orcus | hxxps://github[.]com/BlitzedOfficial/BlitzedGrabberV12/releases/download/BlitzedGrabberV12/BlitzedGrabberV12[.]rar

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
05-05-2024 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/BlitzedOfficial/BlitzedGrabberV12/releases/download/BlitzedGrabberV12/BlitzedGrabberV12.rar

Score

10^/10

orcus agilenet discovery execution persistence rat spyware stealer

Malware Config

Extracted

Family

orcus

209.25.141.181:40489

Mutex

248d60d8a7114264bce951ca45664b1d

Attributes

autostart_method
TaskScheduler
enable_keylogger
true
install_path
%programdata%\Chrome\chromedriver.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
winlogon.exe
watchdog_path
AppData\svchost.exe

Signatures

Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
rat spyware stealer orcus

Orcus main payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe	family_orcus

Orcurs Rat Executable 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe	orcus
behavioral1/memory/4544-1878-0x0000000000850000-0x000000000094C000-memory.dmp	orcus

Executes dropped EXE 12 IoCs

Processes:

7z2301-x64.exe7zFM.exeBlitzedGrabberV12.exemxfix.EXEUnityCrashHandlerV2.exeBlitzedGrabberV12.exeWindowsInput.exeWindowsInput.exechromedriver.exesvchost.exesvchost.exechromedriver.exe

pid	process
1488	7z2301-x64.exe
5008	7zFM.exe
2756	BlitzedGrabberV12.exe
3816	mxfix.EXE
2120	UnityCrashHandlerV2.exe
1824	BlitzedGrabberV12.exe
1012	WindowsInput.exe
4988	WindowsInput.exe
4544	chromedriver.exe
2396	svchost.exe
5992	svchost.exe
3840	chromedriver.exe

Loads dropped DLL 4 IoCs

Processes:

7zFM.exeBlitzedGrabberV12.exe

pid process

3344
3344
5008 7zFM.exe
1824 BlitzedGrabberV12.exe

pid	process
3344
3344
5008	7zFM.exe
1824	BlitzedGrabberV12.exe

Obfuscated with Agile.Net obfuscator 33 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1824-451-0x0000000005350000-0x0000000005542000-memory.dmp	agile_net
behavioral1/memory/1824-468-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-489-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-493-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-505-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-523-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-521-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-519-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-517-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-515-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-513-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-511-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-509-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-507-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-499-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-495-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-491-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-487-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-486-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-503-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-501-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-497-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-483-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-481-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-479-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-477-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-471-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-475-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-473-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-466-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-464-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-461-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net
behavioral1/memory/1824-462-0x0000000005350000-0x000000000553E000-memory.dmp	agile_net

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

7z2301-x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mxfix.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	mxfix.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

Processes:

UnityCrashHandlerV2.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	UnityCrashHandlerV2.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	UnityCrashHandlerV2.exe

Drops file in System32 directory 5 IoCs

Processes:

UnityCrashHandlerV2.exeWindowsInput.exechrome.exe

description	ioc	process
File created	C:\Windows\SysWOW64\WindowsInput.exe	UnityCrashHandlerV2.exe
File created	C:\Windows\SysWOW64\WindowsInput.exe.config	UnityCrashHandlerV2.exe
File created	C:\Windows\SysWOW64\WindowsInput.InstallState	WindowsInput.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe

Drops file in Program Files directory 64 IoCs

Processes:

7z2301-x64.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2301-x64.exe

Drops file in Windows directory 4 IoCs

Processes:

chrome.exeUnityCrashHandlerV2.exe

description	ioc	process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\assembly	UnityCrashHandlerV2.exe
File created	C:\Windows\assembly\Desktop.ini	UnityCrashHandlerV2.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	UnityCrashHandlerV2.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

4040 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4040	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133593934777599254"	chrome.exe

Modifies registry class 64 IoCs

Processes:

OpenWith.exe7z2301-x64.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 8c0031000000000093582153110050524f4752417e310000740009000400efbec5525961a558bb742e0000003f0000000000010000000000000000004a00000000008a621e01500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "3"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\NodeSlot = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Applications	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Applications\7zFM.exe\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Applications\7zFM.exe\shell\open\command	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Applications\7zFM.exe	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe

NTFS ADS 2 IoCs

Processes:

chrome.exechrome.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\BlitzedGrabberV12.rar:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\7z2301-x64.exe:Zone.Identifier	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2776 NOTEPAD.EXE

pid	process
2776	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exepowershell.exesvchost.exechromedriver.exe

pid	process
4504	chrome.exe
4504	chrome.exe
4040	powershell.exe
4040	powershell.exe
4040	powershell.exe
5992	svchost.exe
5992	svchost.exe
5992	svchost.exe
5992	svchost.exe
4544	chromedriver.exe
4544	chromedriver.exe
4544	chromedriver.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
4544	chromedriver.exe
5992	svchost.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
4544	chromedriver.exe
5992	svchost.exe
5992	svchost.exe
4544	chromedriver.exe
4544	chromedriver.exe
5992	svchost.exe
5992	svchost.exe
4544	chromedriver.exe
4544	chromedriver.exe
5992	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

OpenWith.exe7zFM.exechromedriver.exe

pid process

2348 OpenWith.exe
5008 7zFM.exe
4544 chromedriver.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

4504 chrome.exe
4504 chrome.exe
4504 chrome.exe
4504 chrome.exe
4504 chrome.exe

pid	process
2348	OpenWith.exe
5008	7zFM.exe
4544	chromedriver.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

Processes:

chrome.exe7zFM.exe

pid	process
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
5008	7zFM.exe
5008	7zFM.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	process
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

7z2301-x64.exeOpenWith.exechromedriver.exeBlitzedGrabberV12.exe

pid	process
1488	7z2301-x64.exe
2348	OpenWith.exe
2348	OpenWith.exe
2348	OpenWith.exe
2348	OpenWith.exe
2348	OpenWith.exe
2348	OpenWith.exe
2348	OpenWith.exe
2348	OpenWith.exe
2348	OpenWith.exe
2348	OpenWith.exe
2348	OpenWith.exe
2348	OpenWith.exe
2348	OpenWith.exe
2348	OpenWith.exe
4544	chromedriver.exe
1824	BlitzedGrabberV12.exe
1824	BlitzedGrabberV12.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4504 wrote to memory of 4524	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4524	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 4344	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 228	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 228	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe
PID 4504 wrote to memory of 2488	4504	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/BlitzedOfficial/BlitzedGrabberV12/releases/download/BlitzedGrabberV12/BlitzedGrabberV12.rar
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb27e0cc40,0x7ffb27e0cc4c,0x7ffb27e0cc58
2⤵
PID:4524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1808 /prefetch:2
2⤵
PID:4344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2036,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2100 /prefetch:3
2⤵
PID:228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2172,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2396 /prefetch:8
2⤵
PID:2488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3120 /prefetch:1
2⤵
PID:1568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3148 /prefetch:1
2⤵
PID:1636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4252,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4324 /prefetch:1
2⤵
PID:2888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4564,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4596 /prefetch:1
2⤵
PID:1796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4780,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4764 /prefetch:8
2⤵
PID:2752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4852,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4856 /prefetch:8
2⤵
PID:4200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4896,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4964 /prefetch:8
2⤵
PID:1392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4848,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4332 /prefetch:8
2⤵
- NTFS ADS
PID:2872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5192,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5228 /prefetch:1
2⤵
PID:1900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4280,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4468 /prefetch:8
2⤵
PID:2164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5528,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5532 /prefetch:8
2⤵
- NTFS ADS
PID:4860

C:\Users\Admin\Downloads\7z2301-x64.exe
"C:\Users\Admin\Downloads\7z2301-x64.exe"
2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4776,i,9595716895651369541,5049356977706895197,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4752 /prefetch:8
2⤵
- Drops file in System32 directory
PID:5192

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:4644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2708

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1528

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2348

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\BlitzedGrabberV12.rar"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:5008

C:\Users\Admin\Desktop\BlitzedGrabberV12\BlitzedGrabberV12.exe
"C:\Users\Admin\Desktop\BlitzedGrabberV12\BlitzedGrabberV12.exe"
1⤵
- Executes dropped EXE
PID:2756

C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
"C:\Users\Admin\AppData\Local\Temp\mxfix.EXE"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -File mxfixer.ps1
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4040

C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe"
2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
PID:2120

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ddocdjxj.cmdline"
3⤵
PID:3760

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6B68.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6B67.tmp"
4⤵
PID:4116

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe" --install
3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1012

C:\ProgramData\Chrome\chromedriver.exe
"C:\ProgramData\Chrome\chromedriver.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4544

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe" /launchSelfAndExit "C:\ProgramData\Chrome\chromedriver.exe" 4544 /protectFile
4⤵
- Executes dropped EXE
PID:2396

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe" /watchProcess "C:\ProgramData\Chrome\chromedriver.exe" 4544 "/protectFile"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5992

C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1824

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\BlitzedGrabberV12\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2776

C:\Windows\SysWOW64\WindowsInput.exe
"C:\Windows\SysWOW64\WindowsInput.exe"
1⤵
- Executes dropped EXE
PID:4988

C:\ProgramData\Chrome\chromedriver.exe
C:\ProgramData\Chrome\chromedriver.exe
1⤵
- Executes dropped EXE
PID:3840

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll
Filesize
99KB

MD5
956d826f03d88c0b5482002bb7a83412

SHA1
560658185c225d1bd274b6a18372fd7de5f336af

SHA256
f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d

SHA512
6503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647

Download Submit
C:\Program Files\7-Zip\7z.dll
Filesize
1.8MB

MD5
4e35a902ca8ed1c3d4551b1a470c4655

SHA1
ad9a9b5dbe810a6d7ea2c8430c32417d87c5930c

SHA256
77222e81cb7004e8c3e077aada02b555a3d38fb05b50c64afd36ca230a8fd5b9

SHA512
c7966f892c1f81fbe6a2197bd229904d398a299c53c24586ca77f7f657529323e5a7260ed32da9701fce9989b0b9a2463cd45c5a5d77e56a1ea670e02e575a30

Download Submit
C:\Program Files\7-Zip\7z.exe
Filesize
544KB

MD5
9a1dd1d96481d61934dcc2d568971d06

SHA1
f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

SHA256
8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

SHA512
7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

Download Submit
C:\Program Files\7-Zip\7zFM.exe
Filesize
930KB

MD5
30ac0b832d75598fb3ec37b6f2a8c86a

SHA1
6f47dbfd6ff36df7ba581a4cef024da527dc3046

SHA256
1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

SHA512
505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

Download Submit
C:\Program Files\7-Zip\7zG.exe
Filesize
684KB

MD5
50f289df0c19484e970849aac4e6f977

SHA1
3dc77c8830836ab844975eb002149b66da2e10be

SHA256
b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305

SHA512
877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38

Download Submit
C:\Program Files\7-Zip\Uninstall.exe
Filesize
14KB

MD5
ad782ffac62e14e2269bf1379bccbaae

SHA1
9539773b550e902a35764574a2be2d05bc0d8afc

SHA256
1c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8

SHA512
a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Filesize
649B

MD5
282002154c658fa9b89deb7c33460461

SHA1
5cf78a5614ab4f75ba292845f132241d0ca6ebca

SHA256
ec8189895329185cc5ce558f55c2739df7234d33911a05f2fa63074a49cdc0eb

SHA512
dcf3c9e00f4dd1d97530ae930eb811288e746d72392359e2f0a80709ba8845080191831e04ed537466db6e0c229b831d3f3cec51a0fe2f78b46fb4fecaced29f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7a2193f8-955b-4bd6-bb09-03beb623232a.tmp
Filesize
521B

MD5
297a263eacfb6d0c3ac2882df98c45e5

SHA1
bb111358dba2918b2ead32480e702edb1b27f61b

SHA256
7a4246bfb366075524ac251c088ec2b804efeea993fd4bf432e6d7a01ed7cbdc

SHA512
00d6a13fae01ffacd4a245ec9b0d6d3c9c4d38f65decffb171d70155f3a28d02ae5d6dcc5fbb6b3d9839ce2e2de883bc86156abcc5ea70988bce4517b565a753

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
a202eba34a9620b12086cdd7602da0a2

SHA1
26cfb9720b350ff93969509697146eb050dff93e

SHA256
da70194f45a32900d9a7841c0311d7b4b4fb038a53f00dadf11bce01359d0cd4

SHA512
50ecc8d7261ea004ad07675bda35f7e26b86f6b7fbabb00506535de83c0c8eb4cd55fe98962a258655f13edec23d5b88ceaa25526133cd490b72ef6f712ef0f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
521B

MD5
22df042d235fc9a8d6d00aac54772297

SHA1
ba23bfb4fef7ad12a9a4a42ec4ea5de0323d876b

SHA256
b6bf1ea5d4e34a9a7e601f9cb6861cc0280fb8fb4a7cc4111381c77b0d4a25be

SHA512
6a6b96b0fc9cdc9e5f4ee75d3514764b25081295557572c2f0f99f11e1cb0c4195914af1061f6698663c9d67d3cfd948f8f918bf75b207dbf78048a9745f08e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
cc6a180b2825ae983bc8a9da7bda07fe

SHA1
4558baff0c6435928457ebc9b5349d300c7895b1

SHA256
24b418454af859f4252ea19f0e324c7f1fa095131bbfd254d66200e95666ce58

SHA512
4e13a0b6d8aaada7426cfbc1a2d91e893d220973ab19e46121791e987ae7a0d4d4a50d3436e04ef8b4168c47c0e32bf7818f094acb247911e501b12e935acb4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
170a5bbb2cad41456484d1ae81734c38

SHA1
f8149cc33825ea8658d438cc3fa4a4648d6ef5c3

SHA256
caae01f855de6e45f1d50f84c51c361c48f52386d3d4a362370b5275be552210

SHA512
34663b9aa186a1dd14e776696b91ff1802e6b2ad38bf21ad09c6664a30e12bb71fbd3c3fdd7c24aeb0163c9028d907d4e909dd445d06274a9d89c6010a9f7cd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
b3feb0bdbdc1c1091af8a44e39f5fa07

SHA1
32efe9c7939e604919d2c6cd959d3609f4f8551a

SHA256
39f593242675a27c642886c2cac89ddd34cf39061add389342609fe568d16043

SHA512
e1ac1cd0517986e96972f17aa233fd7aab951bdd8232a337cba0e76a254ccea13939e0665191d0f0c4e8cbbda26ba9f899539854dbc02cb6581b3eb1b90b0373

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
b57f75507b07d6b591a8c97ef05f6b60

SHA1
2ba0581d24b5140fc99b057ccc8ab5e20f6b9d5b

SHA256
56fe9b524d6e47739670b076eac8f907743924f2754d7a1bd7fd6605cda321fa

SHA512
a17c81f36c0b46cba54497c52b54ccae4159a248171694a06e4e2013a1ec3aab1ebce4d1c1ce1d4d79f35cc649b261960dac00ea02cc530017fb12a08ecef035

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
2c0aaa11b43195711f1c4572d686d5f5

SHA1
08b664a0f19d8541ee98fe2ef625e9a282ffc1da

SHA256
a3ccf25d268948aa4ec81899709ed72abd7f6955a31064d24d20fde526f7c92e

SHA512
e659da044471028e2ad9f33a021733216a72749dea16955faeb920c40797553ede4b2ef4bdb330334b5dfce3f7982d420e5bc89297435980cb54c6a4b6786c76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
8125deff0872ba9028d7b63ab51732d9

SHA1
db51ad6424cf74f3920671d7dbd8cca777123d9d

SHA256
cff93fa142d0b32781b7b187b21444f9c13bc0a78b669bfb6f3a0e8413ac7a1b

SHA512
860b55ad7f9e26280ce9130450689b7a94a30165cf4a49106deb63ec1a009855a2b26db082e2c3cf07d13b7dbc72483b557991a33b560ba118a8c91f461eaba9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
a260fbabbd0452d5acfa32a7bf0e21b1

SHA1
d667398058d254b2adb3026ff4cd80625bae5bdf

SHA256
c97b66ef06b30aa265db4061253149884f3f2cdd63dc4c589491b8d97471fb25

SHA512
b6b3b47052f3876cda4c48903da2f0e94443978a6ce57ec8cc7df0b14bd9d9f5bf9ada6f182e5f6be35e35170b791411855c22bf4a6131be525dd9f997b6039f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
f89d59cd16d9071714bfd9bb005ab7ca

SHA1
87fd0a36d76301deace0f3a3a5e5c57d3ceffd22

SHA256
434946f0cb1ad1d9f24e351b5085ce31960c22a410ac5e1cce39c626f26e7f80

SHA512
7c4f7b58c9fe03ce9cba3a3d0f153a28c4644550c6ba813d05dbd6b2b79c85b877bf4b33d58c651851dcd07b43cfb73a7fee6f96dd296f6fe0022078dd21ff71

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
9944b6a5c9a525b6c2a294330f45b5a0

SHA1
24c22ea7adc7585db46ee9ae578b1aadaa146e0e

SHA256
20aa221dd52763045755d775558214b8b5cd8644ecc99ca9a9746e654f901ef2

SHA512
8b8be50212cab9fe1c754ba1dbae9d75f8274638c9d8466fc5d270fbe262786e77297825ea8110c608034c20e31187a32dbd93d598ee82f5eb6ea9994989e2ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
9KB

MD5
6425e4446cfd59ff8b2e05290b2eaba5

SHA1
d33a27244ef19487756c51c6936e82dde45d27ed

SHA256
978bfb75cf67615ea18354ed2a3159e8494f27467f803043bee33010ec7be903

SHA512
f30ede66c9b32dd56f8ebb52fb0adfa8542f5c57d889036120668bd1ead0f198dca004ddfe162408e96273bdd530d1afbaf376395e77e27c18f313aaa6c8565a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
77KB

MD5
469954a04d73ef917aa829cb5e150159

SHA1
f41ab1489f6936f307f8a1666e03c7ae642927cf

SHA256
88f27ca4045f7cbcb42bb70ba4c058a19b363527ceae944589fcfd059019229a

SHA512
2db0ee202c0c6782efdb76a52e4175f48d153dbab1b3817f99424b58d63eab71a79bcd59a58a4209392b91d6f86b00c24feefb6944aaf5fce7aadf6aded4d569

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
77KB

MD5
04b75de952e9635afaad40ab244b648b

SHA1
1df0690529a6f334e0cf2393bcfe11ff6ee042c6

SHA256
396756d3923913aeecaed868981f6b8c91a8f9dcbd41e4808c74521c4a27ce1b

SHA512
f4759a061e8c34d55bd3ff0de3a3569146a63750729d57150a94802750898bed2f3d1690e4c2cbca879a3250975f71181969acb03c4e261c3f2cb8ead4bf49aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchost.exe.log
Filesize
425B

MD5
bb27934be8860266d478c13f2d65f45e

SHA1
a69a0e171864dcac9ade1b04fc0313e6b4024ccb

SHA256
85ad0d9909461517acf2e24ff116ca350e9b7000b4eefb23aa3647423c9745b4

SHA512
87dd77feac509a25b30c76c119752cc25020cca9c53276c2082aef2a8c75670ef67e1e70024a63d44ae442b64f4bc464aee6691e80c525376bb7421929cfa3bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12.exe
Filesize
1.6MB

MD5
228a69dc15032fd0fb7100ff8561185e

SHA1
f8dbc89fed8078da7f306cb78b92ce04a0bdeb00

SHA256
920bec9d500f6446b84399ab4c84858d0f0d7d1abb2e0377399ebbc4bafad709

SHA512
373621c4743fa72571b3c8375aa6f7852303a821558b016b002d2af07154787d978f66696db89eeed8fe41f4aed5d66b690d4f87469939f9b1dea2ac2b9101f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\mxfixer.ps1
Filesize
35B

MD5
5d792fc7c4e2fd3eb595fce4883dcb2d

SHA1
ee2a88f769ad746f119e144bd06832cb55ef1e0f

SHA256
41eccaa8649345b33e57f5d494429276e9f2eb23ca981f018da33a34aabfd8eb

SHA512
4b85fe8205c705914867227c97aa1333421970d8e6f11b2ac6be8e95fef1a0f31f985547eafe52e382f13c2a16afa05462bd614b75bee250464c50734d59a92e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6B68.tmp
Filesize
1KB

MD5
a1126c8487a5b9f20c84b404a9031a91

SHA1
5bdc33fe398ae18377ac178654585c9a5d8c3140

SHA256
1a3003c550ac1e3a769e1e026002fb15c4acb9f801c915d9b647ed9655a19983

SHA512
a05461bb140016f7a0993ff3ef30abac1cf80f6a0c47d195e3895cae0723248c9ce98ddfac95c8a50a796b93a4502f86a6056040a1312be8b7171c8d85006b6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandlerV2.exe
Filesize
6.0MB

MD5
3926c7b8fdfb0ab3b92303760b14d402

SHA1
b33e12ef4bdcd418139db59d048609c45fe8f9eb

SHA256
c101904ec19b45612213c2b398892a4523f63862bb3e24c245509db2417585e7

SHA512
4a022be27f58b1735f3a0ac9abdedbd769adb4e3ca1dacdcdc98700b17e138b647f9059585c8ef37fdd7072ad6283e95f10def171584097eb8c70e7d1212ce0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jnlbmdq1.wb1.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcfb00f9-5ae7-4197-ba59-e48107e40d35\GunaDotNetRT.dll
Filesize
136KB

MD5
9af5eb006bb0bab7f226272d82c896c7

SHA1
c2a5bb42a5f08f4dc821be374b700652262308f0

SHA256
77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

SHA512
7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ddocdjxj.dll
Filesize
76KB

MD5
7938e0f8dac3df60628b7ebaf3d028ca

SHA1
d5ebeba3742441fa4e3cf5c127bcad4b9a6e6db3

SHA256
226a38e378bcfc5d6e842a319ddd0b8d8e0a04f7e4f97891e7c122385c767455

SHA512
322168a638dcfa61bb80e2505dcefa4b980617a9481d1c33f12bd72aa437ad6563021e5f3e8db6b925023d68bf84712fbc95338443613941b84d5c8782e8020b

Download Submit
C:\Users\Admin\AppData\Local\Temp\mxfix.EXE
Filesize
155KB

MD5
b4ec612c441786aa614ce5f32edae475

SHA1
3a264f8daeec9b156ddb5ed576d490dd8fbd8e7d

SHA256
e18ba6573b9aa2d139ed5c30f18ac2ece3ce8287d1651db4bc632dbc816f53bd

SHA512
c6800371cdc2b571061e6e755a2c95f49dcb233c3999976f180cb7cf95fa2c62d03b52a3c497a2cd7ae46ec72eaf823db25bd291ca676724194c05966f2bce16

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe
Filesize
9KB

MD5
913967b216326e36a08010fb70f9dba3

SHA1
7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

SHA256
8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

SHA512
c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

Download Submit
C:\Users\Admin\Desktop\BlitzedGrabberV12\README.txt
Filesize
1KB

MD5
110a464be52a150056f184348f09a6c6

SHA1
c7516032dbae3d9e3c0342da0bd690318b93be6f

SHA256
97b778580fd7487beb8062a777a654b718a3b16622d8bcf46594ac9048dd3e6a

SHA512
04c97df944b110f6c481f2b06b406d7ba5b2b3a6176a2527ae8b9820d925a341fd106e20dd3694353effa4f623c8eeb3f858de478ebc13fa6c68d6ab04db85cf

Download Submit
C:\Users\Admin\Downloads\BlitzedGrabberV12.rar.crdownload
Filesize
3.6MB

MD5
4282ce784621bf22365f21260be70e5e

SHA1
3e743738e2ec8cc35d64ebbad99abcfde46eafe3

SHA256
06fa7e3221aa6f67eeefa8b807a6abb0b4c385d7eb61434ccec55ad2a5d3a1dd

SHA512
aa776cfdc39c152814a7e0e6def451454ca30fc4388dec48f3d12b1e50a0ee3925bfd2333700919b52af725cfe7ece93146ba24a9c0d2a6c0d602f7b243b77ec

Download Submit
C:\Users\Admin\Downloads\BlitzedGrabberV12.rar:Zone.Identifier
Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 522975.crdownload
Filesize
1.5MB

MD5
e5788b13546156281bf0a4b38bdd0901

SHA1
7df28d340d7084647921cc25a8c2068bb192bdbb

SHA256
26cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd

SHA512
1f4da167ff2f1d34eeaf76c3003ba5fcabfc7a7da40e73e317aa99c6e1321cdf97e00f4feb9e79e1a72240e0376af0c3becb3d309e5bb0385e5192da17ea77ff

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe
Filesize
21KB

MD5
e6fcf516d8ed8d0d4427f86e08d0d435

SHA1
c7691731583ab7890086635cb7f3e4c22ca5e409

SHA256
8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

SHA512
c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

Download Submit
C:\Windows\SysWOW64\WindowsInput.exe.config
Filesize
357B

MD5
a2b76cea3a59fa9af5ea21ff68139c98

SHA1
35d76475e6a54c168f536e30206578babff58274

SHA256
f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

SHA512
b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC6B67.tmp
Filesize
676B

MD5
99f6cb770ac33b86b90940a487d2ae18

SHA1
d9cf33893d57d3b71d3a685d9fb756f24cdbb9ea

SHA256
10125de473a8713a591c9571663276a7bd20d46709c6c8dce7e4ef9b97cdc804

SHA512
6e6d8f8cc9546133cf8d9baa62e0ccaee4de9d5d6ec9de24728ae432b7f3b3976848333f72a13ef39642e451a35189ede310e020c23173642ddd82512cc153b5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ddocdjxj.0.cs
Filesize
208KB

MD5
e06272bb28419b66481100c1edebcca4

SHA1
6c4be58c03ce6283ffc55392b679cf11daec3027

SHA256
724518389e905eba242aa82d7ad9b1c4034523878d999665c7c9905c5ebf253e

SHA512
ac1492fe22c9ef874cff8b12540f909c169b58ac6c14f480fbb320a5d353037653159c6e4099dd09be3d55410fa5f0cef6c87a4ff8f9447322fa18daaf50d425

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ddocdjxj.cmdline
Filesize
349B

MD5
b94596a8f2984f4fb1586696691a2fc8

SHA1
3d0892b8573aafdca7ffa391774f00bcd64e1a9e

SHA256
0aeabb091d630bf32bb7529780f52a38a53a3327c188210d6c4bdb41cb3cf3ee

SHA512
943719cc9c9c90be9e4895ba649f3295b090e506b974b0f58d2bd5351a544b37a1fe4a4baccaff5e2142f4458e1e029bd1b82eb40c0e05e4894a770fd2ae88dc

Download Submit
\??\pipe\crashpad_4504_OUMUGMHPCRQUQWLF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1012-685-0x000000001BB80000-0x000000001BBBC000-memory.dmp

Filesize
240KB

Download
memory/1012-684-0x0000000003110000-0x0000000003122000-memory.dmp

Filesize
72KB

Download
memory/1012-683-0x0000000000EE0000-0x0000000000EEC000-memory.dmp

Filesize
48KB

Download
memory/1824-481-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-501-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-440-0x0000000000480000-0x000000000062C000-memory.dmp

Filesize
1.7MB

Download
memory/1824-441-0x0000000005560000-0x0000000005B06000-memory.dmp

Filesize
5.6MB

Download
memory/1824-521-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-523-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-479-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-513-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-515-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-505-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-445-0x0000000005050000-0x00000000050E2000-memory.dmp

Filesize
584KB

Download
memory/1824-12213-0x0000000006280000-0x000000000631C000-memory.dmp

Filesize
624KB

Download
memory/1824-493-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-489-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-470-0x0000000070DA0000-0x0000000070DD7000-memory.dmp

Filesize
220KB

Download
memory/1824-468-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-511-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-509-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-507-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-499-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-495-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-491-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-487-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-486-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-503-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-477-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-517-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-483-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-497-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-10614-0x0000000070DA0000-0x0000000070DD7000-memory.dmp

Filesize
220KB

Download
memory/1824-519-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-471-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-475-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-473-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-466-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-464-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-461-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-460-0x0000000073270000-0x00000000732FA000-memory.dmp

Filesize
552KB

Download
memory/1824-462-0x0000000005350000-0x000000000553E000-memory.dmp

Filesize
1.9MB

Download
memory/1824-450-0x0000000004FB0000-0x0000000004FBA000-memory.dmp

Filesize
40KB

Download
memory/1824-451-0x0000000005350000-0x0000000005542000-memory.dmp

Filesize
1.9MB

Download
memory/2120-446-0x000000001C050000-0x000000001C05E000-memory.dmp

Filesize
56KB

Download
memory/2120-452-0x000000001CAA0000-0x000000001CB3C000-memory.dmp

Filesize
624KB

Download
memory/2120-449-0x000000001C530000-0x000000001C9FE000-memory.dmp

Filesize
4.8MB

Download
memory/2120-665-0x000000001CB70000-0x000000001CB86000-memory.dmp

Filesize
88KB

Download
memory/2120-669-0x000000001D1A0000-0x000000001D1C0000-memory.dmp

Filesize
128KB

Download
memory/2120-442-0x000000001BE60000-0x000000001BEBC000-memory.dmp

Filesize
368KB

Download
memory/2120-668-0x0000000001860000-0x0000000001868000-memory.dmp

Filesize
32KB

Download
memory/2120-667-0x0000000001880000-0x0000000001892000-memory.dmp

Filesize
72KB

Download
memory/2396-3290-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/2756-379-0x00000000006A0000-0x00000000008E4000-memory.dmp

Filesize
2.3MB

Download
memory/4040-426-0x000002861F1C0000-0x000002861F1E2000-memory.dmp

Filesize
136KB

Download
memory/4544-2269-0x000000001B960000-0x000000001B9AE000-memory.dmp

Filesize
312KB

Download
memory/4544-2246-0x000000001B450000-0x000000001B462000-memory.dmp

Filesize
72KB

Download
memory/4544-1878-0x0000000000850000-0x000000000094C000-memory.dmp

Filesize
1008KB

Download
memory/4544-2638-0x000000001BEE0000-0x000000001C0A2000-memory.dmp

Filesize
1.8MB

Download
memory/4544-2701-0x000000001BE10000-0x000000001BE20000-memory.dmp

Filesize
64KB

Download
memory/4544-2515-0x000000001BB30000-0x000000001BB48000-memory.dmp

Filesize
96KB

Download
memory/4988-690-0x000000001AAE0000-0x000000001ABEA000-memory.dmp

Filesize
1.0MB

Download