3e1015e338384acfc12eeec1005b5ae4f1b0f32bffa1ad586db9d0cd8bf3c814

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NRR-1.dll
Size 2.0MB
Sample260420-ynmdrsfs8x
SHA256 3e1015e338384acfc12eeec1005b5ae4f1b0f32bffa1ad586db9d0cd8bf3c814
MD5 ce6daace1d68e01c6f26918f8bec7554
SHA1 0eab88f8e6c7b3f07dc4bb2437354c5a6500f215
SHA512 9a027c43a4c9b395a4d6ec954374e7e4313bf01c21c2e76deb47e892153429a6df78d65e627cb42f7fef469a113e4f4e25763f648807ff098690b709275fe5a7
SSDEEP 49152:OUgXn0e/ariDNFNLvKariuj0dVCMt77X:7g/ar2NVh0dP7
TLSH
T1A0A59F47757884ADC15AE0B889779949E77270080F789BDF12A2475EAF7BFD00DBB220
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1948	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211886046830569"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3847269522-1618051987-1942096715-1000\{1A29EDC6-2C90-40B6-8978-AFBBF577CC0A}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
392	chrome.exe
392	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe
Token: SeShutdownPrivilege	728	chrome.exe
Token: SeCreatePagefilePrivilege	728	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe
728	chrome.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 3116	728	chrome.exe	84
PID 728 wrote to memory of 1948	728	chrome.exe	86
PID 728 wrote to memory of 3860	728	chrome.exe	85
PID 728 wrote to memory of 3860	728	chrome.exe	85
PID 728 wrote to memory of 3544	728	chrome.exe	87
PID 728 wrote to memory of 3544	728	chrome.exe	87
PID 728 wrote to memory of 1216	728	chrome.exe	88
PID 728 wrote to memory of 1216	728	chrome.exe	88
PID 728 wrote to memory of 1884	728	chrome.exe	89
PID 728 wrote to memory of 1884	728	chrome.exe	89
PID 728 wrote to memory of 1468	728	chrome.exe	90
PID 728 wrote to memory of 1468	728	chrome.exe	90
PID 728 wrote to memory of 1584	728	chrome.exe	93
PID 728 wrote to memory of 1584	728	chrome.exe	93
PID 728 wrote to memory of 4760	728	chrome.exe	94
PID 728 wrote to memory of 1464	728	chrome.exe	96
PID 728 wrote to memory of 1464	728	chrome.exe	96
PID 728 wrote to memory of 1724	728	chrome.exe	97
PID 728 wrote to memory of 5068	728	chrome.exe	98
PID 728 wrote to memory of 4940	728	chrome.exe	99
PID 728 wrote to memory of 4588	728	chrome.exe	100
PID 728 wrote to memory of 4588	728	chrome.exe	100
PID 728 wrote to memory of 1508	728	chrome.exe	101
PID 728 wrote to memory of 1508	728	chrome.exe	101
PID 728 wrote to memory of 4480	728	chrome.exe	102
PID 728 wrote to memory of 4480	728	chrome.exe	102
PID 728 wrote to memory of 3756	728	chrome.exe	103
PID 728 wrote to memory of 2796	728	chrome.exe	104
PID 728 wrote to memory of 3756	728	chrome.exe	103
PID 728 wrote to memory of 5092	728	chrome.exe	105
PID 728 wrote to memory of 5092	728	chrome.exe	105
PID 728 wrote to memory of 392	728	chrome.exe	108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NRR-1.dll,#1
1⤵
PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4b9dc728,0x7fff4b9dc734,0x7fff4b9dc740
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,5595072400158661368,12448715872104142419,262144 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2088,i,3927611534212224417,229784688826939314,524288 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2084 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,10465551288776834222,8708569883185542482,524288 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2380 /prefetch:13
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,14230807377856982516,9694266885671660139,2097152 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3532,i,7498076071527008950,5910317346619607450,2097152 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4208,i,8159302329560593595,11634123037275477555,2097152 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4216 /prefetch:9
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=1668,i,13000551709086953858,6874734778066124132,2097152 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,691732686636609037,13727780513569318531,524288 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5176 /prefetch:14
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5728,i,11458602191849010067,14722445139854032734,2097152 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3560,i,7720490333295673026,5284628363552119093,524288 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3484 /prefetch:14
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,5898266226873273756,11222163425056024075,524288 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3568 /prefetch:14
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3528,i,799826764758230459,14886643193548197064,524288 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3540 /prefetch:14
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3312,i,9732382788727392219,15840135365818307551,2097152 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5896,i,8315351087490520345,4967938671347454593,2097152 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3432,i,11972782065095497203,6930730080455891627,2097152 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3660,i,7123540012363724085,307687928908558757,524288 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6104 /prefetch:12
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3664,i,18059962616683117844,18374217217164894298,524288 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6264,i,13709690627143953916,10946010528764105966,2097152 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6528,i,12474043076194303601,10170448563743792223,262144 --field-trial-handle=2168,i,3897319949610872198,7349895538022299640,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6784 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c11aef6fb7c9a890eb7b67dc187912073e5583ac6fc4287132a593c15e1d06d5
MD5 630c5f9d5c59762c89aaf3299cb4b646
SHA1 a281a95d4496614049642660d33f4a8ef9f4a3e1
SHA512 67ead7056f50f9081b6ac72b0909d2fac0ed8d26b30d9ae0e1ada2aa95b2e292ef12499210584cbb49c14408f5e25388636e7f3327d089a1061b66201791cdda
TLSH
T1CEE022AECC21AC270CFE176860648787E740236B2B51985B3B3D830D8FB173B418586C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 586208da8ba13442328723542707d5256f693bc7d866a12292a140bdba969fa6
MD5 b2a6fe74b2e7c019acb9a3fcc6f2f196
SHA1 6e63d28bdccdbe30c61f92010b2088f2a02e0bff
SHA512 3661608665698e8518e365ae42df13dc7a8879a2495fe45acb5bbab599f20cbb0939fcaa1d958f8322962e4b8c8e36fc52a132d25812a241a1860332623743c8
TLSH
T1EB21DD527DD1FAE2D7922C35CC433A12A7534478F84AC7035DD647BE285D3A880CF981
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 70551592ae911d5f38a8f7b21d14e6689b235c8344174816082efb862f534098
MD5 bdef98a59ebd014975e18a843b064c02
SHA1 5247826a14ae4876caac6a7979cb00c6a31b18b0
SHA512 e6e1620ce233ecc3971db43849d460bf01bc3fd64f3a017db5f46e9517d2f7fcb5618f1bcfe64064f6b8d71443d67abeba9399f4047508369073320008e5b2d0
TLSH
T14C21BB127DD1FAE1D7922C75CC433A12E7534478F806C7035DD647AE295D2A880CF896
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 f1d70d2a04207fc73670e26f5938210a30f1b83903d0d6c77bd36e596592af4a
MD5 8d0ee4eb2d049c87d2f5e887275ba139
SHA1 3c101fbc9edfbaf79262c9078802f45ce83f313b
SHA512 bff8804dfa06a01fa016ba1616aef8b894a7c026fce13ca18e699179a6553639e2a9e3239b2f5b4ce5e35181d95a0148949fe8aaccf6dfbd706467f107010bf7
SSDEEP 384:Dcr7CHhp62xoswe17eBxixweUnVOb6aIalqZVU3FIPgxq5lI8BINITIvUVW1HDr0:ubw+czSJ
TLSH
T137629DF7C3DC862D885516F8AB257F2FCE190A18432C3D6789D8AF4AD3E1831D21665E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 35b03619facc50364d2f03b4cae423b182f7ef3b794693adc2236d3921cc6e7b
MD5 fe61d833ef84d260464170fc0fdea725
SHA1 86f7f8284eda39953e9f189cfaf06176e3e58863
SHA512 1c5c98f5dbbe64fed9d708fb959d791f528e6404b9764343634334f529bb244b39fe15df3b4f41e5463de11da70addcf9397413b5a6c470e3f8100b9844a7c1c
SSDEEP 192:lR6cBzDfq0oArW0gv7+cp9PRpVn5UL9AHsb+WN1JzaxrN5Wuh2JZqkw4bKakVyIy:lR6mzD1CHBLXW2wIHWe2TqYbKagve
TLSH
T17862D62EB820297B6CDBC22AF914B797E3F5103166952E84EAFC8A1D15D76CD3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c81dd6d7204296e73d12e811122f3000340e4fa71ef2ee275c2e59b82c2c0117
MD5 88ca32d9982dcec2c3541e1236a5a155
SHA1 0bf8815309b9ed3fed1a3a60d963375734e1d3e2
SHA512 f2f02281b38005307e4af684093c398f9fc869d90f56b52f0b2de3596c3a3b50a2f83e3b18e35bc0b06bbd14a7dcced7ec73320e53c2f019e8a94995881a3950
SSDEEP 192:lR6Dfq0oArp0v7spAPRp229AHsb+WNn/rI0xh2JZqkw4bKa6VyIsnAUgtaJ:lR6D1twgUX92ws0r2TqYbKa68
TLSH
T1F842D52EB924387B6CCBC21AF9257757E7F5103161852E88EAFC8A1C15E76CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0c84d947a6cd62644c76d6aaa63f5a86f6f93f065912329bf04b497efb17255b
MD5 518adb0708e3f505e8a1d3cc8ca95e42
SHA1 96e416a159661b1005a1e425682daeb39e697ede
SHA512 88ac21faad72f4e9afde472716fcc8c17363086f9a09d2457c6566b6db969da3dacdfc61f7b4e069f0ed5f7d3fdc4a8ec2a347d5e626f7390d96d4e2ed5423ac
SSDEEP 192:lR6cBzDfq0oArWev7+cpAPRp2n5UL9AHsb+WN1JzaxrcbEAh2JZqkw4bKaQVyIsV:lR6mzD1CaBUX/2wIQEw2TqYbKaUve
TLSH
T1B552E72EB820297BACDBC22AF925B797E3F5102165C52E84FAFC8A1C15D76CD3117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 64d02596fe51f9569a0fe1de01887126126676950cb0a7f364667c79889c4f31
MD5 47969e9ce197f477137c8131386786e6
SHA1 66fef833f6efde29f016efaad43becde43565d19
SHA512 4019e3eee9bfff174f451ea13e463fed78678b27932751d0441ad42c0f3cefee1b3ae6a8abad38aad2e9f7927e21c6c46a74a79a19df1e260ae5577c6f8058a8
SSDEEP 192:lR6cBzDfq0oArp0v7spAPRp2neB9AHsb+WNnaxr522Hh2JZqkw4bKa6VyIsnAUg8:lR6mzD1twgUXb2w8A2B2TqYbKa68
TLSH
T10A52E62EB924393B6CCBC21AFD257757E7F5102165852E88EAFC8A1C15E76CD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ced5b36a4959c2ae744847edeeec9c72cee0c318368b0e1ccd2ad7933ff1576a
MD5 99650f0072c5e3c22b6d1da70246fc28
SHA1 e01b95d7130674f946033056b7352150aa663b23
SHA512 ed30386294d9d0cd0591d7ff155931a50902f6c7948a312ec5c47ab3dd4eba2651e785c7229440477eecbe0eb5ab99f600dc18e082fbd803930f4e0fd5dc45cb
SSDEEP 192:lR6cBzDfq0oArWgv7+cp9PRpVn5UL9AHsb+WN1JzaxrD/vbGtih2JZqkw4bKakVi:lR6mzD1C8BLXW2wIDGA2TqYbKagve
TLSH
T16562E72EB820297BACDBC22AF914B797E3F5103166852E84FAFC8A1D15E76CD3117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 5ab444414a02d4891c7cbb4db3735bec720facb3265bdedc915a68f6beef1cd9
MD5 191a425abbe14997e55d6c34d96395de
SHA1 567b4a799716eb9b3db36abe7163a0aaec1148fd
SHA512 d0c7f690ea61add197a2dbd706250b5de93bf454a11e6e82e25faa2759a36b7158f1e02247d411bcd65234e3d4eb5605c539a97b277b15db18786f9fbc17ab4a
SSDEEP 384:UujAr7KxkXqKf/pUZNCgVLH2Hfgsl+m7pLuLcifmnXODAH+ErU3xWHGWmvhxVtfC:UeAr7KxkXqKf/pUZNCgVLH2Hfgsgm7p/
TLSH
T15D720A677C4C9E770F94CACCD8167A4FADF6024B65E9889583FA982903C5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e5f3f9d0678e023bbe6e24ff782350dd9b9c2af5b5cc13758c606e3e3a354014
MD5 5519f173fb4bab92fd6c1500ec16f9bd
SHA1 d0e9d6558a52cdbd5ba1637c511e1e3696b553d1
SHA512 60892690dfe753f7f518792fd9cd40a1ff30da7a92a18cf50b4c680b9fe0eea243080b9729f514458fad8576ff4186e12ba3ac1b712d0ab035f157ad79a4af09
TLSH
T159B01210C042E541C05303B01596749C31586F109B0E130163F6AD71D8271A15024160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f95f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f95f.TMP
Size 96B
SHA256 e803e0e4e642756cc6e5ba1db2d62ad97c305cc582e761c015c5dd43dd09b27b
MD5 54257be599e1d9a2e44b2dc7e546c90a
SHA1 344bc66344476bd939abee5499239ccb8f7f4242
SHA512 d2a1aa98d6a7b4703b1b12c115615c85c1158c6d13aa8a09c58b18ef64944f5ff5257f855dab9ce28e3b00da164db91c3ce82eec9252f564f0bea028857a0a12
TLSH
T1AAB0228CC00AA322C00283B03B80AAE83020FF38C30322028AF00B23CC222B00030020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 c7461c2e9ef5fdf83104a4a55ed09c02f948c3877ea1e2f0d952a9dcde3aa47e
MD5 ed7cf69d92e171916dc3b0a826ecb5c3
SHA1 015a10b934aa48b8e26e69215734a02956d12f9f
SHA512 843c7fb08f25b6548327285383bfa2377bdb088c26eb456072b93dd267a78ca487e0f6c5a4650e791ec032b3e8782c1e9c0aebf8b3b0709615538fb1ab8a115f
TLSH
T1FBA002D031D67C03DE3907FD1992C5C82370A8600501E66768954049E9521644582804
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\c820f92e-6b54-49f2-b958-55838426f419\index-dir\the-real-index
Size 120B
SHA256 685ffa1ac98bab0a1b392ce381d902b7820a4194ded0c5274c280c9427660632
MD5 1c5780ce914caee1bc90206023212c41
SHA1 f1dad1fb937d063ea26999818b797104e946e8e8
SHA512 2f73d4af2e6f1cd51d997ced9e13c6d936d30dfcc22dd617da53578294d928ccbb8d6f62d978c4a20d107a7fa45541906d14b59d7321227a51480236d3991b57
TLSH
T1F5B0123C80544A25D8190BB13C4B016535251B24B54A031364D12380A4062AA15491B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a3d7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\c820f92e-6b54-49f2-b958-55838426f419\index-dir\the-real-index~RFe59a3d7.TMP
Size 48B
SHA256 0ef0e0e091b6f9d551999d67440e6da8c9d2ed23a5e14037f8d521e37cc81c81
MD5 cb1d855147b2d55861838d6d127a8623
SHA1 448f4da4188baa70cb764b033e6bacef3b9ab4be
SHA512 5d5cc9a1cdbc2a4a7b0afe59743726f354bb61829d88c1cb212fa4193a075c8f730960a783a9162c15c814d51ec8f31c1fb267796cf37235306e10cba7051cfb
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 234B
SHA256 83b65cf876d2f4a673f7eaa434b8c004bc7224b8df7e3e9f1f4552e1d282a615
MD5 3dcd39c8484496891772d6fb25aed09f
SHA1 0f8f20dfa3ebf2c8a3a04c33f52f6b268bb6adf1
SHA512 ebf62a62ecce58cb585fae2b6fe599746f3e12f8e47cb6e01bc495f8e77c70b66b9282c23c975a6e4a73b929578af50bc5ea9489e817244521fddd857f584b42
TLSH
T15FD0A7D725B2DA175630D5A89018215C815B6E4E8C80CCE89845B18775B8B33D405A39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 151B
SHA256 fe11eb0d8a146f79f957642073d4481508d873d5eaabc3616daae86e42b3ba43
MD5 3cceb8f09cd038dee0222cdf0d0ef294
SHA1 52cbe91815be378fc00489e3cb83c3983955882a
SHA512 76bf9c09a4ece0ac2027ba431b2b62fd9d6d7593f0f3ddd1d306eedec0247c683559d126e22a15698640fef2613cda2c3f2eb60a4d8def0185eafc7b9da256ce
TLSH
T1ECC08CD3296089478A30E6E81018B22CC00BA2484CC0CCE8A48800076578E374402E28
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt.tmp
Size 150B
SHA256 84c50962c4099e823bf74efa64b0ec1d468315b7084aaa7578dc3a85bff59802
MD5 8dde3be17ec5de387d923de9588ead2d
SHA1 25d4db4e21538985238c0590f61357fc429a6042
SHA512 ea509f3e715479685d59b658d5924b3c50e6c1d1d4221904aae88f890f9f43792c73f0c7be2f4879a1c55b3e9b69f6d83ba3dd4f5f3e2ab0481683ee002dd239
TLSH
T1ADC08CD32920894B8630EAE81018732CC00BA2484CC0CCE8A48800076578A375402E28
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59547f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe59547f.TMP
Size 157B
SHA256 d3568ca5bf9d4a07693c5ca8d0a0da229e03c72a328c63b1260ace60e20ed54b
MD5 97e581d039e73f64636ec58f56525264
SHA1 fa12b6aa71ea2867293308564c35dd184a1ec3ab
SHA512 a0baec985728e4f217e46d96f0daec6ae195fd13b43eaf661f6737ad4cece42180ef72df4b0525c065a18ed8dfe1215914680463ff59e198dd15b0fb97fd7969
TLSH
T14EC08CD3292049478731A5E51028725CC01BAE4D4CC0CCE8A48931076278A378401E28
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 e5bf2ff2ac7bfe9ebab2bc17c8e4d0388c323c47e2c8c03ab0baef1ad6d46eed
MD5 97e8d6025ae4e10e25cf8da6b340b8c3
SHA1 b063e9dc8e9cb223bc42ceac6a6385edf6ed5d26
SHA512 6833914c4735851ce645163b9c198760ca3325b8cfb2f75291dcdbae8ea903c09a8527f96d31797a37547370a2beff128772685dd89953b988810750489778ab
SSDEEP 3072:FqlvjMqpns3U9mJ6H1gYeCiu4DY8++J3qUQm08KMWF0bFTcVHr6zI0:Fq1jTST6H13iu408++JjcMW2VcVLl0
TLSH
T1F11412B5892A3E7D63A58FE070276CBC48F7CC8D152D96B931C03F0E14773B661568A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 10ca61fd9d50d9503fa4818f22ccc8f97614d8a02e20b67ab6a0785279df505e
MD5 c2f44e49c0eb267a179a1e6c483faa46
SHA1 d58a5404cb24624dc2cdff21fe600a9d0b905e12
SHA512 ba1d5f0aba5436bda18e61f3554385a3c545f9e7aaef7eceacf94ccb57fce57fcd86a7925baf771fb3ddd77b698f88b308b9fab61a81c574c1abf4cfa3e9b910
SSDEEP 1536:4LJP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:gx++J3qUQm08KMWF0bFTcVHr6zgZ
TLSH
T1099302B9991E7D79636ED396A0079CAC8CD3DCCE1510657C30C76F0E14BA3A2A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 0bc02ae4e511d9c258f36e988c7e060f3283e65f80de26a0ff8acb9343ec8fcb
MD5 229bcc14522e261960f59432800d457c
SHA1 8c24edf7482609950f5959f2c85730f7b71d30a5
SHA512 a7a7c0e12c6684741d8f0935b07d3554d5f55d61400c30c9ada1029c002bcf7e9fe8d053aa64b3cb663db4bc3492b33a04d8bff8af484d3c0bc1c9dacb2d76a8
SSDEEP 3072:F5lvjMqpns3U9mJ6H1gYeCiu4DY8++J3qUQm08KMWF0bFTcVHr6zI0:F51jTST6H13iu408++JjcMW2VcVLl0
TLSH
T1A81412B1992A3E6D63B64FE070176DBC4CF3DC8F152D96B931C03F0E14673A6A1568A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1884-342-0x0000023936050000-0x00000239360FF000-memory.dmp

Download

memory/5068-13-0x000001E408DB0000-0x000001E408E5F000-memory.dmp

Download