24266c9c7ae35da3df1bcb720a59e9de50b49e0cb93eda48e3e6c478ff5
MD5 838b25090b7326e33872cee4ac76d32d
SHA1 0c5d033704ee10cf304b18ea27194fe32a27b0b4
SHA512 25a2e14e4b4b420bfa43ca2d9395ddc0e9781d1b085bd057941202247fd10c8ee0584070414063165c1779827eca0576cda97f787bc41a6a912f7cc2ffb08100
TLSH
T1DB814401E7F10715E3FB1DB509B27B15A5B2F89B5F0DA60E0004415A2EB2F80DDA57EB
MD5 SHA1 SHA512 TLSH

Submit Download

3AQNVTWKZNM53UX96L0Z.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3AQNVTWKZNM53UX96L0Z.temp
Size 5KB
SHA256 9bde2cacda0905d42130c358a34c6fe53614269d5313750c9848f2850915ffe9
MD5 39463aad60b4ee02c0a58f695e91dce9
SHA1 86a42b35074279229fb9e0fa00122e285c036277
SHA512 6b3e5c8e939fda385e0219419c66e18a002562cdfc13da5cfa81886e0748c04840c0d967aac51beb17cdec3411ec7b64dd209e6c414d97a8922ab89e2aa868e0
SSDEEP 96:U/L8ZLFLcq4MrW7/L8ZLFLwYoCd/L8ZLFLqp7c:Uz8ZLSJ7z8ZLdoCdz8ZLC7c
TLSH
T178B14400B7F10B01E3BB1DB519B26B05A5B3F99A6F0DA60F0044421B2E72F90DDA57EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

631O0K3X6PNMHPBZ4A7V.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\631O0K3X6PNMHPBZ4A7V.temp
Size 5KB
SHA256 bbf90ecadbf0e1fe146d01f35bcf9e161fdb4ebf82d225c98e0863cd58beb3b9
MD5 5ed4745418471d70224a68e0f05f6686
SHA1 b18fe4eb3291e46a3cb6be9974ba8c2abe05342f
SHA512 461595e8d72980b784c11820f2c242816b053158b02bcce453b6daeac8dae4728544958e3bb556ba73fde65784b40d0f8e30f69ccc1d51b99eea3c577c2422bf
SSDEEP 96:3X8ZLFLcq4MrW0X8ZLFLwYoCiX8ZLFLqp7c:H8ZLSJu8ZLdoCM8ZLC7c
TLSH
T106B16700B7F10B15E3BB1DB919B27B05A5B3F99A6F0DA70E0004415B5EB2B80DD957E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CDDWFM3SAWCDVQIO79AY.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CDDWFM3SAWCDVQIO79AY.temp
Size 3KB
SHA256 8024ce5733356cad5e5f7d9dcf611913a9529de3a605d92957c9a0ab191d2b12
MD5 68276752a326ff8272a188cf141d1109
SHA1 4e3eb1277ab31949e9fbe7123b5d2303d5f32185
SHA512 d28fd4c67877f0906efdb29749f718aa929294989511c311ec24566f457a66163632f8c62a73470485ac401961e0159bac3fbed5e02d1579f671ac369ea1a3ff
TLSH
T1BF813301E7F10715E3BB1DB509B26B15A6B2F89B5F0DA60E0004411A2EB2F80DDA57EB
MD5 SHA1 SHA512 TLSH

Submit Download

CE3XO5HA4ZXWMVW0WVJ5.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CE3XO5HA4ZXWMVW0WVJ5.temp
Size 3KB
SHA256 44842c358fc5f54c110355c751388446a455c65fb6e48eb42b0ae397cc63e898
MD5 56ea54e0c8be14ad679e5162c1b2ab73
SHA1 d6aac3959afcd4b0d59aa92cc03a5d7ac83d4e5d
SHA512 f7bbc6bd832e337e0197557933a20728f0c6c796490ce3782274f69e0e7aea91ccfbabadbd16ef0ded5c9920e34cd1d4c75683d72702a180ef20e7ce3f98e0fe
TLSH
T126814401E7F00715E3FB1DB509B27B15A5B2F89B5F0DA60E0044411A2EB2F80DDA57EB
MD5 SHA1 SHA512 TLSH

Submit Download

LDF8AKGEBKNU9FAB3885.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LDF8AKGEBKNU9FAB3885.temp
Size 3KB
SHA256 ab6372370fc1e43abdec0e6ef5ca2d4a74e207ee8a0fede6536a4803044deb87
MD5 8e82eb8925d15d4d753ae1e88e0325cd
SHA1 aae2794c3a2933a1b413dc4776b505ae89bc8d2e
SHA512 67cdf0871fbfddd2a03d1520ff13ef3958d3d38ca6b94c01f380837463764bdfc39d24b787cc52bb46a65300bbcb19795312aaaac3447e9eafe7ee5abfd16663
TLSH
T1C4814401E7F00715E3FB1DB519B27B15A5B2F89B5F0DA60E0044411A2EB2F80DDA57EB
MD5 SHA1 SHA512 TLSH

Submit Download

NXU9IZ76Z1546K9NDNQF.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NXU9IZ76Z1546K9NDNQF.temp
Size 5KB
SHA256 9f28ce1bc01b12c1c0978b05e94be5d8f6dd613f8fd9f551240a29dd2267e130
MD5 949db39fe38f2f6e4ed041e497f1b5ea
SHA1 6bd79ea74b0f344f6389f5646062c73f3f423f5d
SHA512 33c8b2c1c26a5f6188644cb7e556c54d72d945bf2d0d29bd5a8f7894998087b25a936a142b76e80746c85f506224fc06255a141f1355cad590d8ddc9072bf660
SSDEEP 96:0WL8ZLFLcq4MrWLWL8ZLFLwYoC1WL8ZLFLqp7c:vL8ZLSJiL8ZLdoCcL8ZLC7c
TLSH
T13DB15600B7F50B01E3BB1DB919B26B09A5B3F99A5F0DA70E0044411B2E72B90DDE57EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PAXIH519UJQDDJ8XQ5XA.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PAXIH519UJQDDJ8XQ5XA.temp
Size 3KB
SHA256 e7cd28121be1c5ec41c673d31befb9ed90603edf76de471ada4793ff9a9b989d
MD5 c0775cfa9a399e6dec36fe70f3f9854f
SHA1 7e503fbc17fbc11f50778eb02a8f1b294ca26155
SHA512 5c1279872de5882049ccbed20caab274345258145e365537cff0044e138eeeb7ad81962dcf9e73dca9311ca9cef241016cf77b8a4535b66f167639ea91b18644
TLSH
T1C6813301E7F00715E3BB1DB509B26F15A5B2F89B5F0DA60E0004411A2EB2F80DDA57EB
MD5 SHA1 SHA512 TLSH

Submit Download

ZJ6VECSZTSDGHMPFXCGW.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZJ6VECSZTSDGHMPFXCGW.temp
Size 3KB
SHA256 1c635aa1f98af7cb83c8f8cede4c8f3cc9770a8bde7045ef9bed48625aebaf3d
MD5 31fcc05dc07d89cbca9f16fa61d8584e
SHA1 92f8d8c314f3743b38599ab674bbef65169a0a55
SHA512 8899e0dfed1abc271eddcbf98b346366ae86ae7c17105eec409764809218c20739b3137e244903f6d19e99ecd794e7f9f68da26cfbd7d686d57aa53ffa25aadd
TLSH
T187813301E7F00715E3BB1DB509B26B15A5B2F89B5F0DA60E0004411A2EB2F80DDA57EB
MD5 SHA1 SHA512 TLSH

Submit Download

40a05d61-958c-4737-9783-232f2df72481.tmp

Path C:\Users\Admin\Downloads\40a05d61-958c-4737-9783-232f2df72481.tmp
Size 9KB
SHA256 4ffb6c63731f4398d2c7b2585792db4571838c1b852c88b61ef6d0837113fdf2
MD5 0d0b6f3a10cb28f477bfc1025732203c
SHA1 7ff4956d8e5e15cda8a2bfdbffead5990b6c2709
SHA512 cf6f66974813acb25b20dd23fb93fd04ca1bd245d4d5d7d2e6af38b5fa0a0feda2100496bb0068a63ec8f08cb9ea4072107546778ccb0b4f9769cde5a502a61a
SSDEEP 192:ndcAuo39NYCqZI0rQuELeJPZMQ+H9+TmsxEK:dPYjbrQLL+RFmsxEK
TLSH
T1DA127457B30BF5BBC82E477200F655A5793B017032179E3389E480B90E960916E2BBCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobRunFreeMI5.rar.crdownload

Path C:\Users\Admin\Downloads\RobRunFreeMI5.rar.crdownload
Size 864KB
SHA256 22fe28709a618d9d8ae657347e122591391dac0333ae1d6dae76253ebfe050c4
MD5 f462702302d37913c77cc4f0dd992ac0
SHA1 2373b0361cccfd43e2a1be310e06f8d527c6f154
SHA512 974fbaa715fae42a3077747150f419ba0e606c33aec8b9de9975837cf0ccb44e6024d2ded70288a20847d4e58400624f5c855237f9bc85d27a99f2138277c1f2
SSDEEP 24576:Z1zGBw5zJ2IyZQMc/DH6b7Yc+E3DqIAYAYQ+KoU2hsK:ZM8zJ2IyZQJVc+E3Dq2AV+KoUQ
TLSH
T1571533E7677F468C88E6DA95EDF42CCB0BC016A47991B34B9112883477E4CAC07BE578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8f8730c-9186-4332-8f99-a76fd21484d2.tmp

Path C:\Users\Admin\Downloads\f8f8730c-9186-4332-8f99-a76fd21484d2.tmp
Size 13KB
SHA256 070781522e69a928591168af55b7327277ca724d1c8f39a3d72164859301290d
MD5 d78ab01771ed84476160a4f51ad8b8db
SHA1 00711f83dfcd8785b99e8d01290fdc7c8021e59f
SHA512 14e92efb8007cf4918680bd22602f92445215cbf864468d48fcdb90345baf8720ce61109123f4f3c0b7e6cb956a1a474b702ce091bcc9eedc72c897596b266fb
SSDEEP 384:KlvMSUG05lrV3WDJRNOB8L1XGKlubFbZ8M:KpMNG07rFWDjQBs1udZ7
TLSH
T13E52C09E5B4E4A0144EC174304FF045B1524CAE967D374EFE3CF831092DAE96ADE95C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/544-1050-0x00000283FDC20000-0x00000283FDD0D000-memory.dmp

Download

memory/544-1849-0x00000283FDC20000-0x00000283FDD0D000-memory.dmp

Download

memory/548-628-0x0000000007510000-0x00000000075B3000-memory.dmp

Download

memory/548-618-0x00000000074A0000-0x00000000074D2000-memory.dmp

Download

memory/548-627-0x0000000007480000-0x000000000749E000-memory.dmp

Download

memory/548-630-0x0000000007860000-0x000000000788A000-memory.dmp

Download

memory/548-617-0x0000000006620000-0x000000000666C000-memory.dmp

Download

memory/548-629-0x00000000076D0000-0x00000000076DA000-memory.dmp

Download

memory/548-632-0x000000006F280000-0x000000006F5D4000-memory.dmp

Download

memory/548-619-0x000000006EF10000-0x000000006EF5C000-memory.dmp

Download

memory/548-631-0x0000000007890000-0x00000000078B4000-memory.dmp

Download

memory/548-608-0x0000000005C80000-0x0000000005FD4000-memory.dmp

Download

memory/1868-1438-0x0000019DA0370000-0x0000019DA045D000-memory.dmp

Download

memory/2244-541-0x0000000000120000-0x00000000001FC000-memory.dmp

Download

memory/2244-557-0x0000000000120000-0x00000000001FC000-memory.dmp

Download

memory/2244-540-0x00000000001D5000-0x00000000001D6000-memory.dmp

Download

memory/2244-761-0x0000000000120000-0x00000000001FC000-memory.dmp

Download

memory/2584-573-0x0000000005630000-0x0000000005984000-memory.dmp

Download

memory/2584-566-0x00000000055C0000-0x0000000005626000-memory.dmp

Download

memory/2584-580-0x0000000007450000-0x00000000079F4000-memory.dmp

Download

memory/2584-579-0x0000000006170000-0x0000000006192000-memory.dmp

Download

memory/2584-578-0x0000000006120000-0x000000000613A000-memory.dmp

Download

memory/2584-577-0x00000000061A0000-0x0000000006236000-memory.dmp

Download

memory/2584-562-0x0000000002630000-0x0000000002666000-memory.dmp

Download

memory/2584-563-0x0000000004CF0000-0x0000000005318000-memory.dmp

Download

memory/2584-576-0x0000000005FD0000-0x000000000601C000-memory.dmp

Download

memory/2584-575-0x0000000005C30000-0x0000000005C4E000-memory.dmp

Download

memory/2584-581-0x0000000008080000-0x00000000086FA000-memory.dmp

Download

memory/2584-565-0x0000000005550000-0x00000000055B6000-memory.dmp

Download

memory/2584-564-0x0000000004C70000-0x0000000004C92000-memory.dmp

Download

memory/3040-682-0x00007FFE38040000-0x00007FFE38041000-memory.dmp

Download

memory/3040-681-0x00007FFE37E30000-0x00007FFE37E31000-memory.dmp

Download

memory/4580-598-0x00000000008D0000-0x0000000000C33000-memory.dmp

Download

memory/4580-636-0x00000000008D0000-0x0000000000C33000-memory.dmp

Download

memory/4580-756-0x00000000008D0000-0x0000000000C33000-memory.dmp

Download

memory/4580-558-0x00000000008D0000-0x0000000000C33000-memory.dmp

Download

memory/4580-603-0x00000000008D0000-0x0000000000C33000-memory.dmp

Download

memory/4580-585-0x00000000008D0000-0x0000000000C33000-memory.dmp

Download

memory/5784-1724-0x000001F6B6740000-0x000001F6B6741000-memory.dmp

Download

memory/5784-1726-0x000001F6B6740000-0x000001F6B6741000-memory.dmp

Download

memory/5784-1725-0x000001F6B6740000-0x000001F6B6741000-memory.dmp

Download

memory/5784-1718-0x000001F6B6740000-0x000001F6B6741000-memory.dmp

Download

memory/5784-1719-0x000001F6B6740000-0x000001F6B6741000-memory.dmp

Download

memory/5784-1720-0x000001F6B6740000-0x000001F6B6741000-memory.dmp

Download

memory/5784-1730-0x000001F6B6740000-0x000001F6B6741000-memory.dmp

Download

memory/5784-1729-0x000001F6B6740000-0x000001F6B6741000-memory.dmp

Download

memory/5784-1728-0x000001F6B6740000-0x000001F6B6741000-memory.dmp

Download

memory/5784-1727-0x000001F6B6740000-0x000001F6B6741000-memory.dmp

Download

memory/6308-1352-0x0000023CA2140000-0x0000023CA222D000-memory.dmp

Download

memory/6872-1392-0x00000280FDB40000-0x00000280FDC2D000-memory.dmp

Download

memory/6904-2600-0x00000141A2DA0000-0x00000141A2DA1000-memory.dmp

Download

memory/6904-2597-0x00000141A2DA0000-0x00000141A2DA1000-memory.dmp

Download

memory/6904-2596-0x00000141A2DA0000-0x00000141A2DA1000-memory.dmp

Download

memory/6904-2595-0x00000141A2DA0000-0x00000141A2DA1000-memory.dmp

Download

memory/6904-2604-0x00000141A2DA0000-0x00000141A2DA1000-memory.dmp

Download

memory/6904-2603-0x00000141A2DA0000-0x00000141A2DA1000-memory.dmp

Download

memory/6904-2602-0x00000141A2DA0000-0x00000141A2DA1000-memory.dmp

Download

memory/6904-2601-0x00000141A2DA0000-0x00000141A2DA1000-memory.dmp

Download

memory/6904-2599-0x00000141A2DA0000-0x00000141A2DA1000-memory.dmp

Download

memory/6940-1306-0x000001F6FE190000-0x000001F6FE27D000-memory.dmp

Download