Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://disk.yandex....

windows10-2004-x64

8

Resubmissions

08/06/2026, 15:11

260608-sk4wrafv9r8

08/06/2026, 15:01

260608-sdvdqsft4n8

Analysis

  • user interaction
    yes
  • max time kernel
    503s
  • max time network
    505s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/06/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://disk.yandex.ru/d/e5AhP7HCqQT5Lg
  • Sample260608-sdvdqsft4n
Score
8/10
adwaredefense_evasiondiscoveryinstallerpersistenceprivilege_escalationpyinstallerspywarestealertrojanupx

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 10 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 54 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 14 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 49 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://disk.yandex.ru/d/e5AhP7HCqQT5Lg
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4428
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb1435c728,0x7ffb1435c734,0x7ffb1435c740
      2⤵
        PID:4540
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,15828055945263086185,14210159962617435306,262144 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:2
        2⤵
          PID:1272
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2096,i,5141369865407025453,7357501398765425011,524288 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:3
          2⤵
          • Downloads MZ/PE file
          • System Time Discovery
          PID:772
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,287915588292630136,2301829737947483951,524288 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2344 /prefetch:8
          2⤵
            PID:3052
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,6804042733344903242,18423113394798444981,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
            2⤵
              PID:2060
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,16424161081251407684,1804412222731169605,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
              2⤵
                PID:1364
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4352,i,11785972961568712884,2112565611401963707,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4372 /prefetch:2
                2⤵
                  PID:3816
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,11341212667501058931,17984128639197933793,524288 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5444 /prefetch:8
                  2⤵
                    PID:2040
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5564,i,10447439406222709443,2500103440335390346,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:1
                    2⤵
                      PID:1844
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5648,i,13637746575294310703,12550908832917494521,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:1
                      2⤵
                        PID:1144
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6360,i,3945576553297661062,8558137373196692159,524288 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6356 /prefetch:8
                        2⤵
                          PID:2696
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6420,i,7352055589365424697,1726857903564641598,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4968 /prefetch:1
                          2⤵
                            PID:4168
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5556,i,7192907170190439098,12349944533513721842,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:1
                            2⤵
                              PID:3456
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3376,i,11224745823195795064,6069720870847633159,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:1
                              2⤵
                                PID:3604
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4884,i,10852218189391675192,6252153140665228239,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4840 /prefetch:1
                                2⤵
                                  PID:5212
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3344,i,14168246980997633065,801795907679552631,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5632 /prefetch:1
                                  2⤵
                                    PID:5636
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4968,i,7836534084889869159,6109490928060148756,524288 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:8
                                    2⤵
                                      PID:6080
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,8353174523994707723,7894004184480298217,524288 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6360 /prefetch:8
                                      2⤵
                                        PID:6088
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6432,i,17080998306438772801,1865750420931967108,524288 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4924 /prefetch:8
                                        2⤵
                                          PID:6096
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4328,i,11900896633475106539,12207917632532885147,524288 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4388 /prefetch:8
                                          2⤵
                                            PID:4048
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1016,i,15033913692347245429,7541627280462168184,262144 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5188 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:3108
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6616,i,8524617342783781174,16481978655558716835,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:1
                                            2⤵
                                              PID:456
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4368,i,4562062810262469473,6974278080068241500,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6680 /prefetch:1
                                              2⤵
                                                PID:4004
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5672,i,4102220171237494084,11412996788104159838,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:1
                                                2⤵
                                                  PID:5888
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6812,i,8310995831544695749,4725147958141377970,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6824 /prefetch:1
                                                  2⤵
                                                    PID:1784
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6660,i,7829149991781809683,9657535890429897453,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6888 /prefetch:1
                                                    2⤵
                                                      PID:2940
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6832,i,7834942243016008030,790772381674879832,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4856 /prefetch:1
                                                      2⤵
                                                        PID:5188
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4752,i,7559520000737311880,10020971278681478996,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5712 /prefetch:1
                                                        2⤵
                                                          PID:3856
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5728,i,8691903658493360868,6002687446030698926,2097152 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:1
                                                          2⤵
                                                            PID:5080
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4936,i,16938162250505447617,16831891822302376543,524288 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6824 /prefetch:8
                                                            2⤵
                                                              PID:4072
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3200,i,496680585989265900,12038453124417829086,524288 --field-trial-handle=2012,i,11869359855343181998,15841110868441204366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:8
                                                              2⤵
                                                                PID:5072
                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                              1⤵
                                                                PID:3084
                                                              • C:\Windows\System32\rundll32.exe
                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                1⤵
                                                                  PID:3676
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                  1⤵
                                                                    PID:1540
                                                                  • C:\Users\Admin\Downloads\uninstalltool_setup.exe
                                                                    "C:\Users\Admin\Downloads\uninstalltool_setup.exe"
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5520
                                                                    • C:\Users\Admin\AppData\Local\Temp\is-FF81TZNYOA.tmp\uninstalltool_setup.tmp
                                                                      "C:\Users\Admin\AppData\Local\Temp\is-FF81TZNYOA.tmp\uninstalltool_setup.tmp" /SL5="$50272,5231704,895488,C:\Users\Admin\Downloads\uninstalltool_setup.exe"
                                                                      2⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Drops file in Program Files directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5628
                                                                      • C:\Windows\system32\regsvr32.exe
                                                                        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Uninstall Tool\UTShellExt.dll"
                                                                        3⤵
                                                                        • Loads dropped DLL
                                                                        • Modifies system executable filetype association
                                                                        • Modifies registry class
                                                                        PID:704
                                                                      • C:\Windows\system32\regsvr32.exe
                                                                        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Uninstall Tool\UTShellExt_x86.dll"
                                                                        3⤵
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4656
                                                                        • C:\Windows\SysWOW64\regsvr32.exe
                                                                          /s "C:\Program Files\Uninstall Tool\UTShellExt_x86.dll"
                                                                          4⤵
                                                                          • Loads dropped DLL
                                                                          • Modifies system executable filetype association
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry class
                                                                          PID:5820
                                                                      • C:\Program Files\Uninstall Tool\PinToTaskbar.exe
                                                                        "C:\Program Files\Uninstall Tool\PinToTaskbar.exe" /pin UninstallTool.exe
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:5976
                                                                      • C:\Program Files\Uninstall Tool\UninstallTool.exe
                                                                        "C:\Program Files\Uninstall Tool\UninstallTool.exe" /install_service_silent
                                                                        3⤵
                                                                        • Drops file in Drivers directory
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:1728
                                                                      • C:\Program Files\Uninstall Tool\UninstallTool.exe
                                                                        "C:\Program Files\Uninstall Tool\UninstallTool.exe" /init
                                                                        3⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:3156
                                                                      • C:\Program Files\Uninstall Tool\UninstallTool.exe
                                                                        "C:\Program Files\Uninstall Tool\UninstallTool.exe" /add_control_panel_icon
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Modifies registry class
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:5592
                                                                      • C:\Program Files\Uninstall Tool\UninstallTool.exe
                                                                        "C:\Program Files\Uninstall Tool\UninstallTool.exe" /skip_uac
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:5896
                                                                  • C:\Program Files\Uninstall Tool\UninstallTool.exe
                                                                    "C:\Program Files\Uninstall Tool\UninstallTool.exe"
                                                                    1⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Modifies registry class
                                                                    • Modifies system certificate store
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2068
                                                                    • C:\Program Files\Uninstall Tool\UninstallToolHelper.exe
                                                                      "C:\Program Files\Uninstall Tool\UninstallToolHelper.exe" /pid:2068
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4608
                                                                  • C:\Program Files\Uninstall Tool\UninstallTool.exe
                                                                    "C:\Program Files\Uninstall Tool\UninstallTool.exe"
                                                                    1⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Modifies registry class
                                                                    • Modifies system certificate store
                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5828
                                                                    • C:\Program Files\Uninstall Tool\UninstallToolHelper.exe
                                                                      "C:\Program Files\Uninstall Tool\UninstallToolHelper.exe" /pid:5828
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6068
                                                                  • C:\Users\Admin\Downloads\ElysiaV2.exe
                                                                    "C:\Users\Admin\Downloads\ElysiaV2.exe"
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:6052
                                                                    • C:\Users\Admin\Downloads\ElysiaV2.exe
                                                                      "C:\Users\Admin\Downloads\ElysiaV2.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      PID:3112
                                                                  • C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.exe
                                                                    "C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.exe"
                                                                    1⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1072
                                                                    • C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.exe
                                                                      "C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.exe" ::install
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Modifies system executable filetype association
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry class
                                                                      PID:5492
                                                                    • C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe
                                                                      "C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Suspicious use of SetThreadContext
                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:4800
                                                                      • C:\Users\Admin\Desktop\ElysiaV2.exe
                                                                        "C:\Users\Admin\Desktop\ElysiaV2.exe"
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        PID:3804
                                                                        • C:\Users\Admin\Desktop\ElysiaV2.exe
                                                                          "C:\Users\Admin\Desktop\ElysiaV2.exe"
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:4640
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c title Elysia
                                                                            5⤵
                                                                              PID:4520
                                                                        • C:\Users\Admin\Desktop\ElysiaV2.exe
                                                                          "C:\Users\Admin\Desktop\ElysiaV2.exe"
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          PID:2160
                                                                          • C:\Users\Admin\Desktop\ElysiaV2.exe
                                                                            "C:\Users\Admin\Desktop\ElysiaV2.exe"
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            PID:6000
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c title Elysia
                                                                              5⤵
                                                                                PID:3112

                                                                      Network

                                                                            MITRE ATT&CK Enterprise v16

                                                                            Reconnaissance

                                                                            Resource Development

                                                                            Initial Access

                                                                            Execution

                                                                            Persistence

                                                                            Event Triggered Execution

                                                                            2
                                                                            T1546

                                                                            Change Default File Association

                                                                            1
                                                                            T1546.001

                                                                            Component Object Model Hijacking

                                                                            1
                                                                            T1546.015

                                                                            Privilege Escalation

                                                                            Event Triggered Execution

                                                                            2
                                                                            T1546

                                                                            Change Default File Association

                                                                            1
                                                                            T1546.001

                                                                            Component Object Model Hijacking

                                                                            1
                                                                            T1546.015

                                                                            Defense Evasion

                                                                            Modify Registry

                                                                            3
                                                                            T1112

                                                                            Subvert Trust Controls

                                                                            1
                                                                            T1553

                                                                            Install Root Certificate

                                                                            1
                                                                            T1553.004

                                                                            Credential Access

                                                                            Credentials from Password Stores

                                                                            1
                                                                            T1555

                                                                            Credentials from Web Browsers

                                                                            1
                                                                            T1555.003

                                                                            Unsecured Credentials

                                                                            1
                                                                            T1552

                                                                            Credentials In Files

                                                                            1
                                                                            T1552.001

                                                                            Discovery

                                                                            Browser Information Discovery

                                                                            1
                                                                            T1217

                                                                            Peripheral Device Discovery

                                                                            1
                                                                            T1120

                                                                            Query Registry

                                                                            6
                                                                            T1012

                                                                            System Information Discovery

                                                                            5
                                                                            T1082

                                                                            System Location Discovery

                                                                            1
                                                                            T1614

                                                                            System Language Discovery

                                                                            1
                                                                            T1614.001

                                                                            System Time Discovery

                                                                            1
                                                                            T1124

                                                                            Lateral Movement

                                                                            Collection

                                                                            Data from Local System

                                                                            1
                                                                            T1005

                                                                            Command and Control

                                                                            Exfiltration

                                                                            Impact

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            PinToTaskbar.exe
                                                                            • Path C:\Program Files\Uninstall Tool\PinToTaskbar.exe
                                                                            • Size 386KB
                                                                            • SHA256 e87288744cc29c5ab81d9c3fa78653cacd87bc74bf5a3abc4f38afcd6a1a5c16
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            PinToTaskbarHelper.dll
                                                                            • Path C:\Program Files\Uninstall Tool\PinToTaskbarHelper.dll
                                                                            • Size 366KB
                                                                            • SHA256 7d0a990c0b976ff4d99abfa935eadebcece34e7d4e711ed86066ab7845d6a417
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            UTShellExt.dll
                                                                            • Path C:\Program Files\Uninstall Tool\UTShellExt.dll
                                                                            • Size 534KB
                                                                            • SHA256 2c3a8cbc72aa476726de726248f0374d23a82c947c1cd83a0bb1479256800f7b
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            UTShellExt_x86.dll
                                                                            • Path C:\Program Files\Uninstall Tool\UTShellExt_x86.dll
                                                                            • Size 441KB
                                                                            • SHA256 7e84e0a5cfa92978ed9fc71b277c605b2a257aed8be413abdb2100cbce499f61
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            UninstallTool.exe
                                                                            • Path C:\Program Files\Uninstall Tool\UninstallTool.exe
                                                                            • Size 5.8MB
                                                                            • SHA256 3ed4d23131579a3ceb290d82547c09813dcdd23b63a45b52fe2d01a4aaeb04b7
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            UninstallToolHelper.exe
                                                                            • Path C:\Program Files\Uninstall Tool\UninstallToolHelper.exe
                                                                            • Size 463KB
                                                                            • SHA256 ba8d7b5662f85aa901fd6bcf86fc5989013577b18c81a91bffc1211fec31d6c8
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            English.xml
                                                                            • Path C:\Program Files\Uninstall Tool\languages\English.xml
                                                                            • Size 39KB
                                                                            • SHA256 63a657fe7cdde82230a124ea0f4bb4e36e1b1f95b89f14bc8c6877fbfda5f4b5
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Uninstall Tool on the Web.lnk
                                                                            • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uninstall Tool\Uninstall Tool on the Web.lnk
                                                                            • Size 651B
                                                                            • SHA256 becb9a8d5a5d5150550cb2461bb0429838406576e710b21dc94388c9239e7161
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            Uninstall Tool.lnk
                                                                            • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uninstall Tool\Uninstall Tool.lnk
                                                                            • Size 945B
                                                                            • SHA256 402931c3093127d71760835f2a2a481b68ac7a87e3e22e06889fa31eab2a1240
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            103621DE9CD5414CC2538780B4B75751
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
                                                                            • Size 808B
                                                                            • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
                                                                            • Size 765B
                                                                            • SHA256 25e374fdb93693db68f53adf408637d4970ea1d29bcb55eeeb2684843c60e7a3
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            AEACCDA8653DD8D7B2EA32F21D15D44F_D2C5C6F9A17F366FF76FBD7EB5A3FE91
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_D2C5C6F9A17F366FF76FBD7EB5A3FE91
                                                                            • Size 638B
                                                                            • SHA256 5ee4d0fbd6600d285171045fd7f3b1b272712999605218d0d36ef7b4e1efa17a
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
                                                                            • Size 1KB
                                                                            • SHA256 fadb401130be80de89d3bdb3633dc63d7de6d31b622ede36158053fc13781670
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            103621DE9CD5414CC2538780B4B75751
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
                                                                            • Size 192B
                                                                            • SHA256 a9dbcae242cfa6696854c6ca416373d92099c866d486dec5d9a0ca3da006994f
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
                                                                            • Size 484B
                                                                            • SHA256 789c0bb76d9a7a48f9dd6c4a7cec1d30e049470df047cb3289dfcdae0182082a
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            1C2B4A7E568831BA4A3925A3FBBA2B9C
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1C2B4A7E568831BA4A3925A3FBBA2B9C
                                                                            • Size 248B
                                                                            • SHA256 7d9554b3e846be0c98143df95fd85685543382e82d3af97e59a3c7cf3bb54bce
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            AEACCDA8653DD8D7B2EA32F21D15D44F_D2C5C6F9A17F366FF76FBD7EB5A3FE91
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_D2C5C6F9A17F366FF76FBD7EB5A3FE91
                                                                            • Size 484B
                                                                            • SHA256 318b098f1a60c6c77725da79344527d7e3c52e88f12eb9ddeba94165bef2bc4f
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
                                                                            • Size 482B
                                                                            • SHA256 a9ad0879f41da0a11bac26679b7a56c0d8a27b5247f91f4238749477fd0f4f34
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            BookmarkMergedSurfaceOrdering
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                            • Size 6B
                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            BrowsingTopicsState
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                            • Size 649B
                                                                            • SHA256 3ed6f4f7deff5a54b5a2b00f0539ef4f2851922086f02c51d8a73a22da11c3e4
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            f_000034
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034
                                                                            • Size 24KB
                                                                            • SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f_000035
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000035
                                                                            • Size 41KB
                                                                            • SHA256 0e2e6d1994902577a3d3a7f0e37875dd22de26342bec8403ebe262f92f2eddd7
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f_000036
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036
                                                                            • Size 24KB
                                                                            • SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f_000037
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000037
                                                                            • Size 22KB
                                                                            • SHA256 c3e646e385b7f7fa06a4ff8d6a1c628b92948b58fec797f37c357257ed61e7c5
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f_000038
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038
                                                                            • Size 21KB
                                                                            • SHA256 d2263711c4bed4e203c88ed278049c80d1d3b1fff690be0b3a516749cbb38c58
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f_000039
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039
                                                                            • Size 76KB
                                                                            • SHA256 c05c0b2776f09ddd1447ade29fb189caab8846627ac9288aa443404cc65e5900
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                            • Size 1KB
                                                                            • SHA256 daffdda788537b18f4a6468387d26506503b190ca4a240494310ac240e62b96f
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                            • Size 2KB
                                                                            • SHA256 4e78e42d99d9153381130c3a78e3364a4e2f0c75860fc6ce86e6b854b013b941
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            CURRENT
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
                                                                            • Size 16B
                                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            Network Persistent State
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                            • Size 7KB
                                                                            • SHA256 07e78e9e75de957664aba87f1b4db4bfbd9c69aceedf5e7a0714be041a704383
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Network Persistent State
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                            • Size 11KB
                                                                            • SHA256 52fc668d6c79411bd473d58a3730908c0a9a7e3a8a2acdcf721687d2b3c3a12c
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Network Persistent State
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                            • Size 18KB
                                                                            • SHA256 b58a45a265507bab0fdd255ffeb1c71823e1c10d1c06066907a5d56a319976f1
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Network Persistent State
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                            • Size 17KB
                                                                            • SHA256 0042e384e5ea01a84776ee7b64f0b6ff0335b50b3421187d13ea2a077254e7b4
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Network Persistent State
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                            • Size 15KB
                                                                            • SHA256 9664210556077ac5e8285e33e3e54a097741fcf165eb8df3c011d957abff9443
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            def92dad-0a59-4c91-9181-db368c102850.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\def92dad-0a59-4c91-9181-db368c102850.tmp
                                                                            • Size 2B
                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                            • Size 12KB
                                                                            • SHA256 60b65b71d97c91f5b76e7d480d2135d90f48f06977fe969fcb115744eebdf87d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                            • Size 12KB
                                                                            • SHA256 324e637a05eefac6928274a34aede6b962285b24f45d9feca68ab1efcdcb1f8a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                            • Size 13KB
                                                                            • SHA256 2a504098f7cd5edc5b6411eda29ff9be6ea10c18b03fdb69231bc639e08e40de
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                            • Size 14KB
                                                                            • SHA256 f27a21d7b83fbf2cb9dd781a90dec60031746722a18640c1a44d1d4a6736803d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                            • Size 13KB
                                                                            • SHA256 c0ef34d0ca18a0196aa6d615bb44549d064c3244f18a5068aa867714cc49ebf4
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                            • Size 14KB
                                                                            • SHA256 76da5c0ae361abc474d8e61b389b0c6630ef7d15f7ee703c4eee1f46751330ac
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                            • Size 13KB
                                                                            • SHA256 72f76725d6471756876af5f4fffd035920b0b30f7eed85b91a5570ac0f1f91a0
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Secure Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                            • Size 17KB
                                                                            • SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                            • Size 120B
                                                                            • SHA256 a2b77837065c6ba7a4aa33436b786e4aa1a5e4f5cc04035c88417e974ce3a756
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            the-real-index~RFe5867ae.TMP
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5867ae.TMP
                                                                            • Size 96B
                                                                            • SHA256 08a8b42e64746326d780a65cdd476d8b3e2ed200ef5960417a7e8705ad5641fa
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                            • Size 72B
                                                                            • SHA256 6267c41a247a4bb4a6597ce899b63c4bed9ca766a58c596b4baf999d09ce55cf
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                            • Size 116KB
                                                                            • SHA256 bb44e6ca02cb8391bc1c3703756431bee27111b8d9b1f55c769f6f46cf226962
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                            • Size 115KB
                                                                            • SHA256 fab391ace6bb0d8fbe31d2a8f5de7b6038973c518dc56b51115f61ecb5052361
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                            • Size 116KB
                                                                            • SHA256 0f5241c7a1279dc6cb96a8aa0c493d86447323b401bff3f1aaed9be93d97828c
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                            • Size 116KB
                                                                            • SHA256 ea635099b9ab9cc9d0de2362b32c2b7a7b48347cf6fd40000dffef5519284af5
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                            • Size 117KB
                                                                            • SHA256 01358adf140f06d9d25f83e6297a29cff4cb6481625eb712e17f38010c5255d7
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                            • Size 116KB
                                                                            • SHA256 8aa8ec7642aaea7c8ef23d41f2600e550d7bc00f67084d2da67cd6fa3b3da552
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                            • Size 116KB
                                                                            • SHA256 e0f8da2cdbb09cca99c2cbf96ee746412d553a31006bb4a872b0c747e2851f48
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            CisUtMonitor.sys
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\CisUtMonitor.sys
                                                                            • Size 56KB
                                                                            • SHA256 917572f2a45f7b8312ed09d783418534e95888c10f3e0b6cf40c5df58a7c390d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
                                                                            • Size 561KB
                                                                            • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            uninstalltool_setup.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\is-FF81TZNYOA.tmp\uninstalltool_setup.tmp
                                                                            • Size 4.2MB
                                                                            • SHA256 eb7a6ec9e86a224f0b807e79c19126ba04e60090490c0af794530efb0f2e9a68
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            CachedData.dat
                                                                            • Path C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\CachedData.dat
                                                                            • Size 2KB
                                                                            • SHA256 aa7e06c8ba2e2b86573c445fe390f4f0283351c28808437a886a3fc3c45b8d4c
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            CachedData.dat
                                                                            • Path C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\CachedData.dat
                                                                            • Size 2KB
                                                                            • SHA256 ab2893b44bf41edda55371a98a97be06dc116e8989b2ea3306c6eda06bcd851d
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            preferences.xml
                                                                            • Path C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\preferences.xml
                                                                            • Size 2KB
                                                                            • SHA256 f8b25a4555ec7077a0556b820d7be447509e888ef29c732c0af79f38f2a15fff
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            preferences.xml
                                                                            • Path C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\preferences.xml
                                                                            • Size 2KB
                                                                            • SHA256 09bcedd7676a6db6f275f6d0a2150382b0b5ffb70078872462361ec7e370ec72
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            preferences.xml
                                                                            • Path C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\preferences.xml
                                                                            • Size 1KB
                                                                            • SHA256 0237bf82b7610c21bf77e99037ba18d73c9fccec531b49f08e9b821825cbfa00
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            preferences.xml
                                                                            • Path C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\preferences.xml
                                                                            • Size 1KB
                                                                            • SHA256 182eaf91997dd8149b9cd5dfe21273134aa14f5759d80b5035d7651afe9c8283
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            preferences.xml
                                                                            • Path C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\preferences.xml
                                                                            • Size 2KB
                                                                            • SHA256 48723c4fd5123dfa6de2879cf10ada5695037e5bbff73eeae144cc13263bf556
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            Uninstall Tool.lnk
                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Uninstall Tool.lnk
                                                                            • Size 1KB
                                                                            • SHA256 4d55722153fce4472585bae52aaceead3729390297bae48842c10244eeea1fa2
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            f01b4d95cf55d32a.automaticDestinations-ms
                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                                                                            • Size 11KB
                                                                            • SHA256 99bbfa283c98cf81453bb5bddc8620c65b31d0c7caab397b1e6c52b6fe461233
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f01b4d95cf55d32a.automaticDestinations-ms
                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                                                                            • Size 11KB
                                                                            • SHA256 8364984a15bfd926aaec7ab29517fc0dc551d597fe1be6febdc84b36c4a2d20c
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            269c0465f0b4b6ee.customDestinations-ms
                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\269c0465f0b4b6ee.customDestinations-ms
                                                                            • Size 5KB
                                                                            • SHA256 98a2ce162ba61f026b137108d39e1642723e60dd73b76a4767b84e3ba1b2e998
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            269c0465f0b4b6ee.customDestinations-ms
                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\269c0465f0b4b6ee.customDestinations-ms
                                                                            • Size 5KB
                                                                            • SHA256 99d66f816d1ffa9155954b07dc47eafa79dcec0cd3d38198b083895fe8307ebc
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            269c0465f0b4b6ee.customDestinations-ms
                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\269c0465f0b4b6ee.customDestinations-ms
                                                                            • Size 5KB
                                                                            • SHA256 898fc6653e54abb9c6d9ef2d9c6443a88f44234444b525e45ee0d26e4c0ef1b3
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Uninstall Tool.lnk
                                                                            • Path C:\Users\Admin\Desktop\Uninstall Tool.lnk
                                                                            • Size 927B
                                                                            • SHA256 217b60e0e2b25fe6c5b0f69e44da50ce236e6bd07bf49361233d1a5a778eb9dc
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            Unconfirmed 849211.crdownload
                                                                            • Path C:\Users\Admin\Downloads\Unconfirmed 849211.crdownload
                                                                            • Size 6.7MB
                                                                            • SHA256 3f1603b39d0d581e9cdf71b099c189b00b49bc80bac73e830b63d3274381729b
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            x64dbg_hi_IN.qm
                                                                            • Path C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\translations\x64dbg_hi_IN.qm
                                                                            • Size 23B
                                                                            • SHA256 307cef95dd5b36ff215055d427e1885b7fc3650c9224cf76d63056545996ff60
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            x96dbg.exe
                                                                            • Path C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.exe
                                                                            • Size 194KB
                                                                            • SHA256 7473d96b13c350643fc8f471a2e840494f8ab771b35e3e316ebf8a66660df158
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            x96dbg.ini
                                                                            • Path C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.ini
                                                                            • Size 122B
                                                                            • SHA256 672875a23347e407ff4a54c6baa35090c7041fa45568437f12b86b50bc2fbebc
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            elysiav2.exe
                                                                            • Path \??\c:\users\admin\downloads\elysiav2.exe
                                                                            • Size 24.2MB
                                                                            • SHA256 46ad07abcfd2e8c7aec61c75fc383bbf5fd7dbe898cfdfd54bb20c21b225a7fe
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            memory/3112-745-0x00007FFB1D2C0000-0x00007FFB1D2E9000-memory.dmp
                                                                            Download

                                                                            memory/3112-723-0x00007FFB176B0000-0x00007FFB176C4000-memory.dmp
                                                                            Download

                                                                            memory/3112-724-0x00007FFAFDEE0000-0x00007FFAFE5E8000-memory.dmp
                                                                            Download

                                                                            memory/3112-725-0x00007FFB1D2C0000-0x00007FFB1D2E9000-memory.dmp
                                                                            Download

                                                                            memory/3112-726-0x00007FFB03C10000-0x00007FFB04141000-memory.dmp
                                                                            Download

                                                                            memory/3112-727-0x00007FFB14CE0000-0x00007FFB14D14000-memory.dmp
                                                                            Download

                                                                            memory/3112-728-0x00007FFB14820000-0x00007FFB148EE000-memory.dmp
                                                                            Download

                                                                            memory/3112-729-0x00007FFB1D2A0000-0x00007FFB1D2BA000-memory.dmp
                                                                            Download

                                                                            memory/3112-730-0x00007FFB18BC0000-0x00007FFB18BCD000-memory.dmp
                                                                            Download

                                                                            memory/3112-731-0x00007FFB1D270000-0x00007FFB1D29C000-memory.dmp
                                                                            Download

                                                                            memory/3112-732-0x00007FFB14C70000-0x00007FFB14C7B000-memory.dmp
                                                                            Download

                                                                            memory/3112-734-0x00007FFB147F0000-0x00007FFB14817000-memory.dmp
                                                                            Download

                                                                            memory/3112-733-0x00007FFB14E80000-0x00007FFB14F00000-memory.dmp
                                                                            Download

                                                                            memory/3112-736-0x00007FFB08510000-0x00007FFB085CE000-memory.dmp
                                                                            Download

                                                                            memory/3112-735-0x00007FFB1CF40000-0x00007FFB1CF5A000-memory.dmp
                                                                            Download

                                                                            memory/3112-739-0x00007FFB1B230000-0x00007FFB1B23F000-memory.dmp
                                                                            Download

                                                                            memory/3112-738-0x00007FFB13F10000-0x00007FFB13F3E000-memory.dmp
                                                                            Download

                                                                            memory/3112-737-0x00007FFB14400000-0x00007FFB1442A000-memory.dmp
                                                                            Download

                                                                            memory/3112-740-0x00007FFB176B0000-0x00007FFB176C4000-memory.dmp
                                                                            Download

                                                                            memory/3112-741-0x00007FFAFC420000-0x00007FFAFC7D9000-memory.dmp
                                                                            Download

                                                                            memory/3112-742-0x00007FFB03C10000-0x00007FFB04141000-memory.dmp
                                                                            Download

                                                                            memory/3112-743-0x00007FFAFB050000-0x00007FFAFC418000-memory.dmp
                                                                            Download

                                                                            memory/3112-751-0x00007FFB1CF30000-0x00007FFB1CF3D000-memory.dmp
                                                                            Download

                                                                            memory/3112-749-0x00007FFB14E80000-0x00007FFB14F00000-memory.dmp
                                                                            Download

                                                                            memory/3112-777-0x00007FFAFC420000-0x00007FFAFC7D9000-memory.dmp
                                                                            Download

                                                                            memory/3112-776-0x00007FFB14400000-0x00007FFB1442A000-memory.dmp
                                                                            Download

                                                                            memory/3112-778-0x00007FFAFB050000-0x00007FFAFC418000-memory.dmp
                                                                            Download

                                                                            memory/3112-775-0x00007FFB08510000-0x00007FFB085CE000-memory.dmp
                                                                            Download

                                                                            memory/3112-774-0x00007FFB147F0000-0x00007FFB14817000-memory.dmp
                                                                            Download

                                                                            memory/3112-773-0x00007FFB14C70000-0x00007FFB14C7B000-memory.dmp
                                                                            Download

                                                                            memory/3112-772-0x00007FFB18BC0000-0x00007FFB18BCD000-memory.dmp
                                                                            Download

                                                                            memory/3112-771-0x00007FFB14820000-0x00007FFB148EE000-memory.dmp
                                                                            Download

                                                                            memory/3112-770-0x00007FFB14CE0000-0x00007FFB14D14000-memory.dmp
                                                                            Download

                                                                            memory/3112-769-0x00007FFB03C10000-0x00007FFB04141000-memory.dmp
                                                                            Download

                                                                            memory/3112-768-0x00007FFB176B0000-0x00007FFB176C4000-memory.dmp
                                                                            Download

                                                                            memory/3112-767-0x00007FFB1B230000-0x00007FFB1B23F000-memory.dmp
                                                                            Download

                                                                            memory/3112-766-0x00007FFB13F10000-0x00007FFB13F3E000-memory.dmp
                                                                            Download

                                                                            memory/3112-765-0x00007FFB1CF40000-0x00007FFB1CF5A000-memory.dmp
                                                                            Download

                                                                            memory/3112-748-0x00007FFB1D270000-0x00007FFB1D29C000-memory.dmp
                                                                            Download

                                                                            memory/3112-747-0x00007FFB1D2A0000-0x00007FFB1D2BA000-memory.dmp
                                                                            Download

                                                                            memory/3112-746-0x00007FFB1E910000-0x00007FFB1E91F000-memory.dmp
                                                                            Download

                                                                            memory/3112-721-0x00007FFB1CF30000-0x00007FFB1CF3D000-memory.dmp
                                                                            Download

                                                                            memory/3112-744-0x00007FFAFDEE0000-0x00007FFAFE5E8000-memory.dmp
                                                                            Download

                                                                            memory/3112-720-0x00007FFB1CF40000-0x00007FFB1CF5A000-memory.dmp
                                                                            Download

                                                                            memory/3112-719-0x00007FFB14E80000-0x00007FFB14F00000-memory.dmp
                                                                            Download

                                                                            memory/3112-718-0x00007FFB1D270000-0x00007FFB1D29C000-memory.dmp
                                                                            Download

                                                                            memory/3112-717-0x00007FFB1D2A0000-0x00007FFB1D2BA000-memory.dmp
                                                                            Download

                                                                            memory/3112-715-0x00007FFB1D2C0000-0x00007FFB1D2E9000-memory.dmp
                                                                            Download

                                                                            memory/3112-716-0x00007FFB1E910000-0x00007FFB1E91F000-memory.dmp
                                                                            Download

                                                                            memory/3112-714-0x00007FFAFDEE0000-0x00007FFAFE5E8000-memory.dmp
                                                                            Download

                                                                            memory/3112-722-0x00007FFB1B230000-0x00007FFB1B23F000-memory.dmp
                                                                            Download

                                                                            memory/3188-449-0x0000000006BA0000-0x0000000006BA1000-memory.dmp
                                                                            Download

                                                                            memory/3188-448-0x0000000002B60000-0x0000000002B61000-memory.dmp
                                                                            Download

                                                                            memory/4608-502-0x0000000000400000-0x0000000000474000-memory.dmp
                                                                            Download

                                                                            memory/4608-547-0x0000000000400000-0x0000000000474000-memory.dmp
                                                                            Download

                                                                            memory/4608-462-0x0000000000400000-0x0000000000474000-memory.dmp
                                                                            Download

                                                                            memory/4640-2006-0x00007FFB147A0000-0x00007FFB147AF000-memory.dmp
                                                                            Download

                                                                            memory/4640-2033-0x00007FFB082C0000-0x00007FFB082E7000-memory.dmp
                                                                            Download

                                                                            memory/4640-2113-0x00007FFB03090000-0x00007FFB0315E000-memory.dmp
                                                                            Download

                                                                            memory/4640-2114-0x00007FFB13210000-0x00007FFB1321D000-memory.dmp
                                                                            Download

                                                                            memory/4640-2115-0x00007FFB0F4A0000-0x00007FFB0F4AB000-memory.dmp
                                                                            Download

                                                                            memory/4640-2101-0x00007FFB019C0000-0x00007FFB020C8000-memory.dmp
                                                                            Download

                                                                            memory/4640-2106-0x00007FFB04370000-0x00007FFB043F0000-memory.dmp
                                                                            Download

                                                                            memory/4640-2108-0x00007FFB14C80000-0x00007FFB14C8D000-memory.dmp
                                                                            Download

                                                                            memory/4640-2112-0x00007FFB13EE0000-0x00007FFB13F14000-memory.dmp
                                                                            Download

                                                                            memory/4640-2111-0x00007FFAFB700000-0x00007FFAFBC31000-memory.dmp
                                                                            Download

                                                                            memory/4640-2120-0x00007FFAFDC70000-0x00007FFAFE029000-memory.dmp
                                                                            Download

                                                                            memory/4640-2122-0x00007FFB03B90000-0x00007FFB03BB2000-memory.dmp
                                                                            Download

                                                                            memory/4640-2121-0x00007FFAFA330000-0x00007FFAFB6F8000-memory.dmp
                                                                            Download

                                                                            memory/4640-2123-0x00007FFAF9FE0000-0x00007FFAFA326000-memory.dmp
                                                                            Download

                                                                            memory/4640-2124-0x00007FFAF80F0000-0x00007FFAF86CD000-memory.dmp
                                                                            Download

                                                                            memory/4640-2118-0x00007FFB044C0000-0x00007FFB044EA000-memory.dmp
                                                                            Download

                                                                            memory/4640-1998-0x00007FFB019C0000-0x00007FFB020C8000-memory.dmp
                                                                            Download

                                                                            memory/4640-1999-0x00007FFB147B0000-0x00007FFB147D9000-memory.dmp
                                                                            Download

                                                                            memory/4640-2000-0x00007FFB14C90000-0x00007FFB14C9F000-memory.dmp
                                                                            Download

                                                                            memory/4640-2001-0x00007FFB14770000-0x00007FFB1478A000-memory.dmp
                                                                            Download

                                                                            memory/4640-2002-0x00007FFB14400000-0x00007FFB1442C000-memory.dmp
                                                                            Download

                                                                            memory/4640-2003-0x00007FFB04370000-0x00007FFB043F0000-memory.dmp
                                                                            Download

                                                                            memory/4640-2004-0x00007FFB14750000-0x00007FFB1476A000-memory.dmp
                                                                            Download

                                                                            memory/4640-2054-0x00007FFB04370000-0x00007FFB043F0000-memory.dmp
                                                                            Download

                                                                            memory/4640-2005-0x00007FFB14C80000-0x00007FFB14C8D000-memory.dmp
                                                                            Download

                                                                            memory/4640-2009-0x00007FFB147B0000-0x00007FFB147D9000-memory.dmp
                                                                            Download

                                                                            memory/4640-2010-0x00007FFAFB700000-0x00007FFAFBC31000-memory.dmp
                                                                            Download

                                                                            memory/4640-2008-0x00007FFB13F20000-0x00007FFB13F34000-memory.dmp
                                                                            Download

                                                                            memory/4640-2007-0x00007FFB019C0000-0x00007FFB020C8000-memory.dmp
                                                                            Download

                                                                            memory/4640-2011-0x00007FFB13EE0000-0x00007FFB13F14000-memory.dmp
                                                                            Download

                                                                            memory/4640-2012-0x00007FFB03090000-0x00007FFB0315E000-memory.dmp
                                                                            Download

                                                                            memory/4640-2019-0x00007FFB02FD0000-0x00007FFB0308E000-memory.dmp
                                                                            Download

                                                                            memory/4640-2018-0x00007FFB082C0000-0x00007FFB082E7000-memory.dmp
                                                                            Download

                                                                            memory/4640-2017-0x00007FFB04370000-0x00007FFB043F0000-memory.dmp
                                                                            Download

                                                                            memory/4640-2016-0x00007FFB14400000-0x00007FFB1442C000-memory.dmp
                                                                            Download

                                                                            memory/4640-2015-0x00007FFB0F4A0000-0x00007FFB0F4AB000-memory.dmp
                                                                            Download

                                                                            memory/4640-2014-0x00007FFB13210000-0x00007FFB1321D000-memory.dmp
                                                                            Download

                                                                            memory/4640-2013-0x00007FFB14770000-0x00007FFB1478A000-memory.dmp
                                                                            Download

                                                                            memory/4640-2021-0x00007FFB147A0000-0x00007FFB147AF000-memory.dmp
                                                                            Download

                                                                            memory/4640-2022-0x00007FFB03BC0000-0x00007FFB03BEE000-memory.dmp
                                                                            Download

                                                                            memory/4640-2020-0x00007FFB044C0000-0x00007FFB044EA000-memory.dmp
                                                                            Download

                                                                            memory/4640-2023-0x00007FFB13F20000-0x00007FFB13F34000-memory.dmp
                                                                            Download

                                                                            memory/4640-2024-0x00007FFAFB700000-0x00007FFAFBC31000-memory.dmp
                                                                            Download

                                                                            memory/4640-2025-0x00007FFAFDC70000-0x00007FFAFE029000-memory.dmp
                                                                            Download

                                                                            memory/4640-2026-0x00007FFAFA330000-0x00007FFAFB6F8000-memory.dmp
                                                                            Download

                                                                            memory/4640-2027-0x00007FFB13EE0000-0x00007FFB13F14000-memory.dmp
                                                                            Download

                                                                            memory/4640-2028-0x00007FFB03B90000-0x00007FFB03BB2000-memory.dmp
                                                                            Download

                                                                            memory/4640-2030-0x00007FFAF9FE0000-0x00007FFAFA326000-memory.dmp
                                                                            Download

                                                                            memory/4640-2029-0x00007FFB03090000-0x00007FFB0315E000-memory.dmp
                                                                            Download

                                                                            memory/4640-2031-0x00007FFAF80F0000-0x00007FFAF86CD000-memory.dmp
                                                                            Download

                                                                            memory/4640-2034-0x00007FFB03AB0000-0x00007FFB03AF1000-memory.dmp
                                                                            Download

                                                                            memory/4640-2049-0x00007FFB019C0000-0x00007FFB020C8000-memory.dmp
                                                                            Download

                                                                            memory/4640-2032-0x00007FFB03B50000-0x00007FFB03B8F000-memory.dmp
                                                                            Download

                                                                            memory/4640-2036-0x00007FFB02300000-0x00007FFB023C0000-memory.dmp
                                                                            Download

                                                                            memory/4640-2035-0x00007FFB02FD0000-0x00007FFB0308E000-memory.dmp
                                                                            Download

                                                                            memory/4640-2040-0x00007FFB0F490000-0x00007FFB0F49F000-memory.dmp
                                                                            Download

                                                                            memory/4640-2039-0x00007FFB044C0000-0x00007FFB044EA000-memory.dmp
                                                                            Download

                                                                            memory/4640-2041-0x00007FFB03BC0000-0x00007FFB03BEE000-memory.dmp
                                                                            Download

                                                                            memory/4640-2042-0x00007FFAFDC70000-0x00007FFAFE029000-memory.dmp
                                                                            Download

                                                                            memory/4640-2043-0x00007FFAFA330000-0x00007FFAFB6F8000-memory.dmp
                                                                            Download

                                                                            memory/4640-2060-0x00007FFB13EE0000-0x00007FFB13F14000-memory.dmp
                                                                            Download

                                                                            memory/4640-2047-0x00007FFAF9FE0000-0x00007FFAFA326000-memory.dmp
                                                                            Download

                                                                            memory/4640-2059-0x00007FFAFB700000-0x00007FFAFBC31000-memory.dmp
                                                                            Download

                                                                            memory/4640-2061-0x00007FFB03090000-0x00007FFB0315E000-memory.dmp
                                                                            Download

                                                                            memory/4800-2144-0x0000024307EC0000-0x00000243080F7000-memory.dmp
                                                                            Download

                                                                            memory/4800-1853-0x0000024307EC0000-0x00000243080F7000-memory.dmp
                                                                            Download

                                                                            memory/4800-1808-0x00007FFAFBC40000-0x00007FFAFC195000-memory.dmp
                                                                            Download

                                                                            memory/4800-2075-0x0000024307EC0000-0x00000243080F7000-memory.dmp
                                                                            Download

                                                                            memory/4800-1817-0x0000000076D90000-0x0000000076DA5000-memory.dmp
                                                                            Download

                                                                            memory/4800-1865-0x0000024307EC0000-0x00000243080F7000-memory.dmp
                                                                            Download

                                                                            memory/4800-1862-0x0000024307EC0000-0x00000243080F7000-memory.dmp
                                                                            Download

                                                                            memory/4800-1859-0x0000024307EC0000-0x00000243080F7000-memory.dmp
                                                                            Download

                                                                            memory/4800-1816-0x0000024307EC0000-0x00000243080F7000-memory.dmp
                                                                            Download

                                                                            memory/4800-2045-0x0000024307EC0000-0x00000243080F7000-memory.dmp
                                                                            Download

                                                                            memory/4800-1856-0x0000024307EC0000-0x00000243080F7000-memory.dmp
                                                                            Download

                                                                            memory/4800-2290-0x0000024307EC0000-0x00000243080F7000-memory.dmp
                                                                            Download

                                                                            memory/4800-2136-0x0000024307EC0000-0x00000243080F7000-memory.dmp
                                                                            Download

                                                                            memory/5520-505-0x0000000000CD0000-0x0000000000DBA000-memory.dmp
                                                                            Download

                                                                            memory/5520-257-0x0000000000D8D000-0x0000000000D8E000-memory.dmp
                                                                            Download

                                                                            memory/5520-280-0x0000000000CD0000-0x0000000000DBA000-memory.dmp
                                                                            Download

                                                                            memory/5520-258-0x0000000000CD0000-0x0000000000DBA000-memory.dmp
                                                                            Download

                                                                            memory/5628-377-0x0000000000DF0000-0x0000000001242000-memory.dmp
                                                                            Download

                                                                            memory/5628-504-0x0000000000DF0000-0x0000000001242000-memory.dmp
                                                                            Download

                                                                            memory/5628-491-0x0000000000DF0000-0x0000000001242000-memory.dmp
                                                                            Download

                                                                            memory/5628-376-0x0000000000DF0000-0x0000000001242000-memory.dmp
                                                                            Download

                                                                            memory/5628-264-0x000000000119A000-0x000000000119C000-memory.dmp
                                                                            Download

                                                                            memory/5628-270-0x0000000000DF0000-0x0000000001242000-memory.dmp
                                                                            Download

                                                                            memory/6000-2315-0x00007FFB13EE0000-0x00007FFB13F0A000-memory.dmp
                                                                            Download

                                                                            memory/6000-2311-0x00007FFB147A0000-0x00007FFB147AD000-memory.dmp
                                                                            Download

                                                                            memory/6000-2319-0x00007FFB082C0000-0x00007FFB082E2000-memory.dmp
                                                                            Download

                                                                            memory/6000-2317-0x00007FFAFDC70000-0x00007FFAFE029000-memory.dmp
                                                                            Download

                                                                            memory/6000-2316-0x00007FFB08310000-0x00007FFB0833E000-memory.dmp
                                                                            Download

                                                                            memory/6000-2321-0x00007FFAF9D50000-0x00007FFAFA32D000-memory.dmp
                                                                            Download

                                                                            memory/6000-2314-0x00007FFB035F0000-0x00007FFB036AE000-memory.dmp
                                                                            Download

                                                                            memory/6000-2313-0x00007FFB13F10000-0x00007FFB13F37000-memory.dmp
                                                                            Download

                                                                            memory/6000-2312-0x00007FFB14760000-0x00007FFB1476B000-memory.dmp
                                                                            Download

                                                                            memory/6000-2320-0x00007FFB02F30000-0x00007FFB03276000-memory.dmp
                                                                            Download

                                                                            memory/6000-2310-0x00007FFB08340000-0x00007FFB0840E000-memory.dmp
                                                                            Download

                                                                            memory/6000-2309-0x00007FFB143F0000-0x00007FFB14424000-memory.dmp
                                                                            Download

                                                                            memory/6000-2298-0x00007FFB019C0000-0x00007FFB020C8000-memory.dmp
                                                                            Download

                                                                            memory/6000-2322-0x00007FFB043A0000-0x00007FFB043E1000-memory.dmp
                                                                            Download

                                                                            memory/6000-2308-0x00007FFAFB700000-0x00007FFAFBC31000-memory.dmp
                                                                            Download

                                                                            memory/6068-582-0x0000000000400000-0x0000000000474000-memory.dmp
                                                                            Download

                                                                            memory/6068-565-0x0000000000400000-0x0000000000474000-memory.dmp
                                                                            Download