hawkeye | hxxps://cdn[.]discordapp[.]com/attachments/1235665828129804342/1272860754835673163/PO-SAI_FOOD_PVT_LTD_[.]zip?ex=66bc8374&is=66bb31f4&hm=103fbc9cc2f064b5879e39769452535cf80d61008efd2495a8a87207161e8c5e&

Analysis

max time kernel
599s
max time network
547s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 11:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1235665828129804342/1272860754835673163/PO-SAI_FOOD_PVT_LTD_.zip?ex=66bc8374&is=66bb31f4&hm=103fbc9cc2f064b5879e39769452535cf80d61008efd2495a8a87207161e8c5e&

Score

10^/10

hawkeye collection credential_access discovery execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.comedyskits.com.ng
Port:
21
Username:
[email protected]
Password:
TGXs]#J&_ReU

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 7 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral1/memory/3380-121-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/2328-178-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2328-179-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2328-183-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/1616-313-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/1616-314-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/1616-337-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/3380-121-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/2328-178-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/2328-179-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/2328-183-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/3380-121-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/1616-313-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/1616-314-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/1616-337-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
5008	powershell.exe
4352	powershell.exe
4832	powershell.exe
5564	powershell.exe
5600	powershell.exe
2256	powershell.exe
1084	powershell.exe
3872	powershell.exe
2448	powershell.exe
2292	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

PO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	PO SAI FOOD PVT LTD .exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	PO SAI FOOD PVT LTD .exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	PO SAI FOOD PVT LTD .exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	PO SAI FOOD PVT LTD .exe

Executes dropped EXE 10 IoCs

Processes:

PO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exe

pid	Process
4660	PO SAI FOOD PVT LTD .exe
3904	PO SAI FOOD PVT LTD .exe
912	PO SAI FOOD PVT LTD .exe
2912	PO SAI FOOD PVT LTD .exe
3380	PO SAI FOOD PVT LTD .exe
4860	PO SAI FOOD PVT LTD .exe
4040	PO SAI FOOD PVT LTD .exe
4692	PO SAI FOOD PVT LTD .exe
4488	PO SAI FOOD PVT LTD .exe
5840	PO SAI FOOD PVT LTD .exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

PO SAI FOOD PVT LTD .exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	PO SAI FOOD PVT LTD .exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
58	whatismyipaddress.com
60	whatismyipaddress.com

Drops file in System32 directory 2 IoCs

Processes:

chrome.exe

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

PO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exe

description	pid	Process	procid_target
PID 4660 set thread context of 3380	4660	PO SAI FOOD PVT LTD .exe	123
PID 3380 set thread context of 2328	3380	PO SAI FOOD PVT LTD .exe	125
PID 3904 set thread context of 4860	3904	PO SAI FOOD PVT LTD .exe	134
PID 3380 set thread context of 1616	3380	PO SAI FOOD PVT LTD .exe	137
PID 4040 set thread context of 4692	4040	PO SAI FOOD PVT LTD .exe	147
PID 4884 set thread context of 5208	4884	PO SAI FOOD PVT LTD .exe	161
PID 4488 set thread context of 5840	4488	PO SAI FOOD PVT LTD .exe	169

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

schtasks.exePO SAI FOOD PVT LTD .exeschtasks.exepowershell.exePO SAI FOOD PVT LTD .exepowershell.exePO SAI FOOD PVT LTD .exePO SAI FOOD PVT LTD .exepowershell.exePO SAI FOOD PVT LTD .exepowershell.exePO SAI FOOD PVT LTD .exepowershell.exepowershell.exePO SAI FOOD PVT LTD .exepowershell.exePO SAI FOOD PVT LTD .exeschtasks.exepowershell.exevbc.exePO SAI FOOD PVT LTD .exeschtasks.exePO SAI FOOD PVT LTD .exevbc.exepowershell.exepowershell.exeschtasks.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO SAI FOOD PVT LTD .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO SAI FOOD PVT LTD .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO SAI FOOD PVT LTD .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO SAI FOOD PVT LTD .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO SAI FOOD PVT LTD .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO SAI FOOD PVT LTD .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO SAI FOOD PVT LTD .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO SAI FOOD PVT LTD .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO SAI FOOD PVT LTD .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO SAI FOOD PVT LTD .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133680208937562286"	chrome.exe

Modifies registry class 58 IoCs

Processes:

chrome.exechrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe100000007e2e8d63d7e4da01e3122e14dce4da01c19f783b71edda0114000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "3"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
3096	schtasks.exe
2940	schtasks.exe
3560	schtasks.exe
1756	schtasks.exe
5640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

chrome.exepowershell.exepowershell.exePO SAI FOOD PVT LTD .exepowershell.exepowershell.exevbc.exePO SAI FOOD PVT LTD .exepowershell.exepowershell.exepowershell.exepowershell.exePO SAI FOOD PVT LTD .exechrome.exepowershell.exepowershell.exe

pid	Process
2728	chrome.exe
2728	chrome.exe
2256	powershell.exe
2256	powershell.exe
1084	powershell.exe
1084	powershell.exe
4660	PO SAI FOOD PVT LTD .exe
4660	PO SAI FOOD PVT LTD .exe
4660	PO SAI FOOD PVT LTD .exe
4660	PO SAI FOOD PVT LTD .exe
2256	powershell.exe
1084	powershell.exe
5008	powershell.exe
5008	powershell.exe
4352	powershell.exe
4352	powershell.exe
5008	powershell.exe
4352	powershell.exe
1616	vbc.exe
1616	vbc.exe
3380	PO SAI FOOD PVT LTD .exe
3380	PO SAI FOOD PVT LTD .exe
2448	powershell.exe
2448	powershell.exe
4832	powershell.exe
4832	powershell.exe
2448	powershell.exe
4832	powershell.exe
2292	powershell.exe
2292	powershell.exe
3872	powershell.exe
3872	powershell.exe
4884	PO SAI FOOD PVT LTD .exe
4884	PO SAI FOOD PVT LTD .exe
2292	powershell.exe
3872	powershell.exe
5436	chrome.exe
5436	chrome.exe
5564	powershell.exe
5564	powershell.exe
5600	powershell.exe
5600	powershell.exe
5436	chrome.exe
5436	chrome.exe
5564	powershell.exe
5600	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

chrome.exe

pid	Process
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe7zG.exe

description	pid	Process
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe
Token: SeRestorePrivilege	2032	7zG.exe
Token: 35	2032	7zG.exe
Token: SeSecurityPrivilege	2032	7zG.exe
Token: SeSecurityPrivilege	2032	7zG.exe
Token: SeShutdownPrivilege	2728	chrome.exe
Token: SeCreatePagefilePrivilege	2728	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe7zG.exe

pid	Process
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2032	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	Process
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe
2728	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

PO SAI FOOD PVT LTD .exechrome.exe

pid	Process
3380	PO SAI FOOD PVT LTD .exe
4172	chrome.exe
4172	chrome.exe
4172	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	Process	procid_target
PID 2728 wrote to memory of 3300	2728	chrome.exe	84
PID 2728 wrote to memory of 3300	2728	chrome.exe	84
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 4312	2728	chrome.exe	85
PID 2728 wrote to memory of 5036	2728	chrome.exe	86
PID 2728 wrote to memory of 5036	2728	chrome.exe	86
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87
PID 2728 wrote to memory of 4104	2728	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1235665828129804342/1272860754835673163/PO-SAI_FOOD_PVT_LTD_.zip?ex=66bc8374&is=66bb31f4&hm=103fbc9cc2f064b5879e39769452535cf80d61008efd2495a8a87207161e8c5e&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffa50acc40,0x7fffa50acc4c,0x7fffa50acc58
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,12971912217871014874,7496030193600726924,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1812,i,12971912217871014874,7496030193600726924,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  PID:5036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,12971912217871014874,7496030193600726924,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,12971912217871014874,7496030193600726924,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,12971912217871014874,7496030193600726924,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4788,i,12971912217871014874,7496030193600726924,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4708,i,12971912217871014874,7496030193600726924,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3800,i,12971912217871014874,7496030193600726924,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5328,i,12971912217871014874,7496030193600726924,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5620,i,12971912217871014874,7496030193600726924,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3184,i,12971912217871014874,7496030193600726924,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4924,i,12971912217871014874,7496030193600726924,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5244,i,12971912217871014874,7496030193600726924,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=968,i,12971912217871014874,7496030193600726924,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5436

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3684

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap24255:100:7zEvent24651
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2032

C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe
"C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4660
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2256
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cIQcmsFxE.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1084
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cIQcmsFxE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3822.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3096
- C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe
  "C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe"
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe
  "C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe"
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe
  "C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3380
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2328
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1616

C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe
"C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3904
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cIQcmsFxE.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4352
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cIQcmsFxE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp586C.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2940
- C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe
  "C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4860

C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe
"C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4040
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2448
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cIQcmsFxE.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cIQcmsFxE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9CC8.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3560
- C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe
  "C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4692

C:\Users\Admin\AppData\Local\Temp\Temp1_PO-SAI FOOD PVT LTD.zip\PO SAI FOOD PVT LTD .exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_PO-SAI FOOD PVT LTD.zip\PO SAI FOOD PVT LTD .exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Temp1_PO-SAI FOOD PVT LTD.zip\PO SAI FOOD PVT LTD .exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2292
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cIQcmsFxE.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3872
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cIQcmsFxE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3B4A.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1756
- C:\Users\Admin\AppData\Local\Temp\Temp1_PO-SAI FOOD PVT LTD.zip\PO SAI FOOD PVT LTD .exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_PO-SAI FOOD PVT LTD.zip\PO SAI FOOD PVT LTD .exe"
  2⤵
  PID:5192
- C:\Users\Admin\AppData\Local\Temp\Temp1_PO-SAI FOOD PVT LTD.zip\PO SAI FOOD PVT LTD .exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_PO-SAI FOOD PVT LTD.zip\PO SAI FOOD PVT LTD .exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5208

C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe
"C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5564
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cIQcmsFxE.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5600
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cIQcmsFxE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4D7A.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5640
- C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe
  "C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\13f6b19e-2de4-4296-b6b4-cc6c05b47523.tmp

Filesize
10KB

MD5
f35d6237587eee121e07d36dfdba6ec1

SHA1
57ded2ed02f25e8d15715c1f0834c529102ec68f

SHA256
0b7ca7fa1baf73bb8cc2a1c49caa819bcf75855d93550743d96f9c49582482f0

SHA512
4a571db8b93e6a4c1c7879b6867e7aef53a10e8ea6b89881e9e0e114efecdab02ca57947cfdf307590a73cfa412b53cc09ac0504ba965a424caf917fe820c6b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8b06632b-f53e-428a-a8b8-69425311442f.tmp

Filesize
10KB

MD5
b93bacf04c9c73f9f5f1c981e5b20011

SHA1
27d1801b32ce01e535325d09bca682ccebb3c21b

SHA256
f4707373ce66c14f4d3a0176690a3e0274fbc0cfd8576bf812c3259ccb2d4e80

SHA512
3b357c70171c93fb833a09d783fff4924ecb5df21d16b4f204c67868f76746f7bcdb9b5dfddba1f4d45fecccf782eafb81aa3c23acc553f3af3cbdc322ccc8d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
8259bc16837e8d26680efdb1c8df4e87

SHA1
ebd370d0605631c57d940a382066d7f99a77d54f

SHA256
df6c91374b62c7354acc826482b6902f3961748222b3f761f41213f389217ee9

SHA512
11a63b8bd2738d36ba834190b7c0fd9cdb0d733983ccd28616be3a60bad9cd5681ec5a75a6239e55fe3cf6afd2441cb5f23c79f24189177de467ddb71f54c5af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
210KB

MD5
48d2860dd3168b6f06a4f27c6791bcaa

SHA1
f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

SHA256
04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

SHA512
172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dc7904426367d4d5d684a221a9a4862e

SHA1
908eae9261a1d6de6ba777fa2aa411b1f6872cc3

SHA256
568dd9f70c7e2cb750882391def8048be268a58ca990e50c2a8e9a1802ffb40d

SHA512
3504706276b3c50b51f4a11f15b0f725803e615973e0135cb751fdf5b0634cf489215cebfb8fc94fa842fc853e36d8462e9b9cd47df9b9ba492dd24445604078

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
e579c69b0d72a151ab78e852be633367

SHA1
2420885554e33bd35f2147d9382aea38bf3103e5

SHA256
bcae0e4c5d13705937319a211a0f4906087de77b12a7a470bdb29dcc3022fa05

SHA512
43ea85751e467527a0f05539ffb18f5e513de538352f04bf69a2383e9fc3d4ad619725c3e892393e2490c3797176da8473c7afe773be64b1016b68396e1d4457

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
49f1974d18cd28884237ff16cb34fd1a

SHA1
0569b5d090829d776aee487baf5ce131787a18f1

SHA256
e05f4844592dca0b715464d3880f9ccb227cbe3e51a0e9b11add96e1813ef9d4

SHA512
9ff7d539daea74debb32cb5a098ee27c49c67dc35367724da4f3039c587de5413da2b31b825019e99cbefb754aac36b45daa6c4a62d3d4a25042f156c3a86c4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
4ef86a1cc585d1895986f7d3652b1659

SHA1
ef7eab3c74c4cbaa8683726c0e158f40bbe1ad36

SHA256
b595d3f193e1320d33efa1d9dc0f3f797dd83c19b0f3d295c82483e939fe607a

SHA512
5eedf7f5a1841957d30d3aa32c6374069f568516d7ee015469ad6c0c4848113008a5f351aa7a36ce7ae067169aae2852fc5514f0f48b5cb58d18e8280cfe9695

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
0a2e5a2f4d825f87bc03f5377b0b4d1b

SHA1
0e695b061dd556cf48ce252c9c7e8aa6458f53e1

SHA256
895e823380ab0dd9b9be4a091c3ee4b89e4766b02a22d59cd401e8d385efcb98

SHA512
a46d7ddeb3d76a08a36860fc8c27120d157a34b187fcfeba36dd8289852ff459d38257d39e62eaec038c7bb278ab86ef70dd143cd2afcea816f1b3350f7c8145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
0bbdfc3015fe780d648997c6c0207ab5

SHA1
6a83a103aa9f27fc8ce800eca668968330b939b8

SHA256
432cd87a628afd86ab82cca7f3c886c73b3e43b0fff675c5af7e7dc7e88fc1b4

SHA512
4f64bf83955678ad2386d558ec4a40df470ac56c5dfdce74364d739a8759cf92470929919e36a1e8e84b3eca399fe994a3a4283fcc56d4d92cb595690186638e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7b53537c4af05fd23905c7d72c6f7f1d

SHA1
20579a53f3acde52c8587d37be42804a32485cb9

SHA256
54f60de8260e41cd3bdf4681da2f8a745ce950f2f6e8669936addd886ffd77c0

SHA512
8983a1bd7b7e96bec6044291e5c58ccc1b5e4bdcdafa38107b006428c8b1ef8d745638287352ec932f7c4cfad3dc09a817c1a379270c3f56b65419641f524fd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
07db06aba7d9d043e58ac9ceec51e411

SHA1
db56ce8bdcfb3559b27d11e46810306feca8b901

SHA256
8cd5bc0b774f02a8bf7106995042037193ea671b4693299e73c1724367dd7355

SHA512
56e0e6b2befe73c99d579fcf9deca09e1693d9b07ada544d0b921547bbd1cf57822e35667ca6c95aeb12a6ba28887f00ee9b00c194fab3852d0ebd743ca09bb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
49eafdce6b7a7a96437aa756ffd13c17

SHA1
8feb33da000691706704bc5c6df93c61afd7f2fa

SHA256
da68e408e319c18eeb590908b88efc12cddd35c52865ae3c7f283e3fd76ea8d4

SHA512
9605075e680377a01085d901e8e63d99ce92a4eb3416bf7f9b2c130d7f30c0fb64be243430ccccad224229c73d78073104f8b2f143d43ce60fe791c44581bb9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f930a9addbb9753047276ebe7342c2ba

SHA1
c4c4f5b1feb2d85dfb1c51e724c7a75105492b7b

SHA256
d5b8d63491011b965a78b802a13ffaa1a3b50961160ac4d1cb7a2d162dfb321a

SHA512
5716e2afdd3e48ead2c46735f60afc371e115f4aee1fb38f0adf4f508d259c0d610c04cfed50e453873a10e46ad2e8c0765abbf997c305163ea11a29b0d803e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6e0d6911330aea6bba07544ca2a5208c

SHA1
5ff418f8968313666cd8e0bf32c0fbbf5ec8ebdb

SHA256
227fb5f9c2a2a323abcb8d7e0db5e3564b661d8095bac7d43784fcff87831d41

SHA512
5d4f6b9f0dbac726ba36fc3eb383572430d4d86eb9985d6db6fe801c621c5ba8a48f82d3f308785b954d0b1407a3bcfeb479f31216d4084c7151790cac488b40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e34ff3e34f75c616db2535579efce0ac

SHA1
d5013298c2fdeda905e1b4f6ad943359912fd205

SHA256
9b2f3f931b8b3d01f87a62b6737defa974cf260571969524239c3c45ceede5fc

SHA512
230228cba15b8797b35032b500f41d75c7cb5df3448a47b3b41b40e5a909041f9069bd9c4e9002a1ee1d43afce9d0f637a26cf41a3650369ab40e3748e0589fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
cdb16fb517e61964762c129fd9dbbedd

SHA1
ac32ebd30294a71b8693dd8a4a85d5e3576790af

SHA256
8707e9b846783cf98a4102b3227bce4b4aad0ba801645270220c470f4ebe001a

SHA512
6e12cdbfc915d19e2fc3e0cbbfa52c286f582f867146ac2790ac6dd97784e3b597dc8e3eb2a4cd0dd88c11a2e1eab895e44b14807c77c38b389315f9c9108e5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
068d90dbc2764e39e789b419573b3502

SHA1
990b676d49b8f41b4de781ec8b8155f51e5eb730

SHA256
0245e895898ad36101897f921fcf38ad894b2b1999a696321d4aa1bf0d2cf5c4

SHA512
957a99bdc7ebe6991a3d38755b2d06bab57f37e029e8401adbff9a1ab623eefd6e4e1cd3e0d9c2c9d71ecc24545d382f2510f76dbdf00aa188c9b276e8dd46f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
84d99ec763664d642403132320c8b997

SHA1
26e17fd2dc94b6ef2aff746079ccad5daaab9f5f

SHA256
6596ce03ce0953b2aec14d0bc819b545af93e75b58ae194c2311352d20d83fc4

SHA512
33842005c1404ffaeaea229d946a5efef15f1ea11ec39b5bccf0505e28395c2cb17d2b4503478842f97ea5ae64a091388815aee440bc42f70445c62c08034a67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
048f8ecfd59c90f97f17080286781510

SHA1
99a27c187b4e122bb809de362fa7b13a621dce01

SHA256
1e089b9addbc6d3e706bf71b06a7e1faa095ab72a70de3406394a7e8148d78af

SHA512
a9801f6e51be11b36cc2dbfd147a8f04c2b6c7883e7b8d0bbbb3175ec637c5b1c0b31b4feab828be2aa7670af427ff08cf401c20c0335a862f3f1ec00fbcc4b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e9f0fd50ad912f574835b39af0f19a98

SHA1
190ed6a3121ac894dbe11684550d5cb6b7bd633d

SHA256
73c08d7c5c512b304efa4ff25236b9358cacd5ca5b098b7890e3093d84b797c1

SHA512
2eae41ffe31ba4275ebc06df24fe4afc7bdc0bec1e4d43c724718cd09b696c60fd92f9dcf02ab9a5bb58ecb0ecbc0de8153a49c00b2794cddef0eb909cef993b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7bcfc5290304a0be62a816e272eb94cd

SHA1
51d0d070bc468c53bfef6f4ff22025e20c415667

SHA256
16bb96b4430dd558f3d2b1e0661a9ab75a162e8e7735dd69348c8ee97308a14d

SHA512
b624428afcf003d234e6ca2b1918e92ec285ef4e418a870dcfefaef16be96193b22bbffc645b59252a79aa4f678a5a656176b7861d7ec3d5c6c945903784927d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
042f76021a628c3159ae47c4215fe35e

SHA1
ee7312ec0f779d66395cf170bd5543b032b49e84

SHA256
91e9b1623074f7923ba0853f257170db2bbd24cb3a90eefd5eb91d36ccdb1b01

SHA512
ec57c265eb05759ad3da12388fb3751d95baaafcb3195b738ac384e2a8faa3282728112d92aa7ecdb2e542c023109b9327461e442b6aa6ac1b7f7c294ef6a4af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
77fa2053dc19826dbaa2e4323a6db6a9

SHA1
6166a6079d22d0bff493cdc3fff743f386e952d8

SHA256
4968f780308e6c45f339659d481d544ff6fcd853941e6352158be4163146d500

SHA512
aecbcdff693ef2227cfbadc5da60c2c69a9fe0e7b2f3b2290c011e82c06af009eafada61937a0f87bc1a2b6e6d490fd4fd633233e5e8b4eb55ef22d25dc14c82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
20df70ccde1cc9d13a3d138bbcc2a8fd

SHA1
5abfe0bf56f54878bfa083d40956eba0efda1d58

SHA256
54d132fe714cde7a31c8edf6ea0b27e741c5a0732711ef17122db44aac3e3804

SHA512
8d7b98bc605ee853a078906dba10f8e024533d4eabc6879b43aa3f070afd91ef15e869130dc547743313e9ba4acea733171ea345299ab5ccd3eee7426a69838a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5daf404826934e44ce726bf961a72330

SHA1
cf466c42863edb392fb65fa1fd097ae371f6d939

SHA256
68b7326bda720f9b85530d75cd18458343573e06f87654b00174358572a6fea4

SHA512
31e7de1219a455df5ea6fb5271810bcb6e2537e7671dac0842284e49a79affced9b2c10cacfe3e79ae26cdb2f4e0ebb6183e5f27424d42c36687d69b09e93621

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4ffd0bcaf57cce36f564ef9e1524293c

SHA1
f349f6b2b21e8b354fbf3e5316b3348a8a2cb477

SHA256
90bccf4ec4a47b62debf8abc7b2e54148113bbf3cbe25d16bb64be59f0f9d05f

SHA512
61178ed02b1fa7d68eeccc01d0999ca04f7ef3a4507eb6558981912d716d583c90cfef5f07d38911cdc2e1298107493d97fdf8e9155915162132bd344d6d8bfb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0de7713eea2d45bd5a867fb1d638c78f

SHA1
187c1bb45284a2a2d96a2945277b4f665f9446e3

SHA256
f9025c5f2a79c1198b4b32681528ef1457aaa6c340875c9297f69d5b36449839

SHA512
800782f6801b98590d2ae34ee94e59a71740c4b1f6966ca6c2bf20d78c241c41cf1491e2e72bbdee082a69b8d00d60b98f9531ca538ce4798e0b8ef9996595d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d9cfb7e7d732d050941427d15c4dc6c5

SHA1
a873ee896f1717a6011588f071d09f070bbfe5b1

SHA256
94e56b4a478962c473e1ebd5a96876c7c7af0b36c9f969416b3fed1f7f9675a6

SHA512
dc198fc379690d69ac756831d1f06a7ca3a6c35a39bc9f96199124fa19b0bae582e8c172abbd5133795051d0e9e0451d5704e608aa106b35c980a5c752cd4ffb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
bd80b60e76323474541a38ab60401ed6

SHA1
b323024acc4c4acdef89d22a71d351a5916fba0a

SHA256
06649db63a889b573e01ef2fac1476998dd09c6608d01c5f39221322e22b8b3a

SHA512
a4fe6d10df55d471fd485c287ebe36737ddfea65d8d259e38542f01bbeb133e3330778bdd2f0af9f4a0a40cd1d40534890783da79422a5154d86fd2d683f326c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5cd4855330818b14a8f1ddac729aef63

SHA1
3afc9f2dff79413e278a6f373b93d51d3fb20e53

SHA256
6a45732c782c94bba59a169f84a4ce5c06caa4876041791ecafe6c9482181afe

SHA512
b995c8a35caa33910fbb72915b663a5d2e9e46174c9cb666100dd54e02805ce3c04ff59e166e3c2298531b2969ab7f5d896063bed89c333b079185e08b618acf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
176387a512eec2a5c6f72d8a5faf095d

SHA1
5a85a7feaf7a381614552a29a542ad5f4cfca9b8

SHA256
a6bdeee96edc565998714c4c5687bf1931b08a04cc91d560f2d5f3ef817f62b2

SHA512
f1052c2c23637d0a105711eb842dbba8a42d6616cb2faa87a68fe354caae33c90cba700bb40f076763e5d8ca05354290c1335a1021e13c9cf1f37d721b37ff60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
cfbf7e3ab640468570f39302903eb9e0

SHA1
27d0852a3bb760cb71192219632da7878b3f395e

SHA256
9c6c032a6eb452b4426741e91f094813ad78c9c88a08fc9c6f7064ae00f47555

SHA512
d1d16742792885d46ba51c81dfcbfbd5c2f9789113ed27fc492f040923314f7481d4beb01266e40966fd494dbc187895d642b03ffff0d75507c52ecc36aa3649

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
b27fe18efa3f2950f2dc3ed192f3e4de

SHA1
fab3b860c5d7e70cbf93272a3eb0db9cab692f28

SHA256
66fc43694a1070ab2406883e7a07b36e4e4ab5add5a1dd457a75de1a4db2f03c

SHA512
2acef74fa0692ea7383dfb98239584c6b35b8a25fce47be2c772ffcd61e5bdba32a156dcc56c7689c69959f8938a40968f2d62bd79eead38aec4d208e2ce34c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

Filesize
114KB

MD5
c4b9babaffac86aebbcf26a139a63fd9

SHA1
99a5b22be0e5ad6aafb50aa1d502430b30a3d3a2

SHA256
cfe1e6cd0824badd88744b024ef0f983e4287f39b97795f77fc80a636ba88b25

SHA512
236380aee9d9017ac815a1f7252ec061c4b506c7bf39d185b7e2fe2a38db073d7507638a3e4253ac0b3fce2cfa38171b2b3b499be137fffd1b7ab03e3eb479b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
9a517068901d3bf5db9977dd327a8d31

SHA1
46c4a0147e486d5ee98b526b69703dd02b671191

SHA256
36f0d7d7bcad98546cfe381ea6c1919426a1732f59887e67392cfb22d9545d0f

SHA512
64377fc5cfcfcf6449641c3560ffdaca31e3cdb21039b1ec838d11b7693b051e7cce40f84853bb148d901cb3eb85fda38df2995a70fe6909250894c900c1f34e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
2587630573e4c46a45d87f496059712b

SHA1
d028e831b11c50b48892b5cf1f9d5e9e768b84d7

SHA256
14fbdb4f29555d96a8054dbe3fc409d810898599c8c448a217b589e65236be06

SHA512
4a7a67b47e9e7b00ed4068cd658e980d7e1818457de1afa3a6b78f2c3b9fe82d26d6ba16db1884f927349164e23d662d9a926f9d52cd655cb05e26a5329ed98a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
d8ec8d459e9f91dbb85dcad65fafcb07

SHA1
cee6c1884bbb40cccfd8691b6208a40a154563f9

SHA256
4a6455a6139e97b05e1b647fbaff179c161f8e5c0e408693e37186cad5b4e1aa

SHA512
f3b4875103f21656c98425acc39fc8a2b11422c195c2fd254aad1cb0416603279208ff4287b44b7f089f20f71aab707b3f206529480fe5da0d37846b385c60c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO SAI FOOD PVT LTD .exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
bea9beb9cbecf34cbb3be681ad2265fe

SHA1
58db78ce8ccf124e88a97e8bb17aacf657a0181e

SHA256
b93fa5ca0be86c21f0539c6ffeda8ee5a5d9136db8b02684992f4ff1722a9e13

SHA512
d353835f729e49a09cd347943d457d16794b1cb05c12c9fd28dbbcecd0112e4a27602f2a561239dec87ba99108b1e5b69e6128c406996414f0d89d2114707858

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
f98c091bbcaf4d251beadf5169330e0f

SHA1
1f551e571a113358d2f0c84e965f970dc46d7dcf

SHA256
af45363647d339044574c1fea6b62e58d8356ef40f2ac5bbabeef89bdb077418

SHA512
851d47a9112302f2e86ceb36a4bac9ed03960ce03ec3b459add7acf4e8b3b61fe9ab5b5a16032461aaafaf62a301b5aa906757ac05f54dda9c80d7d5e759c5ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
798feda67487d2b72ebd31725448cb34

SHA1
2195ff4dbdeb500de6e78c8adbb4db8faa26860a

SHA256
a47cc6bfac4c5620ec8c4bfc9edee0052735f32380601ee6441ee859f31c6c2f

SHA512
6ade90c202a8e121cf1a746fc7f7155f8cdafbef59e1982fc258574b665073716b98e242e6fd320c7a1fa77858cb62c4f50beb8c861832fa2d14699ef2676cbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
1140d0d82b81472235bb708bb2605f56

SHA1
21e4304595ba8c8c0c2effb3a5fa68192f27a5df

SHA256
6780298ffd7b758280896d4a25c98609ed4edc1223061f089a9f9b45f346f009

SHA512
386bf6184503c1b3a4cbd355f04a80f360a29dda52fa02c0ae4a0e04e663a4f2b27358fbf5904ca1f815d45da31799e1e43e3457331bbca153e10b8215780400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
104B

MD5
9ab7b35cbc4b7fc598947bc5152a3a4a

SHA1
5b5cc7217910ce59afaac2c26fb7c099c3eeb259

SHA256
ce964fdabee860f070b2a48dcaef9f89060357ffd2a6361056929073e422ff9e

SHA512
3e2353618e279844c170a67dea8779a731544a9c693bcaa05a99e10de5fed84e2ea7c2e5a627f2be9e51f4527654fb1be753190bc26d67bacaf1704b54b929d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xtz2wtq5.xwj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\holderwb.txt

Filesize
3KB

MD5
f94dc819ca773f1e3cb27abbc9e7fa27

SHA1
9a7700efadc5ea09ab288544ef1e3cd876255086

SHA256
a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

SHA512
72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3822.tmp

Filesize
1KB

MD5
00d79555357dbfce97f107a82195d24d

SHA1
45c3f48be71fdabb37bf078041bf7a780611f50f

SHA256
8a3aae7c6c6512591a552a35b1c67680a3ce3455f731a32d8376d9372af424cc

SHA512
f6941cdf1388959168b2b5034ae2ece5c79572228539f5b2ba9f0105f1ac5469b60109dc1928a75d88b47d6d7e2fed569416543099b3e014a168863475b42918

Download Submit
C:\Users\Admin\Downloads\PO SAI FOOD PVT LTD .exe

Filesize
1.0MB

MD5
dea59d578e0e64728780fb67dde7d96d

SHA1
b23c86a74f5514ebcfb8e3f102a4b16f60ff4076

SHA256
71dbb1177cb271ab30531fda54cad0f1ea8be87182f96bf21f37dcf65758f6ce

SHA512
64663c97bcea47b6c265df2598e12b1dfeb437efc6e78a6a23cf0a02cfeaf28b054cc5af85b2d1aff3822c5d5b82905952db2722e095e138a0bf0203977d4bce

Download Submit
C:\Users\Admin\Downloads\PO-SAI FOOD PVT LTD.zip.crdownload

Filesize
958KB

MD5
cfd18de0f6749bd51ee42cd4ead6e2ee

SHA1
6c68fcd05b9809121552b8b319300917412ee528

SHA256
cef63ea66f943ee8b266a07ebbc4a9756b58fa73ef6ddc19eb1ae4a81468db44

SHA512
f30274724d10ebaadc30c9a43d312063bc960c5968dabc6f70753fb8d6d5d68280b67888bc7c8081328b45fb8ae7e92926271d74e4e3c2102df055e33d0ebe1f

Download Submit
\??\pipe\crashpad_2728_KKBTXPLBAHALSYNY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1084-117-0x0000000006080000-0x00000000063D4000-memory.dmp

Filesize
3.3MB

Download
memory/1084-154-0x00000000079C0000-0x00000000079CA000-memory.dmp

Filesize
40KB

Download
memory/1084-151-0x0000000007820000-0x00000000078C3000-memory.dmp

Filesize
652KB

Download
memory/1084-162-0x0000000007C70000-0x0000000007C78000-memory.dmp

Filesize
32KB

Download
memory/1084-126-0x00000000066C0000-0x000000000670C000-memory.dmp

Filesize
304KB

Download
memory/1084-159-0x0000000007B80000-0x0000000007B8E000-memory.dmp

Filesize
56KB

Download
memory/1084-95-0x0000000005970000-0x0000000005F98000-memory.dmp

Filesize
6.2MB

Download
memory/1084-130-0x0000000070FB0000-0x0000000070FFC000-memory.dmp

Filesize
304KB

Download
memory/1084-129-0x0000000006C00000-0x0000000006C32000-memory.dmp

Filesize
200KB

Download
memory/1084-141-0x00000000077F0000-0x000000000780E000-memory.dmp

Filesize
120KB

Download
memory/1616-313-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1616-314-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1616-337-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2256-156-0x0000000007510000-0x0000000007521000-memory.dmp

Filesize
68KB

Download
memory/2256-94-0x0000000004A10000-0x0000000004A46000-memory.dmp

Filesize
216KB

Download
memory/2256-98-0x00000000058B0000-0x0000000005916000-memory.dmp

Filesize
408KB

Download
memory/2256-97-0x0000000005740000-0x00000000057A6000-memory.dmp

Filesize
408KB

Download
memory/2256-161-0x0000000007650000-0x000000000766A000-memory.dmp

Filesize
104KB

Download
memory/2256-96-0x0000000005020000-0x0000000005042000-memory.dmp

Filesize
136KB

Download
memory/2256-160-0x0000000007550000-0x0000000007564000-memory.dmp

Filesize
80KB

Download
memory/2256-125-0x0000000005FF0000-0x000000000600E000-memory.dmp

Filesize
120KB

Download
memory/2256-140-0x0000000070FB0000-0x0000000070FFC000-memory.dmp

Filesize
304KB

Download
memory/2256-152-0x0000000007990000-0x000000000800A000-memory.dmp

Filesize
6.5MB

Download
memory/2256-153-0x0000000007310000-0x000000000732A000-memory.dmp

Filesize
104KB

Download
memory/2256-155-0x0000000007590000-0x0000000007626000-memory.dmp

Filesize
600KB

Download
memory/2292-533-0x0000000070D00000-0x0000000070D4C000-memory.dmp

Filesize
304KB

Download
memory/2292-500-0x00000000062A0000-0x00000000065F4000-memory.dmp

Filesize
3.3MB

Download
memory/2328-179-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2328-180-0x0000000000420000-0x00000000004E9000-memory.dmp

Filesize
804KB

Download
memory/2328-178-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2328-183-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2448-438-0x0000000007AA0000-0x0000000007B43000-memory.dmp

Filesize
652KB

Download
memory/2448-450-0x0000000007E20000-0x0000000007E34000-memory.dmp

Filesize
80KB

Download
memory/2448-428-0x0000000070D00000-0x0000000070D4C000-memory.dmp

Filesize
304KB

Download
memory/2448-414-0x0000000006330000-0x0000000006684000-memory.dmp

Filesize
3.3MB

Download
memory/2448-449-0x0000000007DE0000-0x0000000007DF1000-memory.dmp

Filesize
68KB

Download
memory/3380-121-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/3380-177-0x0000000008260000-0x0000000008268000-memory.dmp

Filesize
32KB

Download
memory/3380-124-0x0000000005A10000-0x0000000005A66000-memory.dmp

Filesize
344KB

Download
memory/3872-532-0x0000000007940000-0x00000000079E3000-memory.dmp

Filesize
652KB

Download
memory/3872-522-0x0000000070D00000-0x0000000070D4C000-memory.dmp

Filesize
304KB

Download
memory/4352-282-0x0000000070D00000-0x0000000070D4C000-memory.dmp

Filesize
304KB

Download
memory/4488-521-0x0000000005590000-0x00000000055A6000-memory.dmp

Filesize
88KB

Download
memory/4660-64-0x0000000005A80000-0x0000000006024000-memory.dmp

Filesize
5.6MB

Download
memory/4660-65-0x00000000055B0000-0x0000000005642000-memory.dmp

Filesize
584KB

Download
memory/4660-66-0x0000000005760000-0x000000000576A000-memory.dmp

Filesize
40KB

Download
memory/4660-67-0x0000000005880000-0x000000000589E000-memory.dmp

Filesize
120KB

Download
memory/4660-63-0x0000000000B00000-0x0000000000C0C000-memory.dmp

Filesize
1.0MB

Download
memory/4660-87-0x00000000058B0000-0x00000000058C6000-memory.dmp

Filesize
88KB

Download
memory/4660-88-0x0000000008ED0000-0x0000000008F9A000-memory.dmp

Filesize
808KB

Download
memory/4660-89-0x000000000C040000-0x000000000C0DC000-memory.dmp

Filesize
624KB

Download
memory/4660-62-0x0000000074C5E000-0x0000000074C5F000-memory.dmp

Filesize
4KB

Download
memory/4832-439-0x0000000070D00000-0x0000000070D4C000-memory.dmp

Filesize
304KB

Download
memory/5008-256-0x00000000056A0000-0x00000000059F4000-memory.dmp

Filesize
3.3MB

Download
memory/5008-279-0x00000000062B0000-0x00000000062FC000-memory.dmp

Filesize
304KB

Download
memory/5008-281-0x0000000070D00000-0x0000000070D4C000-memory.dmp

Filesize
304KB

Download
memory/5008-299-0x0000000006F10000-0x0000000006FB3000-memory.dmp

Filesize
652KB

Download
memory/5008-302-0x0000000007240000-0x0000000007251000-memory.dmp

Filesize
68KB

Download
memory/5008-303-0x0000000007290000-0x00000000072A4000-memory.dmp

Filesize
80KB

Download
memory/5564-573-0x0000000070D00000-0x0000000070D4C000-memory.dmp

Filesize
304KB

Download
memory/5564-551-0x00000000054D0000-0x0000000005824000-memory.dmp

Filesize
3.3MB

Download
memory/5600-583-0x0000000070D00000-0x0000000070D4C000-memory.dmp

Filesize
304KB

Download