vidar | 1f7746f66fe34a60c699d206480985db98616fa0c5bb990db70d808efe0ffd22

Resubmissions

10-11-2024 17:20

241110-vwe3wavjhk 10

Analysis

max time kernel
121s
max time network
183s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-11-2024 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Unlock_Tool.zip
Size

49.7MB
MD5

b94ff5c9d88bb94471136eb639a64420
SHA1

c2b2053f395f50a82503b084af65e8e803efabc9
SHA256

1f7746f66fe34a60c699d206480985db98616fa0c5bb990db70d808efe0ffd22
SHA512

cea383399d2d2b94e50e92948faf3d5403100edd76d17b108ba06e7560834cee6d73924df581e47fd8f55b82bff2c45fe2fa2685d64c9ceec28698ae41bb7c96
SSDEEP

1572864:6aM2esxP+a3sRkaLwu/0WBJAZ229eBddBe7EDfNMAO:VMna8Pwa0m222Sd26vO

Score

10^/10

vidar credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

https://t.me/gos90t

https://steamcommunity.com/profiles/76561199800374635

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Signatures

Detect Vidar Stealer 27 IoCs

stealer

resource	yara_rule
behavioral1/memory/2680-29-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-22-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-24-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-27-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-20-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-173-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-192-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-217-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-236-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-301-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-330-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-339-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-374-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-480-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-501-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-544-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/2680-563-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1772-1390-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1772-1413-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1772-1442-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1772-1465-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1772-1558-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1772-1581-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1772-1588-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1772-1611-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1772-1763-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/1772-1786-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 12 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3064	chrome.exe
2540	chrome.exe
1972	chrome.exe
2688	chrome.exe
2044	chrome.exe
2104	chrome.exe
1948	chrome.exe
2124	chrome.exe
2728	chrome.exe
2112	chrome.exe
2216	chrome.exe
2596	chrome.exe

Executes dropped EXE 8 IoCs

pid	Process
572	Unlock_Tool_v2.5.6.exe
2680	Unlock_Tool_v2.5.6.exe
1192	Unlock_Tool_v2.5.6.exe
2540	Unlock_Tool_v2.5.6.exe
1772	Unlock_Tool_v2.5.6.exe
2264	Unlock_Tool_v2.5.6.exe
1532	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe

Loads dropped DLL 16 IoCs

pid	Process
572	Unlock_Tool_v2.5.6.exe
2860	WerFault.exe
2860	WerFault.exe
2860	WerFault.exe
2680	Unlock_Tool_v2.5.6.exe
2680	Unlock_Tool_v2.5.6.exe
2848	WerFault.exe
2848	WerFault.exe
2848	WerFault.exe
1772	Unlock_Tool_v2.5.6.exe
1772	Unlock_Tool_v2.5.6.exe
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 572 set thread context of 2680	572	Unlock_Tool_v2.5.6.exe	33
PID 1192 set thread context of 1772	1192	Unlock_Tool_v2.5.6.exe	60
PID 2264 set thread context of 752	2264	Unlock_Tool_v2.5.6.exe	85

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2860	572	WerFault.exe	31
2848	1192	WerFault.exe	57
2704	2264	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_v2.5.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_v2.5.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_v2.5.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_v2.5.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_v2.5.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unlock_Tool_v2.5.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Unlock_Tool_v2.5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Unlock_Tool_v2.5.6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Unlock_Tool_v2.5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Unlock_Tool_v2.5.6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Unlock_Tool_v2.5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Unlock_Tool_v2.5.6.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
2868	timeout.exe
924	timeout.exe
1648	timeout.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Unlock_Tool_v2.5.6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Unlock_Tool_v2.5.6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Unlock_Tool_v2.5.6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Unlock_Tool_v2.5.6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Unlock_Tool_v2.5.6.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2040	NOTEPAD.EXE
2000	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
2464	7zFM.exe
2680	Unlock_Tool_v2.5.6.exe
2680	Unlock_Tool_v2.5.6.exe
3064	chrome.exe
3064	chrome.exe
2680	Unlock_Tool_v2.5.6.exe
2680	Unlock_Tool_v2.5.6.exe
2680	Unlock_Tool_v2.5.6.exe
2680	Unlock_Tool_v2.5.6.exe
2464	7zFM.exe
1772	Unlock_Tool_v2.5.6.exe
1772	Unlock_Tool_v2.5.6.exe
2216	chrome.exe
2216	chrome.exe
1772	Unlock_Tool_v2.5.6.exe
1772	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
1948	chrome.exe
1948	chrome.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe
752	Unlock_Tool_v2.5.6.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2464	7zFM.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeRestorePrivilege	2464	7zFM.exe
Token: 35	2464	7zFM.exe
Token: SeSecurityPrivilege	2464	7zFM.exe
Token: SeSecurityPrivilege	2464	7zFM.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeShutdownPrivilege	3064	chrome.exe
Token: SeSecurityPrivilege	2464	7zFM.exe
Token: SeRestorePrivilege	2792	7zG.exe
Token: 35	2792	7zG.exe
Token: SeSecurityPrivilege	2792	7zG.exe
Token: SeSecurityPrivilege	2792	7zG.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	2216	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe
Token: SeShutdownPrivilege	1948	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2464	7zFM.exe
2464	7zFM.exe
2464	7zFM.exe
2464	7zFM.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
3064	chrome.exe
2464	7zFM.exe
2792	7zG.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe
2216	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 572	2464	7zFM.exe	31
PID 2464 wrote to memory of 572	2464	7zFM.exe	31
PID 2464 wrote to memory of 572	2464	7zFM.exe	31
PID 2464 wrote to memory of 572	2464	7zFM.exe	31
PID 572 wrote to memory of 2680	572	Unlock_Tool_v2.5.6.exe	33
PID 572 wrote to memory of 2680	572	Unlock_Tool_v2.5.6.exe	33
PID 572 wrote to memory of 2680	572	Unlock_Tool_v2.5.6.exe	33
PID 572 wrote to memory of 2680	572	Unlock_Tool_v2.5.6.exe	33
PID 572 wrote to memory of 2680	572	Unlock_Tool_v2.5.6.exe	33
PID 572 wrote to memory of 2680	572	Unlock_Tool_v2.5.6.exe	33
PID 572 wrote to memory of 2680	572	Unlock_Tool_v2.5.6.exe	33
PID 572 wrote to memory of 2680	572	Unlock_Tool_v2.5.6.exe	33
PID 572 wrote to memory of 2680	572	Unlock_Tool_v2.5.6.exe	33
PID 572 wrote to memory of 2680	572	Unlock_Tool_v2.5.6.exe	33
PID 572 wrote to memory of 2680	572	Unlock_Tool_v2.5.6.exe	33
PID 572 wrote to memory of 2860	572	Unlock_Tool_v2.5.6.exe	34
PID 572 wrote to memory of 2860	572	Unlock_Tool_v2.5.6.exe	34
PID 572 wrote to memory of 2860	572	Unlock_Tool_v2.5.6.exe	34
PID 572 wrote to memory of 2860	572	Unlock_Tool_v2.5.6.exe	34
PID 2680 wrote to memory of 3064	2680	Unlock_Tool_v2.5.6.exe	37
PID 2680 wrote to memory of 3064	2680	Unlock_Tool_v2.5.6.exe	37
PID 2680 wrote to memory of 3064	2680	Unlock_Tool_v2.5.6.exe	37
PID 2680 wrote to memory of 3064	2680	Unlock_Tool_v2.5.6.exe	37
PID 3064 wrote to memory of 556	3064	chrome.exe	38
PID 3064 wrote to memory of 556	3064	chrome.exe	38
PID 3064 wrote to memory of 556	3064	chrome.exe	38
PID 3064 wrote to memory of 1684	3064	chrome.exe	39
PID 3064 wrote to memory of 1684	3064	chrome.exe	39
PID 3064 wrote to memory of 1684	3064	chrome.exe	39
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40
PID 3064 wrote to memory of 2612	3064	chrome.exe	40

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Unlock_Tool.zip"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\7zO0A948757\Unlock_Tool_v2.5.6.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0A948757\Unlock_Tool_v2.5.6.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Users\Admin\AppData\Local\Temp\7zO0A948757\Unlock_Tool_v2.5.6.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO0A948757\Unlock_Tool_v2.5.6.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3064
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef74c9758,0x7fef74c9768,0x7fef74c9778
        5⤵
        
        PID:556
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:1684
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1108 --field-trial-handle=1336,i,11636689374831299010,16203849014666608871,131072 /prefetch:2
        5⤵
        
        PID:2612
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1336,i,11636689374831299010,16203849014666608871,131072 /prefetch:8
        5⤵
        
        PID:2088
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1336,i,11636689374831299010,16203849014666608871,131072 /prefetch:8
        5⤵
        
        PID:2400
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2300 --field-trial-handle=1336,i,11636689374831299010,16203849014666608871,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2312 --field-trial-handle=1336,i,11636689374831299010,16203849014666608871,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2728
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1448 --field-trial-handle=1336,i,11636689374831299010,16203849014666608871,131072 /prefetch:2
        5⤵
        
        PID:1648
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1372 --field-trial-handle=1336,i,11636689374831299010,16203849014666608871,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2112
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3508 --field-trial-handle=1336,i,11636689374831299010,16203849014666608871,131072 /prefetch:8
        5⤵
        
        PID:2116
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3608 --field-trial-handle=1336,i,11636689374831299010,16203849014666608871,131072 /prefetch:8
        5⤵
        
        PID:1032
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3516 --field-trial-handle=1336,i,11636689374831299010,16203849014666608871,131072 /prefetch:8
        5⤵
        
        PID:1764
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AKKECAFBFHJD" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:2252
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 100
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2860

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2608

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap5425:94:7zEvent25730
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2792

C:\Users\Admin\Desktop\Unlock_Tool_v2.5.6.exe
"C:\Users\Admin\Desktop\Unlock_Tool_v2.5.6.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1192
- C:\Users\Admin\Desktop\Unlock_Tool_v2.5.6.exe
  "C:\Users\Admin\Desktop\Unlock_Tool_v2.5.6.exe"
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Users\Admin\Desktop\Unlock_Tool_v2.5.6.exe
  "C:\Users\Admin\Desktop\Unlock_Tool_v2.5.6.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7249758,0x7fef7249768,0x7fef7249778
      4⤵
      PID:2944
  - - C:\Windows\system32\ctfmon.exe
      ctfmon.exe
      4⤵
      PID:2064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1248,i,18380023627311144317,6662994062068605356,131072 /prefetch:2
      4⤵
      PID:2992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1452 --field-trial-handle=1248,i,18380023627311144317,6662994062068605356,131072 /prefetch:8
      4⤵
      PID:1528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1512 --field-trial-handle=1248,i,18380023627311144317,6662994062068605356,131072 /prefetch:8
      4⤵
      PID:2124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1248,i,18380023627311144317,6662994062068605356,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2320 --field-trial-handle=1248,i,18380023627311144317,6662994062068605356,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1708 --field-trial-handle=1248,i,18380023627311144317,6662994062068605356,131072 /prefetch:2
      4⤵
      PID:1708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2208 --field-trial-handle=1248,i,18380023627311144317,6662994062068605356,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3492 --field-trial-handle=1248,i,18380023627311144317,6662994062068605356,131072 /prefetch:8
      4⤵
      PID:2504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3612 --field-trial-handle=1248,i,18380023627311144317,6662994062068605356,131072 /prefetch:8
      4⤵
      PID:2508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 --field-trial-handle=1248,i,18380023627311144317,6662994062068605356,131072 /prefetch:8
      4⤵
      PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AAEGHJKJKKJD" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2648
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 116
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:2848

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2040

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:768

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2000

C:\Users\Admin\Desktop\Unlock_Tool_v2.5.6.exe
"C:\Users\Admin\Desktop\Unlock_Tool_v2.5.6.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2264
- C:\Users\Admin\Desktop\Unlock_Tool_v2.5.6.exe
  "C:\Users\Admin\Desktop\Unlock_Tool_v2.5.6.exe"
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Users\Admin\Desktop\Unlock_Tool_v2.5.6.exe
  "C:\Users\Admin\Desktop\Unlock_Tool_v2.5.6.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7209758,0x7fef7209768,0x7fef7209778
      4⤵
      PID:1124
  - - C:\Windows\system32\ctfmon.exe
      ctfmon.exe
      4⤵
      PID:1000
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1368,i,1906939255340735482,8184537930579995090,131072 /prefetch:2
      4⤵
      PID:1212
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1368,i,1906939255340735482,8184537930579995090,131072 /prefetch:8
      4⤵
      PID:1800
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1368,i,1906939255340735482,8184537930579995090,131072 /prefetch:8
      4⤵
      PID:1884
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2296 --field-trial-handle=1368,i,1906939255340735482,8184537930579995090,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2328 --field-trial-handle=1368,i,1906939255340735482,8184537930579995090,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=972 --field-trial-handle=1368,i,1906939255340735482,8184537930579995090,131072 /prefetch:2
      4⤵
      PID:2756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1312 --field-trial-handle=1368,i,1906939255340735482,8184537930579995090,131072 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2688
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3464 --field-trial-handle=1368,i,1906939255340735482,8184537930579995090,131072 /prefetch:8
      4⤵
      PID:2856
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3584 --field-trial-handle=1368,i,1906939255340735482,8184537930579995090,131072 /prefetch:8
      4⤵
      PID:848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3720 --field-trial-handle=1368,i,1906939255340735482,8184537930579995090,131072 /prefetch:8
      4⤵
      PID:2104
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IDHDGDHJEGHI" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1612
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 116
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:2704

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AAEGHJKJKKJD\GDHIID

Filesize
6KB

MD5
bbb4dbd9a1f0c01ae936b7d0a06d1805

SHA1
a2c2b38fd3013692a828c6c40b9349f647789a79

SHA256
0dc0cfe8ad4121493c067796767ce194786de444bdce937e5c9cfcc2bc71e78f

SHA512
a4ca58ed8ec1207cafdb1ad48d748c1feec49342b14957953dc0bb5b2fdcaf74b89c0f713a38b45b94face57459fe3816c1e3ff297b43661bbde5f14a5188fbf

Download Submit
C:\ProgramData\AAEGHJKJKKJD\HCFBKK

Filesize
92KB

MD5
102841a614a648b375e94e751611b38f

SHA1
1368e0d6d73fa3cee946bdbf474f577afffe2a43

SHA256
c82ee2a0dc2518cb1771e07ce4b91f5ef763dd3dd006819aece867e82a139264

SHA512
ca18a888dca452c6b08ad9f14b4936eb9223346c45c96629c3ee4dd6742e947b6825662b42e793135e205af77ad35e6765ac6a2b42cefed94781b3463a811f0a

Download Submit
C:\ProgramData\AAEGHJKJKKJD\IIJEBF

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\ProgramData\IDHDGDHJEGHI\JKECFCFBG

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\ProgramData\IDHDGDHJEGHI\KJJJDH

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\ProgramData\IDHDGDHJEGHI\KJJJDH

Filesize
5.0MB

MD5
c5ec8e3a3ac8a0b4def250704fadbe97

SHA1
0673f991bef6c568e04e37ae93567ab6369b8b46

SHA256
d72959f1ac7ba38109198851384bac6b086b0b4d859334719d8898b81ce4ca70

SHA512
2094ed53e365418bfc58ea71947280e71f712a20a28c1f49c44b3128032796a3066323a717dc74e4240fd03187c007660b285a5a300d5603d68ae61847e562d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
727208ad6b7b05f61589df9601e4e979

SHA1
730238d0a29a763d1b8bc9b9ad6a0de1d3c68c48

SHA256
314ef9060659363bd00f1f0b394ee3fa234b95b3c0e18a3387692d90560799fe

SHA512
a2360503ef3a7f6ceda2fe30ffee28e530d50bc79443c99b5e250ffd18e331c8279eb7e8bdd3eae2ed928efc3a5b538900c4786e5dc6d3e8ed7955967b419bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a17762fdd5b3557f233afdbc48567da

SHA1
530843e885358a1d61306e26ac2b1fef5b8f580d

SHA256
c382e9214802f509d8c185ed9c340a1f6ba1203803066fe54328f9fa398d610d

SHA512
8a2c08d180e392f05be70294d8c7516eb96b0cb3724f87986309a90cbdfc741e5a2a697aa9cd2b972aaa8f17a3622ebd5da61125d09b7f88e3c9b1acc52511fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
3d382785322b299d80009a15f2ba841d

SHA1
c1c52b11fe2d1f4fb4a58d6e67171f48b814de6e

SHA256
c0cb3b9bde4fc5e23dca627c9f3d2a6b7344a6a10c20eb113f5778347c84a186

SHA512
92b56a0f2d4dfb3927ca18ed903babf5ed6e9429bdea84596c249619f4d869a387f1b7dc0e11037b8d901bec46be0077135a10756f7ae425b334f64f65cac9ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
0b530b460984a4f426653ed26a1f4bb6

SHA1
edb24a93c8571a55ddd939adca272c03fa52afcf

SHA256
c9eaeb4802f9030d9ed0002b8bfc655f81638e29cb5e15ad7eccbad8174f7bb8

SHA512
a138ef8dbb4697cc92b7ba2b8b3d750f661b90d469071be66242318b6dc050e9fcd57184daea8786d7650a426407e65140aade27eb212789c54ec868d5c094fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
29acc7d11d4391748f3d1253849a2e0b

SHA1
3ff5749dfe8a28085a4a40cb88a60e498cbd9175

SHA256
8e133e9d24921ee093ae9b9b18270faa284d0adb2d88ee326ec85cb0642ba8e5

SHA512
0a6eec4b96e4f9f9886f5607684d94a603f240d5a2964e9f5698bdb8c93eada7c7c6959d0a339c2ebc5c21069412074199b26ef82969222ae1700150134eeaac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000009.dbtmp

Filesize
16B

MD5
979c29c2917bed63ccf520ece1d18cda

SHA1
65cd81cdce0be04c74222b54d0881d3fdfe4736c

SHA256
b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

SHA512
e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000011.dbtmp

Filesize
16B

MD5
6de46ed1e4e3a2ca9cf0c6d2c5bb98ca

SHA1
e45e85d3d91d58698f749c321a822bcccd2e5df7

SHA256
a197cc479c3bc03ef7b8d2b228f02a9bfc8c7cc6343719c5e26bebc0ca4ecf06

SHA512
710620a671c13935820ed0f3f78269f6975c05cf5f00542ebc855498ae9f12278da85feef14774206753771a4c876ae11946f341bb6c4d72ebcd99d7cff20dcd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

Filesize
136B

MD5
1467455a3518b754fefebc2e7ac85994

SHA1
15a81a49b4d7cc79cdefba6ab682527aa4950139

SHA256
76090f41fb32b40e70343b0345747f8bdb5c28adfb0566e65a7e63733896b126

SHA512
36bbc8e8115b0997fe50f67e32e268293daf6ebce5e7ded75f0a513ee8368eca4cf9dd53e1de1fa8bf0b3d8542cc969b56dcf059d1570d32568288d4908ce6d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000007

Filesize
50B

MD5
1be22f40a06c4e7348f4e7eaf40634a9

SHA1
8205ec74cd32ef63b1cc274181a74b95eedf86df

SHA256
45a28788cde0d2a0232d19c391eae45777fe640790ac0674d6daa5672c444691

SHA512
b8f6f42d375e3ad8015d744fa2814994fa6e588b41cce0131fca48194dd40146b08169a8ce0da350525ff32a59a16edb503c72e0f07254955c82a0d38074856e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000008.dbtmp

Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG

Filesize
247B

MD5
975f00d9aca3c66f3546c781491f0ea4

SHA1
4c9eb02bbeaa7abbaa248f49848078d70711512c

SHA256
a3ab9c9130fc838facb62eb99dfcaad137542c3ea65500001998135ef56f073a

SHA512
b67de405b20a832ac034907c71144cef0ef356347672a1d87ea246df8e56013c7d298181c38cfcb13008c84a20ebbd42e851eed11e1e5ce210dd409908587d59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
136B

MD5
970ca14ff0d095e853ed4655e76d4dde

SHA1
974cc4a224ce83b3f73f4e1bae69c69afec6aca1

SHA256
c4a8ab4e4ff7572235fe323a2fa1f3fe536247ef471bd41a66647cd3e1a2b98f

SHA512
fafd11dad1a52ba412961c7ffb0280354e7da51e409bcaaf0880a52e2b14f287cb7c43795882765a6097c29060eadcb67e158bb838ea0780b560cb73689913b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000007

Filesize
107B

MD5
22b937965712bdbc90f3c4e5cd2a8950

SHA1
25a5df32156e12134996410c5f7d9e59b1d6c155

SHA256
cad3bbec41899ea5205612fc1494fa7ba88847fb75437a2def22211a4003e2eb

SHA512
931427ad4609ab4ca12b2ee852d4965680f58602b00c182a2d340acf3163d888be6cfad87ca089f2b47929ddfa66be03ab13a6d24922397334d6997d4c8ede3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000008.ldb

Filesize
1KB

MD5
b598df23549718d247a3b994e466a285

SHA1
e01c4faca55b1a8edfcbf6451f1d1fc12c65b984

SHA256
de8696de18260272e6a37e4f80bc00cddc34f4bc7835c9ecc5dd4e9ba096b50d

SHA512
b5985edbf24623d4356ee157aae6bb43b7412dc2221bfb214756050f3be001cc528a2ce16740d7e8b6a5383530bb83fa414cbaaef428e413c6d954baf974f6d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000009.log

Filesize
2KB

MD5
95414a5209f87e66d276e533a0d6494c

SHA1
acaa7564a4951debdfc72e60cbccf9967ae14bb0

SHA256
d1defc1ba88cbb0fbea24378710e04d03f364523bca580ff2aa8da923edd3096

SHA512
09c0bae1343e1480edd2d6d921a54b346c7e5bed12ccf86f4e112eb300d6095e448c340aead92477d5c0a5122628ff66128b17184a489ad6748fd66b8d4f6735

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
250B

MD5
62afdadde97a4f515a64bb23141ca97e

SHA1
de42647ccf753f2cd4945b366e34c0a81eb19569

SHA256
d092c975275b73bbdf5d321dad8d9707201d7bfbee08ad8161d521745be58840

SHA512
a0467817521eb94e09e5bb3a339f88f87917617a4fb9c5ef51ce233e59e0592117acdd2d69849c2dff9fd4cb4c93b6e4e5cb4cd62cc4ab19036d94ed221fa9d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000007

Filesize
250B

MD5
17955c6a1bfe62d0dc5fef82ef990a13

SHA1
c4bc3f9ccf3fa9626c9279ecb1a4cbfbf4a0fcf5

SHA256
1cba135964cd409db09911c7cd4699112622596ff633cea868a83c54088c03a7

SHA512
5fb73bb4f7eb1c9e26f34e5d0f310783c7e629e717760ee38731a52a8e3fba6831d77abf0f37631fed820839a00c9242a582e59266de08d3c92c5c4f83c8e7a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e18e9edb-1de0-44c5-9c2c-92031b584652.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000008.ldb

Filesize
485B

MD5
cdd6f62687219a9b508137a29105d231

SHA1
2404c4c669ba18564911f996739ae2a98e1fc978

SHA256
b3da9f86289568c061097b01c7868273969e42834f72f8a5bf68a188f22354be

SHA512
8b72895e4b3346db1c1dd6a19699772273ad1fb162d6d207e1354761c3067bc630de9997572b2b65a64a283b2b6401ea4bbd045749bd0e05df35504f7545f60b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000009.log

Filesize
57B

MD5
50e0a00e9e3eca5dd3e80d3e6e8b8eb6

SHA1
f0afa409c7ab927938c8dedf7e57c0f355103cba

SHA256
7c820f099ace6ab1f6694f5b610412ce0cd81c64a500bc8558ae5ff9042a9c8c

SHA512
7834f7052e6d21e6aba4b5445b555103bfb9f1e04457a5aa7363918e97e0d7dfd0e08a9136c377600fd3a1c8818296b76e9eb09c7217b4e8b9229bb81689a79e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

Filesize
249B

MD5
9d49f0acd713a5f91b775565f213e7b0

SHA1
a47e73a0f6577ee04dedb8cef4b92d787d8830cc

SHA256
63bb30f7fde90468a8e0c08bd80c921b837d293056aff189652821a399eac8c5

SHA512
abaf7a90d9309fce203ce8c55d59bfce9feb306aa5dceebf4bf6cdcba2091410cf28306a8b4c41c3ce5b8458744d01960a69ee2e8abcd41f2b39cdf7ef47e636

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\MANIFEST-000007

Filesize
98B

MD5
1c0c23649f958fa25b0407c289db12da

SHA1
5f6b10cd5a39fe8c30353bcf4cd4e4a60ef35574

SHA256
d5134b804a775cfb79c6166d15b5721d38ffc2da11948a6c1263595d6c2941cf

SHA512
b691e882018833a108bd286bc76c55a140d00d5a266617a3a381af1ceff01aefaef17acef29d14dec931d7051455726cde8974cd04cc07302f1c3cc452fe2f52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000008.ldb

Filesize
316B

MD5
0fc3af8952de849bf087e6b32abc7796

SHA1
57f37e2eb81067131c62534148ccef5e96aba7bb

SHA256
5cd6b27825b5c78d7feda712e54d4d77ff9c181d3ce4041c6cc0b273d8e3ce56

SHA512
1701c528695b6586d1a0a8b4414be3654728135b936421993548e8cad5df6b41fdd95f440582ef637428efbb3077f754ad404fbc5c8b203f6da32398e9bf0da1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000009.log

Filesize
34B

MD5
fe62c64b5b3d092170445d5f5230524e

SHA1
0e27b930da78fce26933c18129430816827b66d3

SHA256
1e1a9ca70503efd8c607f9bc7131f08aba0476d75f2586dadb4da5485a5315d4

SHA512
924daccfbfb0c0464b4c5fd769e01a8f2e96fe28b635aa27ab4cd91766b05b03bbf941af14c017436107673f01bad815ce1fac2a649e745c76b3c736994b4fd2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000013.dbtmp

Filesize
16B

MD5
a6813b63372959d9440379e29a2b2575

SHA1
394c17d11669e9cb7e2071422a2fd0c80e4cab76

SHA256
e6325e36f681074fccd2b1371dbf6f4535a6630e5b95c9ddff92c48ec11ce312

SHA512
3215a0b16c833b46e6be40fe8e3156e91ec0a5f5d570a5133b65c857237826053bf5d011de1fcc4a13304d7d641bcba931178f8b79ee163f97eb0db08829e711

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

Filesize
249B

MD5
a32ae7891f04b41b3f29192523525006

SHA1
c5f998d4c20db11335c7e287f0f1ede8faac9a14

SHA256
f06f1720c036a4456b056624a7b88566dea444621a23c5c5eb705703724fefd4

SHA512
8331c16b14aff44e4237b9e27c24c71aa2f9b4f1185f83879445e71835323bc8fb9a6f41a0b8102bcb64c73884c9fe9dcb678e21ffd7147dc692b05c1c54afad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000007

Filesize
118B

MD5
803855ce14aeb68b6bf334d92054dd85

SHA1
0789a3d9bde9c039f77adb9f5bf68525699628a4

SHA256
1bb727cc92e08a0b7664cf2d960e633ecff55366e3cee4f63f5ef86b0c433b6d

SHA512
84c8c92f3a06eabb264611969769f2015cc5de13fae343eabed3d8055fe0f07095d01b300f475249fddfed76e86b50c7e2222315c4da2a7cdfe95cdf6c72aa2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AS91FDNI\76561199800374635[1].htm

Filesize
35KB

MD5
66794a8558846347a75ed64d7766a60a

SHA1
50e16f1d0406d779ea7847da2a579f90843d606e

SHA256
d3620c30df3ed46d320458c63cf2c17caab73b7ee5a13619a7bd43cb0d8273c2

SHA512
9de9f7c9803eb588bb10c6559afd5b2b1d54310c3a0180f794d3fa3e7268cfebaa41a3acbd3e8c6ca6e9cf14bea6b13009239cf3379e2204d9e4e00b397adddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO0A948757\Unlock_Tool_v2.5.6.exe

Filesize
1.1MB

MD5
b067c29195a13494802f2eab3a9106d3

SHA1
adca61f35491b5eb7d85daaa917f96d666e9d612

SHA256
40592e02eec664b6c7358d2c44eaf1b019ff171755a9b824f0cf180e4f4251c9

SHA512
5c49e56265ce8df8b89b783d8d1e5468abf50348376fabe290e00d766c9e1d72f05c46b78fec6506f3e55ebe7f19b3afe8381cf91de036aa200f124f9eb902ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab50C1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5112.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Desktop\Readme.txt

Filesize
105B

MD5
dc725c7d51887c1b081bca0d6a7571fa

SHA1
88134d6eccf7b128d20d6c77973e708b78df675f

SHA256
365e3615f862ac76420f2aa4665be1960f354d01a4715f2c70218a5f80b27cc8

SHA512
26ae4bb368c69167334722841af8d62e3b3965cc6d25efa683df58857d7a03de10de37c4f22205eadb826f504cc7ffe81337b6f5f958925d84be4920a163f7b5

Download Submit
C:\Users\Admin\Desktop\Unlock_Tool_v2.5.6.rar

Filesize
49.7MB

MD5
720f68e1a57f1881b0dcbfecdfc0b3bf

SHA1
7662d996406bbd32ea2baa20ae469321bc87ee2d

SHA256
edf2f2b1325eff120bef7a2414e367cd60efcc8d4256ba884d753cda39b1f381

SHA512
9e58a26de7fffe731bba8625529b811475a03b60860e705e4cbb51eb9ba7fa060731e93d8fee271adda12e6d7a370277ede27dd7afaf449f06d99795d3a46cd1

Download Submit
C:\Users\Admin\Desktop\locales\resources\Data\level4.resS

Filesize
128KB

MD5
64d183ad524dfcd10a7c816fbca3333d

SHA1
5a180d5c1f42a0deaf475b7390755b3c0ecc951c

SHA256
5a666340f42f0f985772024d90a83d15c9a241a68d58205cd4afbb1a31f1621a

SHA512
3cab59dff09981f49d1070fba06a781439bb1ea2dae0cfcb937d9875bbe9e866be2c951cfc6a3ca4a92aea79dd3e9c4792a765f5a06f230a57dabcab2f0b3c1e

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/1772-1413-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1772-1558-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1772-1442-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1772-1436-0x000000001A370000-0x000000001A5CF000-memory.dmp

Filesize
2.4MB

Download
memory/1772-1390-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1772-1254-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1772-1786-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1772-1763-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1772-1611-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1772-1465-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1772-1588-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/1772-1581-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-480-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-16-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-236-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-217-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-211-0x000000001A3F0000-0x000000001A64F000-memory.dmp

Filesize
2.4MB

Download
memory/2680-192-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-173-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-330-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-339-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-20-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-374-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-301-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-501-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-544-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-563-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-18-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-27-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-24-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2680-22-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-29-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/2680-14-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download