hijackloader | hxxps://fitgirl-repacks[.]site/mouse-p-i-for-hire/

Resubmissions

08/05/2026, 12:47

260508-p1dsqacx9m3

08/05/2026, 12:43

260508-pydd6scx2q10

08/05/2026, 11:32

260508-nnp5jsbt9l10

Analysis

user interaction
yes
max time kernel
129s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://fitgirl-repacks.site/mouse-p-i-for-hire/
Sample260508-pydd6scx2q

Score

10^/10

discovery execution hijackloader loader

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\tool_net20_32_test
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral1/files/0x0003000000024fa6-891.dat	family_hijackloader

Executes dropped EXE 1 IoCs

pid	Process
2032	mShqu1SYQ.exe

Loads dropped DLL 2 IoCs

pid	Process
2032	mShqu1SYQ.exe
2032	mShqu1SYQ.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
116	api.ipify.org

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2372	powershell.exe
4016	powershell.exe
5032	powershell.exe
392	powershell.exe
2336	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mShqu1SYQ.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3956	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227178586945685"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3847269522-1618051987-1942096715-1000\{C04AFBC9-0583-40B3-8738-F3109D846733}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Setup.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
4016	powershell.exe
4016	powershell.exe
4016	powershell.exe
5032	powershell.exe
5032	powershell.exe
5032	powershell.exe
392	powershell.exe
392	powershell.exe
392	powershell.exe
2336	powershell.exe
2336	powershell.exe
2336	powershell.exe
2372	powershell.exe
2372	powershell.exe
2372	powershell.exe
1424	chrome.exe
1424	chrome.exe
2032	mShqu1SYQ.exe
2032	mShqu1SYQ.exe
2032	mShqu1SYQ.exe
2032	mShqu1SYQ.exe
2032	mShqu1SYQ.exe
2032	mShqu1SYQ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe
Token: SeShutdownPrivilege	1276	chrome.exe
Token: SeCreatePagefilePrivilege	1276	chrome.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe
1276	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1248	Setup.exe
1248	Setup.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1256	1276	chrome.exe	80
PID 1276 wrote to memory of 1804	1276	chrome.exe	81
PID 1276 wrote to memory of 1804	1276	chrome.exe	81
PID 1276 wrote to memory of 3956	1276	chrome.exe	82
PID 1276 wrote to memory of 3508	1276	chrome.exe	84
PID 1276 wrote to memory of 3508	1276	chrome.exe	84
PID 1276 wrote to memory of 2912	1276	chrome.exe	86
PID 1276 wrote to memory of 2216	1276	chrome.exe	85
PID 1276 wrote to memory of 2912	1276	chrome.exe	86
PID 1276 wrote to memory of 2216	1276	chrome.exe	85
PID 1276 wrote to memory of 2320	1276	chrome.exe	88
PID 1276 wrote to memory of 2320	1276	chrome.exe	88
PID 1276 wrote to memory of 3212	1276	chrome.exe	89
PID 1276 wrote to memory of 3212	1276	chrome.exe	89
PID 1276 wrote to memory of 3700	1276	chrome.exe	90
PID 1276 wrote to memory of 3700	1276	chrome.exe	90
PID 1276 wrote to memory of 4824	1276	chrome.exe	92
PID 1276 wrote to memory of 3668	1276	chrome.exe	91
PID 1276 wrote to memory of 3668	1276	chrome.exe	91
PID 1276 wrote to memory of 4548	1276	chrome.exe	93
PID 1276 wrote to memory of 3432	1276	chrome.exe	95
PID 1276 wrote to memory of 3432	1276	chrome.exe	95
PID 1276 wrote to memory of 2220	1276	chrome.exe	96
PID 1276 wrote to memory of 2220	1276	chrome.exe	96
PID 1276 wrote to memory of 2700	1276	chrome.exe	97
PID 1276 wrote to memory of 2700	1276	chrome.exe	97
PID 1276 wrote to memory of 4016	1276	chrome.exe	98
PID 1276 wrote to memory of 132	1276	chrome.exe	99
PID 1276 wrote to memory of 236	1276	chrome.exe	100
PID 1276 wrote to memory of 4228	1276	chrome.exe	101
PID 1276 wrote to memory of 4228	1276	chrome.exe	101
PID 1276 wrote to memory of 4744	1276	chrome.exe	102
PID 1276 wrote to memory of 4744	1276	chrome.exe	102
PID 1276 wrote to memory of 5108	1276	chrome.exe	103
PID 1248 wrote to memory of 1508	1248	Setup.exe	107
PID 1248 wrote to memory of 424	1248	Setup.exe	109
PID 1248 wrote to memory of 3008	1248	Setup.exe	111
PID 1248 wrote to memory of 5064	1248	Setup.exe	113
PID 5064 wrote to memory of 4016	5064	cmd.exe	115
PID 1248 wrote to memory of 3060	1248	Setup.exe	117
PID 3060 wrote to memory of 5032	3060	cmd.exe	119
PID 1248 wrote to memory of 1740	1248	Setup.exe	120
PID 1740 wrote to memory of 392	1740	cmd.exe	122
PID 1248 wrote to memory of 2456	1248	Setup.exe	123
PID 2456 wrote to memory of 2336	2456	cmd.exe	125
PID 1248 wrote to memory of 5044	1248	Setup.exe	126
PID 5044 wrote to memory of 2372	5044	cmd.exe	128
PID 1248 wrote to memory of 2032	1248	Setup.exe	129
PID 1276 wrote to memory of 1424	1276	chrome.exe	130

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fitgirl-repacks.site/mouse-p-i-for-hire/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffcc21c728,0x7fffcc21c734,0x7fffcc21c740
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,11491936726530003341,2919946728392346317,262144 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,18091466268989773147,17737740126272074860,524288 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,5620443722539723567,914450745249916965,524288 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2336 /prefetch:13
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,9044525732514845547,10035666428798281619,2097152 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,5876164972252609044,677481660493371880,2097152 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3808,i,8364731787296657320,1663461968737953322,2097152 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4328 /prefetch:9
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4640,i,12436880175061611026,12466259277879828607,2097152 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4836,i,2909474555361563256,14015310398216670081,2097152 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4996,i,12776860908615489073,1611210823021601279,524288 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5060 /prefetch:12
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5080,i,9539237890549076086,6986088229464872124,524288 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6268,i,2016931298738040313,14423900001458454173,524288 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6204,i,11507772344077774944,15495168611206012661,2097152 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6172,i,8212546112621660178,3748499295106071824,2097152 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6120,i,13418774845559764347,16812397060486425282,2097152 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6780,i,3439382733576973048,16207305728292776423,524288 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6808 /prefetch:14
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6796,i,15762962310524556688,16190657069946594422,524288 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  PID:132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6804,i,9000692017320719397,17208685556951544270,524288 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6888 /prefetch:14
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=7024,i,15963503764389644651,12236768985623049146,2097152 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5372,i,1639368475132647183,9728911349003169067,2097152 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6268,i,11345475105359087809,17783602015575693807,524288 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6696 /prefetch:14
  2⤵
  - NTFS ADS
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6644,i,5387564349385322356,7726500895237812561,262144 --field-trial-handle=1936,i,10586342382855084351,10464785938341620752,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5924 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1424

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3120

C:\Users\Admin\Downloads\Setup\Setup.exe
"C:\Users\Admin\Downloads\Setup\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:1508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:3008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2372
- C:\Users\Admin\AppData\Local\Temp\tmp-63996-BafKSQ5NTBzp\mShqu1SYQ.exe
  C:\Users\Admin\AppData\Local\Temp\tmp-63996-BafKSQ5NTBzp\mShqu1SYQ.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

79e147e5-56ac-4e92-9915-4c8425e159ce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\79e147e5-56ac-4e92-9915-4c8425e159ce.tmp
Size 12KB
SHA256 064c317f32887117dfaf07c4ee31f438e5cc590d14ff42b622603632a5f04af9
MD5 1d14a60a554034e2c19fb13c629a8515
SHA1 9352a462c1ea884c701732b2716386379c250630
SHA512 11e2b3e27133921a9c8dccfc0017f6fdb6103c3683ef3884b5b20891f4e57115397ad6b1667d07d489dfbd915dd5af6e4ef42368f69fc9e47514c3f9769b703d
SSDEEP 192:GRBBpnr/TLwJv7DZpAPRp2KjlN9AHsb+WNnTHcNr2tt2C5iWGAykw2VyIsnAUge:GRBBpEJRUX12wLS272C5iBAyue
TLSH
T1D342D76EF964697B5CCAC22AFD257B57E3F6103161941E88E6FC8A2C18E75CD3127007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 73366e7ca84bb067e186ec83d362c621c9118ebd2c3f69d15c667b6d75975127
MD5 68d6db4a02a7ef593d8779e7bf182498
SHA1 65fdca9db3b50c6e08c79551d5463e736e04df26
SHA512 5c2c40c84a65da5914c5ad4e19ef01081dada9af7712af06077c9cbfa8d04dad00cdca02f95d9b3bcd4d7a467e147a2e7464f45b9bb0531b701bfb5cd3b56fad
TLSH
T1F5E022AACC21AC2B0CFD276974698B47E751135B27418C5B3B3D820C8FF2A3B468186C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 792B
SHA256 c0908073824aeb01d6ac1da2d4add92ca573421d5924d8b6f7da5cc858d0ce48
MD5 5dd9f61f51d62f5d338a34a9e95c5fa5
SHA1 35bb2df85e45777750c97a74eb2e9246b30af2aa
SHA512 0b0a0f80c580928cd28e2c933983973e5a1cc8034c0c01314068c9a85f07818949fbbb6fe3b61c5dde8cf3b6958513f4dab3f4cf4a0aa943f0048df9c681619f
TLSH
T1CC01D7145AA0121FCF6E0F30A4A15E4064BDB957D03E0F7360BCA8B16D533C03B82844
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 a6e0038edf2595a2f8a6af0c432e5ec46fa45a7090806fa8dada1d37608c943f
MD5 afaab7f6cd9e03df44a9359655f13db5
SHA1 b3aacae970063eeb93be63e9b7fbf4624550e105
SHA512 9f3c9e68773eca7bf45da9e88e2a6010a57159d28ea745211c107e94081493265b2a934298d9ac2eedab317d9d4e21864410e3943ac6ddea262d9c1fe5104729
TLSH
T12E01F0145AE0150FCF6E0F3494A54E4065BEF857D07E1F73207CA4B16D973C03B92884
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 b368f8eab94d6ebf35b164f96a8c159f64838df07df708552ae810b22b72ba57
MD5 d00a971fefc8dc3d02aa3175ce2482e0
SHA1 442a01a5db5f802677d23cb2a52e687d61c6f57a
SHA512 4ec7fc712ba07d563863d7c2cbd9797b348617e37291d64a54826885eef9cde63681846932e2bfb25878bf1ab7152b62a85644f80358ae3d19a3aa20d9042311
SSDEEP 384:D7HMQeNFQcwJpDLqaIaEgd2E9kzyhCox5KrY6eTIW60c/BKR6hO2XX3LvSoCRcg0:gR22hB
TLSH
T10A42FEF7CBF8867D891261F4AA153E2FCE490959136C3C26C8E89F4B93F2871E14194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 da695db9355628be9f3210cd934a47b25335d2f8b41b6180f07239e7f33e8785
MD5 98bb2e132646187896d349f3f7abb7f3
SHA1 2f779ab0df885e01f8170bdcd52d5e815b720cc1
SHA512 81b94b39c1974d3ca9cc9f6393079c72672e667cd1b4e4ad2e4101ef5d2af3e8ac781234dffc9f0d67138462694be5a1baa0696e279bfd8efadc70cb22e984a5
SSDEEP 192:GRBBVnr/TLwJv7DZp1PRpljtrjlFI9AHsb+WNqsqTHyNzfNr2at2C5iWGAykwOVo:GRBBVEJRfXQ2wOcx2q2C5iBAymE
TLSH
T1AE62D76AF964297B9CDAD226F925BB57E3F6103161C41E88E7FC8E2C14E76CD2117007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 5ab444414a02d4891c7cbb4db3735bec720facb3265bdedc915a68f6beef1cd9
MD5 191a425abbe14997e55d6c34d96395de
SHA1 567b4a799716eb9b3db36abe7163a0aaec1148fd
SHA512 d0c7f690ea61add197a2dbd706250b5de93bf454a11e6e82e25faa2759a36b7158f1e02247d411bcd65234e3d4eb5605c539a97b277b15db18786f9fbc17ab4a
SSDEEP 384:UujAr7KxkXqKf/pUZNCgVLH2Hfgsl+m7pLuLcifmnXODAH+ErU3xWHGWmvhxVtfC:UeAr7KxkXqKf/pUZNCgVLH2Hfgsgm7p/
TLSH
T15D720A677C4C9E770F94CACCD8167A4FADF6024B65E9889583FA982903C5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ae43f2dd543775406e3806e44fd6dd64ed7adb3be917b207441e3df07e5cfaf2
MD5 be04364623b671220670c00c076611ab
SHA1 0dda62d0f8e0e105fb9d4641c25e183c38108aac
SHA512 173a77befe63ecb5f92bbdc7eca67c0741c8486c986c0da4cfe9c89e9afde4fe6c2e7469e7cc5e888ca5d973bd2b0b8573df81c90acd3e79395c5eb6b287c764
TLSH
T1CBB0125084025501C01702F8128204883154AF22C705131593F4E97298265949118150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585464.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585464.TMP
Size 96B
SHA256 0edc124d1efa45effd2705f0ef961ca14f36e73e430134df31f2500d3f4a8d2a
MD5 12466e7322b05737d09fe9970ad5a6e6
SHA1 6d93d94abf5499665d416147256ff57cbee95bc6
SHA512 3fc27bf4a04c2124af456efc99e7d4c0a0b794a19ecc622a393396ad7bff629a0b60f2163042797ac2338283366a2d6a9cd8627028996b96aef9b0329f622209
TLSH
T16BB02208C002B323C00203B028A0CAEA3020EF22C203022282E00F33CC302200320220
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 86B
SHA256 429a859a7dba726aeca648094eb785a5194b8fd8dd8f9cfc27317b2a186c949e
MD5 0353d2fe8324be912cb6ac14c955d87d
SHA1 e22de95399e356c74f798eac0dcc90cea3743d5b
SHA512 feae614ab3016cf121e2ef47aa7f98c0800626721eea53eef3ad80a5ba4420da62556d920cfdd1ef5dd14198fd03c2df37d20aa319718646af7ae7382c8a825a
TLSH
T19FA001FB8A54999A0A61A9E86139B62EE08F829CCCD8DDF0840891D66269A621006A10
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 167B
SHA256 89457ca12236f386a47962e30b4184dbfeca8cb0ab48d1ae86c2bac84c798a00
MD5 c23c8f608a35a558a567107cb20c4ee4
SHA1 c06ec799724241d8965b50b6d0d9b53799b951c4
SHA512 3330e348341dc8ac20cb85a22a8daad86b6991d7e885e3ba5062004f26f8d1b488230d109758c2f49251d363cf4d1d03640b90de7c214b5c69e0da6bebd82155
TLSH
T194C08CE346206B860B70DAD83235791EE1AF4C1CCCC8CCE4C00EB8C26038723C446A20
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 244B
SHA256 872b84678d346dc7caf4916cafeda9c8a4b5115a381b445b4b57295a667e816c
MD5 672dab41691fb66c09087d5f2b6b62d3
SHA1 03d923381fd9e62ef1c6c7fe7d6087a209494fe7
SHA512 ba21c840204324ee8e2d5eed13c6c37b1f1610a3fa203d618b6712186421bc02192d6338a4ea4caa1f17d3a0c2c64d34223472113e86674e6fe46dbb83b4bf5f
TLSH
T1CDD0A7E692319F490A74DBD42135B41E919A4D1DCCD8DCD9D409F8C6307C353D847622
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 160B
SHA256 855e8f108e8c80292810a1d6f2cdd63ebd6000368fadc53c1c7c89c5889e9738
MD5 d836fa636a1cd4e21278f69fea362a66
SHA1 2693a96e7576b2e6d0306fd464cb9c605f45f963
SHA512 666c7df5cb83b010d4e47e250c99e5396971a1fae3a1b97ddd83b0d7946cfdeaa9f71f9c2e43a8846689234179c53ba903088a39052cf9e7aeece3c9aa7c1a15
TLSH
T130C08CE38620AB8A0A74DFD82225B92EE18B890CC8D8CCE4C00C88C260387238443A20
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe580da7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe580da7.TMP
Size 167B
SHA256 6d677b365c0955a078e22d241ef7594468a55e1591567157c66d51ddbc96bec8
MD5 cd657e7899b04213b7ccbb69d2dad7c9
SHA1 0dcd17bd619963fda59c981b1581e09be4f9af1c
SHA512 f587e727d66d5908ccde6cd13a70823b7ae881ef1c8e170c1a89a87d381c2b3c2e7b1c62b60f5fb39eb8e9e6b988a4ffb0d26a06c03413eb04a2df60f84c5abe
TLSH
T12BC08CE74BA05DCA0771AEE41034750ED21F8C5CCDC8CCB89889B08A3038463808062C
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\66f5bb8b-c9cb-47c6-807c-2f3284af238e\67
Size 10.0MB
SHA256 e5b844cc57f57094ea4585e235f36c78c1cd222262bb89d53c94dcb4d6b3e55d
MD5 f1c9645dbc14efddc7d8a322685f26eb
SHA1 8c206a1a87599f532ce68675536f0b1546900d7a
SHA512 868d3a190f2723758d1a64498a4ac1f14b0297e16e731a0eec3a446b775c65cb8428ab33140cee13ef51e7bb3764b5ff1900cfb342a3dbf3fcc41dd6cdd9fcea
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 78e750286d92ad9550f0287702404c6368baa12581f55f2ec1fe5d5e381470d3
MD5 01fe200a7e6e1aaae68f461cfd0d732e
SHA1 c37eac70334d21936db201bac8040e0d9cc69884
SHA512 ab8ca492505869f9bd4a5c0cbe0a4034c7e63c2e82b2a191320adfa59f6e45f9c0f7b1c338eb0995e17e51d8f01256e25b7c4ff68f083a3407f9e02ce24173be
SSDEEP 1536:xL0FP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:Z0d++J3qUQm08KMWF0bFTcVHr6zgZ
TLSH
T10D9302F9991E7D3953ABD2D6A0079CAC4CD3DC8E2518657C30C76F0E14BA3D2A35B8A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 08be72a1a28525d9c1488bc94797fd5a11484c86b068c45982503ef9affa81bb
MD5 cd4fc6670b4861e561268a266845f99f
SHA1 6a7d12f67737d27ebb96ae6fc4444d72975980f0
SHA512 beae7ffafa45d0c5c580401bc986439d7b45f10ff915789a12d7916e392836f9c39e3ce27d38d7ca5775a9e6982c7787db4801442a9a08b99a2cfb52dfb3c72d
SSDEEP 1536:4LGP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:gc++J3qUQm08KMWF0bFTcVHr6zgZ
TLSH
T1BA9312B9991E7D39636ED396A0079CAC8CD3DCCE1514517C30C76F0E14BA3A3A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 7e8e79883660c2002d73a7d2bd0a0570babf44566e027fd973d247a02b9d7277
MD5 605756e2e106e1c0c69761a8f2fa7a68
SHA1 62c42735700606eec0f8e76c114b8f8e02e65a41
SHA512 3f232fbebd5eca915ab241380bb19bf6443936d1d9d90c044b40591a2a3d7ff2ba952633d15a60f268aa2b93e696821ea94cf354e098d26ff1e9571f716da8ff
SSDEEP 1536:QLCP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:4o++J3qUQm08KMWF0bFTcVHr6zgZ
TLSH
T1149302B9991E7C3963AFD3A6A0079CAD4CD3DCCE1518557C31C35F1E14BA392A34B8A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 4cfaab1805a2631f24e867408f0de0728d21ac1f583786eb3c61cf008ab71368
MD5 bac2d73b289be60965b59edbd738b639
SHA1 90a65ea3a82aa040600e5c6e9e7a0c8d31fd46f3
SHA512 35046aaa608e6f16a62e98983a2c05e76a1abc26bc2eab6d2df0eb0fa2a4373d252e0646c7bbdf1be863221c32b7a6f96342ed34e1e6483b078e08a091b6b716
SSDEEP 1536:QLwP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:42++J3qUQm08KMWF0bFTcVHr6zgZ
TLSH
T1249312B9991E7C3963AFD3A6A0079CAD4CE3DCCE1518557C31C35F1E14BA392A34B8A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 f28182bc017d065aef2794a24e60b12c9afeb3587f7d13f687b9e677eae6e2ba
MD5 6173d180279c917575230694d3592410
SHA1 f6630bd2b31f6419366b0ac7ae14086de2f13374
SHA512 434d709751b2527785a67de50a9da5dcbdf9c49c61c8c0a64f79d37f9721596547d617627448e10cf16e2636a2f4aeec8f3def5b454693046891207ca2b60d62
SSDEEP 1536:xLLP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:Zj++J3qUQm08KMWF0bFTcVHr6zgZ
TLSH
T1E69312B9991E7C3963AFD3A6A0079CAC4CE3DCCE1518547C31C35F1E14BA392A34B8A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 bda1c6dd9a13f6ebb9447cb283ee38f7dc366029efb575a4979cb065a5895f7d
MD5 793dff612ad4f90ddae1488415c0f42d
SHA1 e2b3890fdae14fe1dda639fe7661fa91a864a4cb
SHA512 61fa2ae1d81df9dfc829bd8bbb765edeac283eac30068e4d5b3ef31e19b3d58eb0f403ef2c2886952b68eccab889333616a597ad496d994735ada97af97e4c0a
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqnBPzOIz+cm7vmkKiNLWPiNyDI:iq4uYqGEUdncqKXq3qotzYuWq4Iz+OW
TLSH
T14791DD323375B0D4C9667F07292C19C463AF4396EA94AF4CB258521ED92B14BDB222F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 70fddee4b6eb581e453320ac93d7140895a7ee662bf15eb8ff02f73ab6833556
MD5 186cd9fb9214627938f2318c430bbe4b
SHA1 97af62d192b37d489591a18683e7d1335620c2f2
SHA512 fe1993f94490f63661cfda1c553075aa799ea2b4bbe54aef9517fb2b940f409ee78963e2f957fabead6dc45c62f177147944ec0be39f3fa71ae9dd969795eb4d
TLSH
T1DB31AB33B3ECC165C8D9117A208C6D0072A9C3C744DECFCB2B84C229997F6DADB545A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5f3d99d3c7a8c84bef53992d1ecc40c7c47263de8c4264e127bbbb0c1d181512
MD5 c164336a6a7c7d398a31b24c15f05804
SHA1 f3e049fc3ed538277b0f4a8337d29b0fb44a6794
SHA512 396abdbca72395e10033f87a71421f6696315a08c2c5a2b4b974b61d821ee3731f7282141e39c37a22cddef66951f212121666451e9df1eebe84e12be23df300
TLSH
T17E218B37B79DC165C8D9117A208C9D00B279C3C740DECF8B7A84C228A97F5DADB945A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b98fddfce9185383cd12e552de2c7daeec68a5d2b2efc41af4c066c09d11a9c2
MD5 59cdd289b84928da841f990b1f12bb6e
SHA1 a323af34bf271d3a950209c8b43c7087a9aca17f
SHA512 344bf7854a391653866c8ac9aa6192c03e153045b9248d8c815d618f6ec73fdfe43e67f6585e8eadda7266ed6022ea5cea60ec76a88f84b4880cf2df59f0df9a
TLSH
T13A218B33B79DC165C8D9117A208C9D00B275C3C740DECF8B2AC4C128A97F5DADF941A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f1695dbae8336f6f926f520a43a4022a4408fb194d3a215fb8ad29a3a64754c4
MD5 64f299bb478c8ac7e68eba44307df9c5
SHA1 597fdea7afae24abecbaedb1ada6ae950f5b86dc
SHA512 a32b1b34ff8da6089210ce0ff79596ae22e27cc711efa83f8a5a67badc4489bd694b4b75865039198468b066d0f936e847156b427254c6dde3fa7945a76e750e
TLSH
T12A218B33B79DC165C8D9117A208CAD00B275C3C744DFCF8B2A84C228A97F5DADB945E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_puucuh1a.p3t.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_puucuh1a.p3t.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

VulcanMessage5.dll

Path C:\Users\Admin\AppData\Local\Temp\tmp-63996-BafKSQ5NTBzp\VulcanMessage5.dll
Size 802KB
SHA256 781f713994c2d58e65a2a9349229acd1bcab253e9e3204bd992175203b7d1f00
MD5 cde5e94a11b89274af4a266cb8bdcddd
SHA1 5c633b04aa385a5476924221a6b41d769f70c557
SHA512 70ead0e3d0f0da916c329f5c0aa60c528fcf8a0b9fb0700bf50322f7df6a2e170da0121aa0d5ab7a84a0867938014a2438c0dd9ce19262ca899b0287c75c5e2e
SSDEEP 12288:MpyLe5IOax8B4OjpYR9AVYvXV+hvMoz+7ACk4ykya7pBdkNTg2Lg2Uk:8yL8IOaxLV+hrmAC5y6duTZkk
TLSH
T1CD056C213E88C135EB9E02B7597CBF2605BDE9604B7485C7A7DC5A5E8E342C22B32357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dispatch-def.toml

Path C:\Users\Admin\AppData\Local\Temp\tmp-63996-BafKSQ5NTBzp\dispatch-def.toml
Size 1.3MB
SHA256 ea87c988f9168cfd83647b0a5f63f8854fb8fcf130bdfe68be21ff2751b5c8b3
MD5 f20eb103212269a67935ed3a48480d82
SHA1 deb685ff81ea04884a0a626786ede619179b8d3c
SHA512 4e4507a9f61dcff52c19765e1de4421b2c880db169a3e1972b9b3c06b094768325b3fdd879d2f8c5e05943bbde15f42a1fb97f6b76ab8981a714380b2148de6d
SSDEEP 24576:7LC35XumCcOqfE0OtZ+YiHTL5SE7Y415FPySJvF0PaIZ9UU6T/dKeHwHM7P31txr:72357CcOZ7iHvj15FKSJt0JZ9UVs9UPl
TLSH
T156552389916DFB99E1D923FF637AF00DA5C5EC3C168E1598417ACE213A009815F2F9B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

display_lib.bin

Path C:\Users\Admin\AppData\Local\Temp\tmp-63996-BafKSQ5NTBzp\display_lib.bin
Size 21KB
SHA256 3ebf3941bc1d450f5a2c905dde7c962070fe9f99c3af5aacd9f427bf913698b2
MD5 fc93807322b7b2d0c8c0dbf7b46cc490
SHA1 68325431a330fc7b47f7e535d7c3559fdfc1bdd8
SHA512 0f2a2320f86b762f16f0f5c45502e59073dc5f113ea67e505328d1fb5b0b44b8dc65fb36724e75510bfe07147ac71c4a3cc992c809d9a2b78fddc62bfea7bd40
SSDEEP 384:vW308SSrgohjffLGEDOYcAOlPPGsd9qZs1N7E+21NSnEyd/9cyw4N:OGMhnLGMcAOhNuss/54N
TLSH
T127A2AEB64FB2AB456C1B983B94B1B4E5C351FAF22D0A01B3F5C9290D343199BED58D83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gude.dll

Path C:\Users\Admin\AppData\Local\Temp\tmp-63996-BafKSQ5NTBzp\gude.dll
Size 1.2MB
SHA256 9ebcdcb038eddd7709f88be121ed8f4aa7578aa6d7109c26775a7d9a9a632d2a
MD5 f15e0fe10831a30c7c8ad89bf5637d43
SHA1 ef9475ce4e8582a15ef937163a502154534b7207
SHA512 de1bd91ef508177bc9b50147f4bb06288a9563ab24c29d3f1777029c84100980b76c2ecd3b9423b0ea368c6b167dd4e8a792b0bbfabc10829fc71f6274549747
SSDEEP 24576:uO5hr0a5P8v16cjK5EtEGmX5WiVRCcUg+8aZm4ws2JIxgAtwYHEgTA/j+Q+jtWwo:ojxtwX5y+22JEthEgTqj+7j9+ccSU
TLSH
T18A45AE21B682C179E99E11B0967EABEF183C57590B7404DBE2D82DAD5E300D37B37B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mShqu1SYQ.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp-63996-BafKSQ5NTBzp\mShqu1SYQ.exe
Size 33.3MB
SHA256 c7a161e17e1bc6c115fe1c057ca955623f3d46850cd0081e0d5bbdef0d13dbe2
MD5 9789063270077bd181506ea83006b3eb
SHA1 be764bb9092fc2322a2f1361f411963c9abb9030
SHA512 fedf156ed313836ace0581d4119a4f7b2adf87184cfd00b3843f3e38703f1b34b55b866687b9dab7fc7ea293293b7ecd2304088e37a5daf51a1793bd260d3cc3
SSDEEP 393216:KYoipe6Ob02BfTfvoMxKAzeR31BwiFvsiXUxew+fWhl1MUl2noOg9Wbkxy0MS/F2:HI3BTrG3MY
TLSH
T10E77380266EB89D1FDF75E70AAFA62575467BD11BF3080CB51082F3A1D736D09A31B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\tmp-63996-BafKSQ5NTBzp\msvcp_win.dll
Size 493KB
SHA256 1cd346de5c12aae1a0288ae13f1d383954630c7b3bb683d4e4e5fe7b0a28b084
MD5 b2c48677d930c635a18b059f41f4ce38
SHA1 fc561931cbd76e36df2791152f38cae525a8e6c4
SHA512 44af8406c96467852c4255f3c299d31c4ba877ca69bf910a9ec4ba15e1d546f3a2e0a3e7c6b0f12afdfe51c0b3830658a355f317ba9d36fd7f5faf32001bc7f6
SSDEEP 12288:XeMcMmVRYcFERWKn9g82vWirm7bAhUgiW6QR7t5s03Ooc8dHkC2esJ2SWQw:XeMKYXQKn9g82vt2bf03Ooc8dHkC2ecQ
TLSH
T156B44B332A4509F1E48A23B4618D936283FDEC650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\tmp-63996-BafKSQ5NTBzp\ucrtbase.dll
Size 1.1MB
SHA256 d55482632d1d34f0605a963676c548926c8a03f50226a1213573eec0b223b697
MD5 d84e6add375748a5f880f8bbc4bd6b5a
SHA1 cd32cbea792b021c655b844a4bf18c2abd005089
SHA512 5361de1528795946dc461dd632eab3afb7b4d94a7941a8ab2df0312f5a08506cf0c6275498fca98c9e89c7f5e34c2ec68409210c62d945e3e6bcd06dfb823a48
SSDEEP 24576:fQeqoON4h/4z/G1YknUkY3Ub6lym9mcvIZPoy4yuhp5Rrbd:4eqoONs42nUv3UbfEp5h5
TLSH
T12F358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

Setup.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Setup.zip:Zone.Identifier
Size 65B
SHA256 e8499b3c1a6ebdb0f44df291a52b65f4410b6779bc900ac969fca84553fd0fdd
MD5 01bcccbed33a9b3785924e5c7da86f8b
SHA1 649fc4b4913a0c6108ee97b4df223277610a3390
SHA512 358befb6a0200b0e64fc35b9031ef12d0878d15e9082909785dc0c4cbbe0fba61c5bc121772abb988e649e12b0f5d885a69f556c2c0e07737bc2fd825cc9e2d7
TLSH
T112A022030000800C0E0030C800ECC828F00EFA008EAB020AEC0000EACC800EC80E2A02
MD5 SHA1 SHA512 TLSH

Submit Download

persistent.1778244358.tmp

Path C:\Users\Admin\Downloads\Setup\data\saves\persistent.1778244358.tmp
Size 1KB
SHA256 208128aa84f3378449b2d1649a17d52c4c9229fa10a1b322ab818349063477bd
MD5 c73174e9c4c6ac7d1362e15a8f8d99c5
SHA1 c179deb08ac31711a3a8410e128b1ba063b7bc62
SHA512 5b02b4892fcdfe38e10447234e7b6c90c17d8c4671f604cbb264ac41db694433993e4ed54122256edc36cca7437c3c423ee2da00f311061825314f43bba611ec
TLSH
T180312A8DAFC4D2C9E71C01E9388EBB4A71806DD69B7018029C76318DA38561CDD337BE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/392-829-0x00000259926A0000-0x00000259926AC000-memory.dmp

Download

memory/392-830-0x0000025992BB0000-0x0000025992BC2000-memory.dmp

Download

memory/1248-863-0x0000000002110000-0x00000000021E6000-memory.dmp

Download

memory/1248-920-0x0000000002110000-0x00000000021E6000-memory.dmp

Download

memory/1248-921-0x0000000006F00000-0x0000000006F12000-memory.dmp

Download

memory/2032-892-0x0000000074540000-0x000000007458F000-memory.dmp

Download

memory/2032-922-0x0000000003220000-0x000000000336D000-memory.dmp

Download

memory/2032-903-0x0000000074540000-0x000000007458F000-memory.dmp

Download

memory/2032-893-0x00007FFFDCF00000-0x00007FFFDD109000-memory.dmp

Download

memory/2336-846-0x000002C99DD50000-0x000002C99DD62000-memory.dmp

Download

memory/2336-845-0x000002C99C400000-0x000002C99C40C000-memory.dmp

Download

memory/2372-861-0x00000253E9F20000-0x00000253E9F2C000-memory.dmp

Download

memory/2372-862-0x00000253EBAB0000-0x00000253EBAC2000-memory.dmp

Download

memory/4016-788-0x0000022698700000-0x000002269871C000-memory.dmp

Download

memory/4016-790-0x00000226FDF70000-0x00000226FDF7A000-memory.dmp

Download

memory/4016-791-0x00000226FF7C0000-0x00000226FF7EA000-memory.dmp

Download

memory/4016-792-0x00000226FF7C0000-0x00000226FF7E4000-memory.dmp

Download

memory/4016-789-0x0000022698730000-0x00000226987E3000-memory.dmp

Download

memory/4016-795-0x00000226800E0000-0x00000226800EC000-memory.dmp

Download

memory/4016-796-0x0000022680140000-0x0000022680152000-memory.dmp

Download

memory/4016-775-0x00000226FDF90000-0x00000226FDFB2000-memory.dmp

Download

memory/5032-811-0x000001C7DE160000-0x000001C7DE213000-memory.dmp

Download

memory/5032-813-0x000001C7C3ED0000-0x000001C7C3EDC000-memory.dmp

Download

memory/5032-814-0x000001C7C5B80000-0x000001C7C5B92000-memory.dmp

Download