hxxps://cdn[.]discordapp[.]com/attachments/1203745491347574884/1203749369744986132/NinjaGram_PTO[.]rar?ex=65d239f6&is=65bfc4f6&hm=923f41b2fe22e62f933093349e919e6754eff05244f15754f5c75d0c4ac8b3ee&

Analysis

max time kernel
176s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-de
resource tags

arch:x64arch:x86image:win10v2004-20231215-delocale:de-deos:windows10-2004-x64systemwindows
submitted
04/02/2024, 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1203745491347574884/1203749369744986132/NinjaGram_PTO.rar?ex=65d239f6&is=65bfc4f6&hm=923f41b2fe22e62f933093349e919e6754eff05244f15754f5c75d0c4ac8b3ee&

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4440	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe

Loads dropped DLL 30 IoCs

pid	Process
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	NinjaGram_PTO.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	NinjaGram_PTO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\NinjaGram_PTO.rar:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4388	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2720	firefox.exe
Token: SeDebugPrivilege	2720	firefox.exe
Token: SeDebugPrivilege	2720	firefox.exe
Token: SeRestorePrivilege	4416	7zFM.exe
Token: 35	4416	7zFM.exe
Token: SeSecurityPrivilege	4416	7zFM.exe
Token: SeDebugPrivilege	4440	NinjaGram_PTO.exe
Token: SeDebugPrivilege	4388	taskmgr.exe
Token: SeSystemProfilePrivilege	4388	taskmgr.exe
Token: SeCreateGlobalPrivilege	4388	taskmgr.exe
Token: SeDebugPrivilege	2720	firefox.exe
Token: SeDebugPrivilege	2720	firefox.exe
Token: SeDebugPrivilege	2720	firefox.exe
Token: 33	4388	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4388	taskmgr.exe
Token: SeDebugPrivilege	2960	NinjaGram_PTO.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2720	firefox.exe
2720	firefox.exe
2720	firefox.exe
2720	firefox.exe
4416	7zFM.exe
4416	7zFM.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2720	firefox.exe
2720	firefox.exe
2720	firefox.exe
4440	NinjaGram_PTO.exe
4440	NinjaGram_PTO.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
4388	taskmgr.exe
2960	NinjaGram_PTO.exe
2960	NinjaGram_PTO.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2720	firefox.exe
2720	firefox.exe
2720	firefox.exe
2720	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 2720	524	firefox.exe	29
PID 524 wrote to memory of 2720	524	firefox.exe	29
PID 524 wrote to memory of 2720	524	firefox.exe	29
PID 524 wrote to memory of 2720	524	firefox.exe	29
PID 524 wrote to memory of 2720	524	firefox.exe	29
PID 524 wrote to memory of 2720	524	firefox.exe	29
PID 524 wrote to memory of 2720	524	firefox.exe	29
PID 524 wrote to memory of 2720	524	firefox.exe	29
PID 524 wrote to memory of 2720	524	firefox.exe	29
PID 524 wrote to memory of 2720	524	firefox.exe	29
PID 524 wrote to memory of 2720	524	firefox.exe	29
PID 2720 wrote to memory of 348	2720	firefox.exe	85
PID 2720 wrote to memory of 348	2720	firefox.exe	85
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2796	2720	firefox.exe	86
PID 2720 wrote to memory of 2528	2720	firefox.exe	87
PID 2720 wrote to memory of 2528	2720	firefox.exe	87
PID 2720 wrote to memory of 2528	2720	firefox.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://cdn.discordapp.com/attachments/1203745491347574884/1203749369744986132/NinjaGram_PTO.rar?ex=65d239f6&is=65bfc4f6&hm=923f41b2fe22e62f933093349e919e6754eff05244f15754f5c75d0c4ac8b3ee&"
1⤵
- Suspicious use of WriteProcessMemory
PID:524
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://cdn.discordapp.com/attachments/1203745491347574884/1203749369744986132/NinjaGram_PTO.rar?ex=65d239f6&is=65bfc4f6&hm=923f41b2fe22e62f933093349e919e6754eff05244f15754f5c75d0c4ac8b3ee&
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.0.168504998\482636180" -parentBuildID 20221007134813 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {01cd9779-f95c-41a4-9123-9c07795e9e76} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 1960 16c392bca58 gpu
    3⤵
    PID:348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.1.2115670538\262633987" -parentBuildID 20221007134813 -prefsHandle 2372 -prefMapHandle 2368 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81d0c6ec-2926-4fb0-8256-5e54374a1570} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 2384 16c391e4858 socket
    3⤵
    PID:2796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.2.530421175\116411423" -childID 1 -isForBrowser -prefsHandle 3000 -prefMapHandle 3016 -prefsLen 21603 -prefMapSize 233444 -jsInitHandle 1116 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84ddb577-80cc-4801-a2cb-9b128fb2f237} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 2988 16c3d3f3b58 tab
    3⤵
    PID:2528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.3.350586050\810137088" -childID 2 -isForBrowser -prefsHandle 4072 -prefMapHandle 4068 -prefsLen 26001 -prefMapSize 233444 -jsInitHandle 1116 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d69950e4-d69d-4522-a243-48e10a44233b} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 4080 16c2ca6de58 tab
    3⤵
    PID:4952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.5.1992002616\26194345" -childID 4 -isForBrowser -prefsHandle 4676 -prefMapHandle 4528 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1116 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0d4e771-c404-42ef-a100-a335497a695a} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 4724 16c3f644b58 tab
    3⤵
    PID:2264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.6.1464345344\1653770947" -childID 5 -isForBrowser -prefsHandle 4976 -prefMapHandle 4972 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1116 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8757b339-69d6-4ecf-b70a-8c1c191219f9} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 4728 16c3d74a558 tab
    3⤵
    PID:4176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.4.219469818\672120907" -childID 3 -isForBrowser -prefsHandle 4376 -prefMapHandle 4560 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1116 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7d05319-75f7-46c6-aadb-cd88e5a18d71} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 4328 16c3d3f1d58 tab
    3⤵
    PID:4968

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\NinjaGram_PTO.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4416

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2040

C:\Users\Admin\Desktop\NinjaGram_PTO\NinjaGram_PTO.exe
"C:\Users\Admin\Desktop\NinjaGram_PTO\NinjaGram_PTO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4440

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4388

C:\Users\Admin\Desktop\NinjaGram_PTO\NinjaGram_PTO.exe
"C:\Users\Admin\Desktop\NinjaGram_PTO\NinjaGram_PTO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:2960

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\NinjaGram\customstringsEN.resx

Filesize
26KB

MD5
c6ab9b5583ef1bec0d85afb49623b6ab

SHA1
89217decb0cceaa6e0de2a715dec8ff34299a501

SHA256
75bd63a0b2c3c46876f1c24f5eb530205d47afa40695da7ce72b24afae02d2b1

SHA512
7801c47e00adbf119bd31c1499b067a83e4521453611843a868b3002e85bacae5330596c5aa98d8ba837fa0cc8e2a9cc5c2cd73523358d519798fcc2ea6d775b

Download Submit
C:\ProgramData\NinjaGram\customstringsES.resx

Filesize
25KB

MD5
76ce21787d9cc8c78bbc3ba29cc6763a

SHA1
c9a5cb01fe8abf22dc3283deb26316aa6f3b011a

SHA256
96145d666bcdfe44725dc33700d895becd9a2734a3694892cfdce444529470e5

SHA512
e2ddc14426415235eae073b0ecafedf471bda473c7fea512b3b066fb725eb060ca75b935f3c82c6711a6d2272914d3b92bf0b1752da2d4e6a8466086f94f0750

Download Submit
C:\ProgramData\NinjaGram\errors\log.txt

Filesize
29B

MD5
119a1c728848a418df249165ccdc090f

SHA1
5879d287d843842a529cb63656de48ac04b36eea

SHA256
3d334727b9ae12c218c3eda2b4e372a9852ce2fe526b3ec9a2667af8e5a36988

SHA512
02dc86e2dbf68d3635ed7c753765ba53c597be617fb79488045aa4e4214bf4496795b7cdedd8697d77104651b7f0cdbc71c9f9d170eeb55557d8d81c2de8bc85

Download Submit
C:\Users\Admin\AppData\Local\NinjaGram\NinjaGram_PTO.exe_Url_00nkvfcovxk3j5gq0timf0mlo4zppgld\7.7.0.9\user.config

Filesize
644B

MD5
9ec2d4fb64194ff1462b4bf6a046e868

SHA1
388b9cba14e6382a01ddca77a8dbb66b103906ce

SHA256
674aa778616662c1f0a1682debb5982ac0188cbf7a625f7feeb087242f377697

SHA512
6d2dd4d027528b369f2accde704b9962ab09ae58132ccac85ea787efffe4773d542089ff188922fc3df7c7f0d74d24d3b630b234d2de365c4e60a7abc1e17ada

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE0419E348\NinjaGram_PTO\es\frmAddComment.es.resx

Filesize
153KB

MD5
9fb05e1af87857e2848b49ecb04ee193

SHA1
30dcc9c62137d0aa433b2240dcec298413da01f7

SHA256
0b8a460f0b587cc864ce9738c0bd34b3471f016e95c07b77ff9810b7d54fea5d

SHA512
9f5de640569e397ab3fdf6f96e646204b83edaa84c476d8c9f24ff3140f8fb48707fc4c042638a5ba50bdecfb71d2848bd7d62c26abec7a0d7c9f88b05963cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\evbF3A.tmp

Filesize
1KB

MD5
545883d1506948ff5a436adab704ac2e

SHA1
b83fa93e99d9ff126254b37f6d16f69b49c51343

SHA256
2297059d26f19817bf0b7728325fd8ed338c3130b6d14b61e20154ea63aae3f1

SHA512
03d0c48db33647225ad5376c4a2c8f96a33fa24c349b1ba2f1324f6ca6f1e20d4d0cb9c5ab625df720feb99776dc9a944dee5547b3de39ab369eb3c4ca4c3037

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\datareporting\glean\db\data.safe.bin

Filesize
3KB

MD5
73846b28abe6fb74713fa173c63f1fc3

SHA1
48c009712adadd7f67123e8cab8d2d2ae3d6787b

SHA256
7857887dcdf5f9a4c82c002084b69dadf41b71bc5abfdf0c04d18445313b1f6c

SHA512
88d7230313ea0f8d9d92e6bb6a65d03852f32e31fe3c2cee4427a783bd527fdee72deec33a1c838070cb08af2a638181cd006561a51d254a51c4f3636acb0d2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
f99b36a94f5ef7a24cfe99bcdff5395f

SHA1
6e6058712722387fcc3ef998a379fe5b4f625c23

SHA256
78d824e59d91c380ade3bddfc699f6a51e0753eacedfbcecdbc8df98ef6da182

SHA512
b065c4ab07d9d48cac8d893f0b4ce915477ee6019bc09ab4b3c7ef1eb61b79807a25a3a01b397b0ebb557f09c06a81e25bfd6b8298d16c6436fce458bd1450d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\datareporting\glean\pending_pings\3039db1a-ac63-449d-9e66-67dccd08ad53

Filesize
11KB

MD5
5dd581f343fa3c10e7e231c40a235354

SHA1
01d9b9ea7863b05ff9f6523e212f1c8f9a091f69

SHA256
db2c637f5be35f5f10207e0a010201a22164bf47a02e3e6e3d61b089df9436dd

SHA512
ec0a532ba017d3b072e87283c8cf42b5807401e30b4ad9b1396cf5db3496d516f4205be3aaad73221724d102ec7162c6116150e353bde1075b298d552b31dcf2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\datareporting\glean\pending_pings\729bc405-558a-4e3f-9374-b7493fbff904

Filesize
746B

MD5
92f73323dd060008b60387de72ea9d31

SHA1
58a19f9759949e8d93ebd30fa717250c8bbfe311

SHA256
adc33a1a90f5132095026dd2f22f69ab99b4ac657a5bbac2a72a24ea84867c24

SHA512
0c662c6a8a45c767936973fdb364bb2a9468db833a5cf6fbbcb1e64dccf6861e528dfad2e10f67f73bc233e2ac34c5277e150244bf094bf183e8219dfa787daa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\prefs-1.js

Filesize
6KB

MD5
f1bc073bfa4794bbfd2d3abe692609f6

SHA1
92fe4d2c755f287ac40f1468990555b6d23c4f95

SHA256
2d743870be68751c9bba21bd3d958675365340a11434f6c3e72bce8a5e948ddd

SHA512
06a20d1f54ee940b4f4ffa78ce3f562a7e13b1de3319d275ff0ca9018b6627d46135abe2d59cde32e2762b423146d0a9c0a37b8c9e2637e14872b8732633899e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
64f5496d30256a79dbd7f3a55e8e0c4b

SHA1
a8453d9cac041d308d1e36c39e579efdb33c7acb

SHA256
b579be079cf812fe469c70d21ec284dff814e913a6657cbe4ea45579c16897f1

SHA512
fea1387d8528b9cbccc88962ea6c5260dda768c56cbe8fc7da74d9009d6f655085593016b25dd1c200684a576c5d55b51a805e9a6faa1cc40d55e880a71aa6f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
5f456b351c1b4801891cec8733113abb

SHA1
709a276ba417026c02d4d767cde1aa49e2121249

SHA256
1658c97bb69272d82cfdd334da4fdb37f1e2b5f1620aa4370ac632efe406dc2d

SHA512
f9135a44fa9df83c0688c91e1adaf43fab8139fcd0c121ccfa8075c051e9dae5a11117bc3edbefc8271e51a3429c040256893639c36a031738cdfef8f22ae951

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
6d96f5fce3fb0bed0bb03b1d40242ffc

SHA1
59d1951a9f1e19271cb3b5e1fa802d81af673464

SHA256
e9234c30760123aea0a6d1594c73987398c5067eea99e229e9cdda3043fe684e

SHA512
0a5242f2667fcaa6db1674377664c46332f5907a062317cf7fcca023ed2079ff9a44ca515e236be69b34020c4de7e6db9c23916b5a0a006e6274a822866df744

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\EO.Base.dll

Filesize
1.5MB

MD5
97466526d815b79f7c52332f59602453

SHA1
53789134e48021b87919ab1635385e33631831cc

SHA256
3b15b2205d61f712405ad30d71a25be8bb8cf7dbb0ee80f56869542841155119

SHA512
d7a17ae0f267e2dff44670f85c163deb14b9c6fd590f8501ef6fd205b419678f35cf0a8921b72572252a74d30724a8f30fc30aa1c2452e3d8dc27f71612813b9

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\EO.Base.dll

Filesize
2.2MB

MD5
453ecc9fe7a0c5a18ee250d5d95c2993

SHA1
b5a31932d8fab51240e5717be45734ebb0182303

SHA256
35d6362dd87559f66c5f93e0707e80181ee6dcb1b0fe1e6fd22f8bda3619c8de

SHA512
a7eba600f7d974562eecfc3cba3c577838f99bce2745dd9a3a25a5b9857120a154e904b1bbabfd020d98ac5c6deafb6b74eeb0b5ad1cfd7cea56ff72ef763877

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\EO.Base.dll

Filesize
1.4MB

MD5
a1a57da615166944c5a5157a40fe184b

SHA1
044e793564499095d14b9772314ee1b31e489ec3

SHA256
2e1661b85e00b3a14622cf2517efcaa8c32789ee549d2d893cac559e3a93e2b9

SHA512
f131393a1eae9747dea780f00cb0a10350c78f6c5fee1accdc67e0577bdc2be24af501c219ad309bfb704eb8336b22e29255cbab101a9f65d34406879648ddd8

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\EO.Base.dll

Filesize
3.3MB

MD5
57a1b94cc1c7fc9f063a56c51decf6d5

SHA1
fe8b4a6d8485af9ebffdb926cb1df15dbe9d47c9

SHA256
f7a7dd2f7dec6776806b62cda14994a261f2bee91b3dc47095043dc80b6d1e68

SHA512
99199980b3be3a405d2d46f573c52fbbfe03a2aa7f54b3144a8c723998e938a67d86ee98bfdcc25442e7591efcd510968a47b94a82f439f832a534669dd2f18f

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\EO.Base.dll

Filesize
3.4MB

MD5
07ab67e7607168cec8f4db491b55db31

SHA1
d28e89a2c1390c24059992a7f8a724b61f335f74

SHA256
de81a13f43eb7b7085a0ed5a5d2e634b98f76b02726a90d3c23cb34333f492d8

SHA512
fee5702839050debb8718095535a9753ca77b488fb5ac7a3d78f9ba0183e264f8f6b97ac221e888d1bbeb64aa744adf995dc9efd31f57b3f0988c16dbd4b92fc

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\EO.WebBrowser.dll

Filesize
226KB

MD5
5a993c3a2df3fe8824f169c7612ae81b

SHA1
ba4eed3c938ff2dcb455b89f9cfc61cf630a5bd2

SHA256
a468ee8dc6b2f5d347fb7d402b64c186a34539759cf2f381e5a8a62525df7bc2

SHA512
b6bfc981308419ced269d1fecd99115833271183b0e163e7178bbc5b7feff87a98f13d1633cc1b275f413f7bf2748f791f70cb888d13a4532a02df53f6529e71

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\Gibraltar.Agent.dll

Filesize
1.3MB

MD5
30f8eb6fdaeff6460000f90064c8d8f8

SHA1
1244fffff85a1878d12f290635cfddeb154cc89c

SHA256
5eae0bd049e9c63fe82d6fdc70214cb4c13c69ae5920fb4429719b0a1d3c38d6

SHA512
76621d569eb729e7e16ba08429c2788d89c75adec99d5616abf6f71223298895cf9334c2942a1fbd84b52380b0a7c127e97cf32ec95ee4e242299eef06323fd2

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\Gibraltar.Agent.dll

Filesize
1.2MB

MD5
591f9cdb5bd0a4f4d995c2857f3ad666

SHA1
0626ea08366df04b45d9abd8e28a4f7f850ab4f2

SHA256
807094680669bac8249b3cf47f9282c74302c55249650e505de72ba9371593ff

SHA512
9c8c4f9cdd65e908026401453d22d323dfea595a253e6dacad3bd11c1a7bf91415014d0ea8c8848f74f0aad5c83f03c62c72008ac4916273d29950d4c9d5d9e8

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\Gibraltar.Agent.dll

Filesize
955KB

MD5
77f0553945975d6f71af99f731aa20a9

SHA1
5bc7bccbd24cc1b16499ffaf5a8613eac9baa1d1

SHA256
5a904f2bcabe14c9960a1bbaf2f297d3a71d822763e3dc902a1ca139c31cafd1

SHA512
21745293ba86a72fb2ffba4a16698df9ca31fae5b125425febf739241e0104c222441d3ac2904df7d14c65920a86ea8891fe803156ff0579ba8eb4185773b57c

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\Gibraltar.Agent.dll

Filesize
3.4MB

MD5
e587d98467d6b5c7d9f3a39e0e00c708

SHA1
a5ad7dc2fbdcb75b17dfd6354fb6922fd8f009bb

SHA256
b7603ddfc09fb49d18a177af34a7781a09a5756114a5f3bf9536d1834d01ef98

SHA512
1307922516c0411b03cd6f7eb096112b4ee7fc5a77522031859f278a8c7d7f6a8ba7b0b0f0a5456f383e9c39e980d58f08c49fca12156e47aa4cf6b26e0880fa

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\Nevron.Presentation.dll

Filesize
4.6MB

MD5
0ff88424da16ca7847cca1d7b4c90455

SHA1
96b29f8f21197e58944fcdc07013ab5b1b941dc3

SHA256
90f850a1a1eca8a8bb5c485385544e7d6cea7c0540972563eccbef5209d02c10

SHA512
c0e0a23aa865731f8870116da10c7e9f0ef05651c3fc5015dfba14f56e1107d2c5571c5e0244029048a1aaf41f4fbc11d21ff68cb16cda4ea46b9aa61166376b

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\Nevron.Presentation.dll

Filesize
4.0MB

MD5
94343d06039f03387e5914f2904bfeda

SHA1
480127478a863dc5b955634d5ef079e7545ca106

SHA256
fe248c27c1b0cdaa4a85ee5c902b362c1e1f005a535540333dfb23a1c74a7cfd

SHA512
12fc1ffe03f9060196dc6a63c622d4ad94abd5c8456f43296b324bb0828e66aae3b59d9f9cbc599f3aa4f5ff8f1e0bf3b54c686c9d6fc3642a01509b6b819f00

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\Nevron.Presentation.dll

Filesize
2.6MB

MD5
11e7962d5b73b98787aca3f2c3eaa1a7

SHA1
721d5d79054f06c4693b4de637ab86b7a963c619

SHA256
09043dae084eb734927468dfedc293fef5a44453218c1b3cd89b0a19fd1a0c61

SHA512
ba7857c22f4e7f4c95b5147a21a7cf7b7cf21740c765d6383cfc48f0c13c926e1a186c5e1eb500d7d6eeb0fc566eecef024040c30b35d533ac7da353d2730f6c

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\Nevron.System.dll

Filesize
452KB

MD5
e8561b46f03835cc272445714f78d140

SHA1
6e24011c901e6d474b0a0134e1f1239f204f2e23

SHA256
3cd447f9bd1c5dfc7b070d483b451889372a069aa83977a82e3c05221cb3ad6b

SHA512
b308c6f6f28b80ef78185a5016ece6501e716bd88b52bf4da95ecbb29bd44c627b99dc9a1b68ddbb2617e331b72702ae05617f73755f8b85f38e765803037d6f

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\NinjaGram_PTO.exe

Filesize
3.7MB

MD5
275c668e2235cb23037a433f98a06119

SHA1
62b6f806ad80e88a4398f75cec842afed4133eaf

SHA256
5ee75c7fa9e17cd68c35eec2fb7ac48efcbddbdfbc5e93b83184197ff15827e3

SHA512
10fefafdc805f01d7717a8b14ed23c2e0b6852142e8a5a948520e5e8645a009e8b89b1bccd37679f9a7a30788d1ff56f8742e00b9d0f1faa924ced42cfa52959

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\NinjaGram_PTO.exe

Filesize
2.2MB

MD5
a3c845494c681985d3c95f7f7cba4467

SHA1
232fd9bd2db8480399a8ed29b62b48232a8ff899

SHA256
871f72bfe56cf21e5764935a3fac64b61014b56bc36aa62e42b41017037aa3ed

SHA512
c0a3bbc59d4fd6bf8241f0342614848bf22d24cc3733489b5df8285d449499990ac1a4dd34495693ed1307dba1b762f569e9b4bea84abcfca465ec0821250e9f

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\NinjaGram_PTO.exe

Filesize
960KB

MD5
887c3edd611ffff0da538b521a733f9f

SHA1
f03488f631f614eb8576a609bc817e2ec32d4cdf

SHA256
5182fd79afdcdc78a7007b40a8b07a1d47b988892373998d12a27a1cb1636279

SHA512
3ab92379e7bbfa4d22797050b648c641dcff7a8f349a875c16b97d8c059a514877548cd084be9de9cdea8bd8f90af0854a58cae8ed3c63dbdff71cfadd4b4269

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\NinjaGram_PTO.exe.config

Filesize
27KB

MD5
b046981d6b81cd511e9abf67a50e48d5

SHA1
ebf9390e21ae2cd471fd7241456d5d25e18585fc

SHA256
2cd4359a2abd4ad8f958d8f4c751ea0ed41fa140fcf73d4da5b366e2c8c64605

SHA512
40c138e211c802702b3840d8505ccbf872308279311ca32d30924f8d5fd4bbf47be85f5fdf4d4854d9b48862b5e239c8b1a46d34420b39839540cdd9655a6831

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\System.Data.SQLite.dll

Filesize
595KB

MD5
805455d504378a446b355d1a198a0494

SHA1
3faca7893da72c23946a9075d5920f8d1c1abc2c

SHA256
69229734889589f39bf7ca25a985ce7cd9d599b46730acce41a7d4b0b06f5454

SHA512
acea88208f9f1f3856655bfd753935bee59fec074793ecaded6b82c3e1f2438f5ff1e27f3a467f7deca7868415cb6cd28f129faae8772028d1a6a1e3170ee363

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\System.Data.SQLite.dll

Filesize
667KB

MD5
84e146510db569e12832b8d36d25fa9a

SHA1
46b750a3f8993cb1f73c0d0e3e48cc412367ff85

SHA256
5612023e1bd8e75574be210ab4e86323b92b1147488290a0288b6cc9021bf546

SHA512
eaaf4c5797c1342153abc65b1ea41c70566f10322a3d33cbb6457b96bb6349d8ddc404422724776bd3fc0ead792be9a70f7ad8695f48498ca55e6b923c4cba0a

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\System.Data.SQLite.dll

Filesize
705KB

MD5
37f2dbc90f9085194bf0598a2b98be63

SHA1
c79e6e4425bcb54a9ec09f7f3bebd506c9c5fcae

SHA256
af3400171dce13f205c964a3589562638f97101fac8efec13f9a2ecd5e42bc5c

SHA512
c56ad832887b780f6b1e21d47e5078c2bdfc12f5bba67735f9b4fdadf6a728271a566191b52b6a7192898c5407a2b02a2e6f535b31d357f563b70b9e57bc78cc

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\System.Data.SQLite.dll

Filesize
501KB

MD5
04e67e9b1e4c7c12a01c1f7103589581

SHA1
3120b7ee9a1a62ccf50300d530a9ea2853b15b44

SHA256
2736f79aab88a6cb3276f2c58f4efbc29b8f4b8b0ff6537c2b153ba620a2d3bd

SHA512
13430741453019497964fe8c448756b6d5b212e6f8a9c018c3a578b3d8c5eb63091ed7e0815bfe81c5df08b20f90b43147d2bfb70bc98ef84d4c0ce98ac382d3

Download Submit
C:\Users\Admin\Desktop\NinjaGram_PTO\System.Data.SQLite.dll

Filesize
883KB

MD5
80725a732aba27911402f9ca09fede23

SHA1
1051744f654a6d20590970f9335e1ef246f0fa67

SHA256
49261be7f20c9d9dfd1ff35d71e9f3b1b7de17f65581c67beed43d933f1eb85c

SHA512
b24c5e5e55751b46af7fefec92552e04ddb6051e81174c1cae2d80ed1eb8b2c355c7a1eea93074abaeadfddf30e17a7425f14716cd4f2dfc50048b7fbfba6b49

Download Submit
C:\Users\Admin\Downloads\NinjaGram_PTO.Vgu57uVb.rar.part

Filesize
1.6MB

MD5
64561b52e7731f7fd1241d189f2986c4

SHA1
f8ce9a95f254db208057b27bfc76870c6965347e

SHA256
22bee4331f76cf3d9b5a4c21640c4ff8a62e1bcc0711fe225935d4a2ba44d4b0

SHA512
9a4f911bfa4187c273c11bf84c95bba3934cbd9d920e86f2f5b6f720dd877749169388f82c4d2e0a63c14c0bd1c895bfbc09b211921a023d66a6f13387dd760c

Download Submit
C:\Users\Admin\Downloads\NinjaGram_PTO.rar

Filesize
78.5MB

MD5
728ae04dfbe3e731d8b85bd86bab6dcc

SHA1
474244a765a40d510165f2a1b605cf5b294c2ca4

SHA256
cd755b2e592dfd0724b80ff924ac97c265665436d09a9904a3e8623e075ddf3f

SHA512
c3e490d685eee04bae5e9cff4bb515a7f503ff4b80403f4df4946b75b92af45406a88ec813288b1c7fc2e732236b5545fa411c07b0bac958ca1679112b680353

Download Submit
memory/2960-380-0x0000000074C90000-0x0000000075440000-memory.dmp

Filesize
7.7MB

Download
memory/2960-328-0x0000000074C90000-0x0000000075440000-memory.dmp

Filesize
7.7MB

Download
memory/2960-327-0x0000000000400000-0x000000000085A000-memory.dmp

Filesize
4.4MB

Download
memory/2960-330-0x0000000005C50000-0x0000000005C60000-memory.dmp

Filesize
64KB

Download
memory/2960-358-0x0000000005C50000-0x0000000005C60000-memory.dmp

Filesize
64KB

Download
memory/2960-329-0x0000000000400000-0x0000000000812000-memory.dmp

Filesize
4.1MB

Download
memory/2960-364-0x000000000B210000-0x000000000B564000-memory.dmp

Filesize
3.3MB

Download
memory/2960-369-0x000000000BA90000-0x000000000BADC000-memory.dmp

Filesize
304KB

Download
memory/4388-314-0x000001A305720000-0x000001A305721000-memory.dmp

Filesize
4KB

Download
memory/4388-313-0x000001A305720000-0x000001A305721000-memory.dmp

Filesize
4KB

Download
memory/4388-317-0x000001A305720000-0x000001A305721000-memory.dmp

Filesize
4KB

Download
memory/4388-319-0x000001A305720000-0x000001A305721000-memory.dmp

Filesize
4KB

Download
memory/4388-316-0x000001A305720000-0x000001A305721000-memory.dmp

Filesize
4KB

Download
memory/4388-318-0x000001A305720000-0x000001A305721000-memory.dmp

Filesize
4KB

Download
memory/4388-315-0x000001A305720000-0x000001A305721000-memory.dmp

Filesize
4KB

Download
memory/4388-307-0x000001A305720000-0x000001A305721000-memory.dmp

Filesize
4KB

Download
memory/4388-309-0x000001A305720000-0x000001A305721000-memory.dmp

Filesize
4KB

Download
memory/4388-308-0x000001A305720000-0x000001A305721000-memory.dmp

Filesize
4KB

Download
memory/4440-248-0x0000000005730000-0x0000000005CD4000-memory.dmp

Filesize
5.6MB

Download
memory/4440-306-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/4440-299-0x000000000BA90000-0x000000000BADC000-memory.dmp

Filesize
304KB

Download
memory/4440-297-0x000000000BB40000-0x000000000BC23000-memory.dmp

Filesize
908KB

Download
memory/4440-292-0x000000000B210000-0x000000000B564000-memory.dmp

Filesize
3.3MB

Download
memory/4440-288-0x000000000A300000-0x000000000A366000-memory.dmp

Filesize
408KB

Download
memory/4440-287-0x000000000A5F0000-0x000000000A960000-memory.dmp

Filesize
3.4MB

Download
memory/4440-283-0x0000000005E20000-0x0000000005E30000-memory.dmp

Filesize
64KB

Download
memory/4440-282-0x0000000009C30000-0x0000000009F96000-memory.dmp

Filesize
3.4MB

Download
memory/4440-278-0x0000000006830000-0x0000000006CD4000-memory.dmp

Filesize
4.6MB

Download
memory/4440-269-0x0000000006670000-0x00000000066E4000-memory.dmp

Filesize
464KB

Download
memory/4440-265-0x0000000006720000-0x000000000682E000-memory.dmp

Filesize
1.1MB

Download
memory/4440-260-0x0000000006610000-0x000000000671E000-memory.dmp

Filesize
1.1MB

Download
memory/4440-256-0x0000000005E30000-0x0000000005E6E000-memory.dmp

Filesize
248KB

Download
memory/4440-252-0x0000000005D40000-0x0000000005D96000-memory.dmp

Filesize
344KB

Download
memory/4440-251-0x0000000005D20000-0x0000000005D2A000-memory.dmp

Filesize
40KB

Download
memory/4440-250-0x0000000005E20000-0x0000000005E30000-memory.dmp

Filesize
64KB

Download
memory/4440-249-0x0000000005560000-0x00000000055F2000-memory.dmp

Filesize
584KB

Download
memory/4440-247-0x0000000003060000-0x00000000030FC000-memory.dmp

Filesize
624KB

Download
memory/4440-246-0x0000000000400000-0x0000000000812000-memory.dmp

Filesize
4.1MB

Download
memory/4440-245-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/4440-242-0x0000000077D72000-0x0000000077D73000-memory.dmp

Filesize
4KB

Download
memory/4440-243-0x0000000077D73000-0x0000000077D74000-memory.dmp

Filesize
4KB

Download
memory/4440-241-0x0000000000400000-0x000000000085A000-memory.dmp

Filesize
4.4MB

Download