donutloader | 3e1fb4cc6c8ce65e6ac79793cb7d482e6c18ba46dce36b0c51a259b511528d30

Analysis

max time kernel
149s
max time network
146s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
13/07/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
component_2.exe
Size 1.0MB
Sample260713-bb2llaav5l
SHA256 3e1fb4cc6c8ce65e6ac79793cb7d482e6c18ba46dce36b0c51a259b511528d30
MD5 dea25a6b76f660ff1d464c88ce57e453
SHA1 e114092df6873c703be1a785646b171948d37980
SHA512 f5cb10060b1cbce9a460861c6b959926c0c7affd132d8a3c361118e0f17a08a719b20e8fd8a27d8c583d2091734fcdc33a0e2e84617c165445f8659a07b579a7
SSDEEP 24576:eOlOX6eCdBvm0+myIesqfFSZhGGtEoeJhkhfIkdb5:eOlC8H3Bf
TLSH
T13435CF163BF5EE01E2AA33B940A045D443F5E4199E86DF0A22D43AF36ADFF91DB06057
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader persistence spyware stealer

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/3928-7-0x00000230ABFF0000-0x00000230AC232000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2220	powershell.exe
3804	powershell.exe
1060	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	component_2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\Control Panel\International\Geo\Nation	CoreWorker_eISNxgiOXwxybMx.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Repair.lnk	component_2.exe

Executes dropped EXE 2 IoCs

pid	Process
2488	CoreWorker_eISNxgiOXwxybMx.exe
5568	CoreWorker_eISNxgiOXwxybMx.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoreWorker_eISNxgiOXwxybMx = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_eISNxgiOXwxybMx.exe"	component_2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-101591186-421676486-4137282292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoreWorker_eISNxgiOXwxybMx = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_eISNxgiOXwxybMx.exe"	CoreWorker_eISNxgiOXwxybMx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoreWorker_eISNxgiOXwxybMx = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_eISNxgiOXwxybMx.exe"	CoreWorker_eISNxgiOXwxybMx.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2780	chrome.exe
3472	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	component_2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	component_2.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe
3928	component_2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
5184	chrome.exe
5184	chrome.exe
5184	chrome.exe
5184	chrome.exe
5184	chrome.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe
5892	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3928	component_2.exe
Token: SeDebugPrivilege	3928	component_2.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeIncreaseQuotaPrivilege	2220	powershell.exe
Token: SeSecurityPrivilege	2220	powershell.exe
Token: SeTakeOwnershipPrivilege	2220	powershell.exe
Token: SeLoadDriverPrivilege	2220	powershell.exe
Token: SeSystemProfilePrivilege	2220	powershell.exe
Token: SeSystemtimePrivilege	2220	powershell.exe
Token: SeProfSingleProcessPrivilege	2220	powershell.exe
Token: SeIncBasePriorityPrivilege	2220	powershell.exe
Token: SeCreatePagefilePrivilege	2220	powershell.exe
Token: SeBackupPrivilege	2220	powershell.exe
Token: SeRestorePrivilege	2220	powershell.exe
Token: SeShutdownPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeSystemEnvironmentPrivilege	2220	powershell.exe
Token: SeRemoteShutdownPrivilege	2220	powershell.exe
Token: SeUndockPrivilege	2220	powershell.exe
Token: SeManageVolumePrivilege	2220	powershell.exe
Token: 33	2220	powershell.exe
Token: 34	2220	powershell.exe
Token: 35	2220	powershell.exe
Token: 36	2220	powershell.exe
Token: SeDebugPrivilege	2488	CoreWorker_eISNxgiOXwxybMx.exe
Token: SeDebugPrivilege	2488	CoreWorker_eISNxgiOXwxybMx.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeIncreaseQuotaPrivilege	3804	powershell.exe
Token: SeSecurityPrivilege	3804	powershell.exe
Token: SeTakeOwnershipPrivilege	3804	powershell.exe
Token: SeLoadDriverPrivilege	3804	powershell.exe
Token: SeSystemProfilePrivilege	3804	powershell.exe
Token: SeSystemtimePrivilege	3804	powershell.exe
Token: SeProfSingleProcessPrivilege	3804	powershell.exe
Token: SeIncBasePriorityPrivilege	3804	powershell.exe
Token: SeCreatePagefilePrivilege	3804	powershell.exe
Token: SeBackupPrivilege	3804	powershell.exe
Token: SeRestorePrivilege	3804	powershell.exe
Token: SeShutdownPrivilege	3804	powershell.exe
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeSystemEnvironmentPrivilege	3804	powershell.exe
Token: SeRemoteShutdownPrivilege	3804	powershell.exe
Token: SeUndockPrivilege	3804	powershell.exe
Token: SeManageVolumePrivilege	3804	powershell.exe
Token: 33	3804	powershell.exe
Token: 34	3804	powershell.exe
Token: 35	3804	powershell.exe
Token: 36	3804	powershell.exe
Token: SeIncreaseQuotaPrivilege	1060	powershell.exe
Token: SeSecurityPrivilege	1060	powershell.exe
Token: SeTakeOwnershipPrivilege	1060	powershell.exe
Token: SeLoadDriverPrivilege	1060	powershell.exe
Token: SeSystemProfilePrivilege	1060	powershell.exe
Token: SeSystemtimePrivilege	1060	powershell.exe
Token: SeProfSingleProcessPrivilege	1060	powershell.exe
Token: SeIncBasePriorityPrivilege	1060	powershell.exe
Token: SeCreatePagefilePrivilege	1060	powershell.exe
Token: SeBackupPrivilege	1060	powershell.exe
Token: SeRestorePrivilege	1060	powershell.exe
Token: SeShutdownPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeSystemEnvironmentPrivilege	1060	powershell.exe
Token: SeRemoteShutdownPrivilege	1060	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5184	chrome.exe
5184	chrome.exe
5892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 3464	3928	component_2.exe	89
PID 3928 wrote to memory of 5328	3928	component_2.exe	88
PID 3928 wrote to memory of 3464	3928	component_2.exe	89
PID 3928 wrote to memory of 5328	3928	component_2.exe	88
PID 3928 wrote to memory of 5184	3928	component_2.exe	93
PID 5184 wrote to memory of 5784	5184	chrome.exe	94
PID 5184 wrote to memory of 3116	5184	chrome.exe	95
PID 5184 wrote to memory of 3116	5184	chrome.exe	95
PID 5184 wrote to memory of 2780	5184	chrome.exe	96
PID 5184 wrote to memory of 5776	5184	chrome.exe	97
PID 5184 wrote to memory of 5776	5184	chrome.exe	97
PID 5184 wrote to memory of 5468	5184	chrome.exe	98
PID 5184 wrote to memory of 3636	5184	chrome.exe	99
PID 5184 wrote to memory of 5468	5184	chrome.exe	98
PID 5184 wrote to memory of 3636	5184	chrome.exe	99
PID 5184 wrote to memory of 1532	5184	chrome.exe	100
PID 5184 wrote to memory of 5788	5184	chrome.exe	101
PID 5184 wrote to memory of 1532	5184	chrome.exe	100
PID 5184 wrote to memory of 5788	5184	chrome.exe	101
PID 5184 wrote to memory of 5588	5184	chrome.exe	102
PID 5184 wrote to memory of 5588	5184	chrome.exe	102
PID 3928 wrote to memory of 5892	3928	component_2.exe	103
PID 5892 wrote to memory of 3024	5892	msedge.exe	104
PID 5892 wrote to memory of 3472	5892	msedge.exe	105
PID 5892 wrote to memory of 5584	5892	msedge.exe	106
PID 5892 wrote to memory of 5584	5892	msedge.exe	106
PID 5892 wrote to memory of 5584	5892	msedge.exe	106
PID 5892 wrote to memory of 5212	5892	msedge.exe	107
PID 5892 wrote to memory of 5212	5892	msedge.exe	107
PID 5892 wrote to memory of 4600	5892	msedge.exe	108
PID 5892 wrote to memory of 4600	5892	msedge.exe	108
PID 5892 wrote to memory of 4440	5892	msedge.exe	109
PID 5892 wrote to memory of 4600	5892	msedge.exe	108
PID 5892 wrote to memory of 4440	5892	msedge.exe	109
PID 5892 wrote to memory of 4440	5892	msedge.exe	109
PID 5892 wrote to memory of 2336	5892	msedge.exe	110
PID 5892 wrote to memory of 2028	5892	msedge.exe	111
PID 5892 wrote to memory of 5060	5892	msedge.exe	112
PID 5892 wrote to memory of 3320	5892	msedge.exe	113
PID 5892 wrote to memory of 3320	5892	msedge.exe	113
PID 5892 wrote to memory of 1944	5892	msedge.exe	114
PID 5892 wrote to memory of 3320	5892	msedge.exe	113
PID 5892 wrote to memory of 1944	5892	msedge.exe	114
PID 5892 wrote to memory of 1944	5892	msedge.exe	114
PID 5892 wrote to memory of 3800	5892	msedge.exe	115
PID 5892 wrote to memory of 3800	5892	msedge.exe	115
PID 5892 wrote to memory of 3800	5892	msedge.exe	115
PID 5892 wrote to memory of 5488	5892	msedge.exe	116
PID 5892 wrote to memory of 4580	5892	msedge.exe	117
PID 5892 wrote to memory of 3428	5892	msedge.exe	118
PID 5892 wrote to memory of 3940	5892	msedge.exe	119
PID 5892 wrote to memory of 5488	5892	msedge.exe	116
PID 5892 wrote to memory of 5488	5892	msedge.exe	116
PID 5892 wrote to memory of 4580	5892	msedge.exe	117
PID 5892 wrote to memory of 4580	5892	msedge.exe	117
PID 5892 wrote to memory of 3428	5892	msedge.exe	118
PID 5892 wrote to memory of 1108	5892	msedge.exe	120
PID 5892 wrote to memory of 5024	5892	msedge.exe	121
PID 5892 wrote to memory of 2484	5892	msedge.exe	122
PID 5892 wrote to memory of 3428	5892	msedge.exe	118
PID 5892 wrote to memory of 3940	5892	msedge.exe	119
PID 5892 wrote to memory of 3940	5892	msedge.exe	119
PID 5892 wrote to memory of 1108	5892	msedge.exe	120
PID 5892 wrote to memory of 1108	5892	msedge.exe	120

C:\Users\Admin\AppData\Local\Temp\component_2.exe
"C:\Users\Admin\AppData\Local\Temp\component_2.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef" --app=http://127.0.0.1:49863
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffd7d09c728,0x7ffd7d09c734,0x7ffd7d09c740
    3⤵
    PID:5784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,13068751770318534748,1865367749121909679,262144 --field-trial-handle=1884,i,6464135260502430088,13883737020630312281,262144 --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:2
    3⤵
    PID:3116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef" --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,10291612808544378554,14558281915382622944,524288 --field-trial-handle=1884,i,6464135260502430088,13883737020630312281,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef" --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,18029974132737385023,7158812892968706676,524288 --field-trial-handle=1884,i,6464135260502430088,13883737020630312281,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
    3⤵
    PID:5776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,12159600581717640872,14504258704364481904,2097152 --field-trial-handle=1884,i,6464135260502430088,13883737020630312281,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:5468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,743757814348243986,6605251369781391799,2097152 --field-trial-handle=1884,i,6464135260502430088,13883737020630312281,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:3636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3632,i,7164935638496707155,14317129769666671455,2097152 --field-trial-handle=1884,i,6464135260502430088,13883737020630312281,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
    3⤵
    PID:1532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3644,i,16931748096608551416,42240305228745299,2097152 --field-trial-handle=1884,i,6464135260502430088,13883737020630312281,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:2
    3⤵
    PID:5788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3480,i,2422570993299407315,7690287406453506634,2097152 --field-trial-handle=1884,i,6464135260502430088,13883737020630312281,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:2
    3⤵
    PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --app=http://127.0.0.1:50016
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffd6b18c188,0x7ffd6b18c194,0x7ffd6b18c1a0
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,11601801757722995545,16744320438778568506,524288 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,3831254281728397556,13463234595212272370,262144 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,6336400051761685363,11896250071667911946,524288 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,11483073399626074216,4000749194829321097,2097152 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,15757334261803943697,10838693557505636268,2097152 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,10611901458788184639,5173368521708170409,524288 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:8
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,2343860340544872943,4429116879234225792,524288 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,519147013608686686,5116651420740184628,524288 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:8
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3936,i,6596344906329743813,9346844489615429299,2097152 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:1
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3956,i,7553519795944051371,15713039949783716768,2097152 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:2
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4352,i,6711910124485186485,17523854029877227013,2097152 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4436,i,4790948033025002458,3039096786480922371,2097152 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:2
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4452,i,7421974737505611235,2006539633660288523,2097152 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4464,i,16491869883431973179,13572370517201849380,2097152 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:2
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4516,i,13559880815376186093,6503030730038602689,2097152 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4532,i,17046035360160104725,15127319302620615486,2097152 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:2
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4624,i,9601049896899204887,13917354311633168784,2097152 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4640,i,5257255581523255812,1849209433400119950,2097152 --field-trial-handle=2448,i,243272606194395213,17667359944191797876,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:2
    3⤵
    PID:2484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
  2⤵
  PID:5148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe
  "C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'CoreWorker_eISNxgiOXwxybMx-8642' -RunLevel Highest "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1060
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
    3⤵
    PID:4336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4580

C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe
1⤵
- Executes dropped EXE
PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CoreWorker_eISNxgiOXwxybMx.exe

Path C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe
Size 13KB
SHA256 ac1b5674bc96f344170df29bc59c38907370786a8495f33d75b20cff7f16a5f7
MD5 8f6f193d29649778778f82c815f0dcf5
SHA1 779e92a644084a2a3135cc410ccb960e9d8a932f
SHA512 1537c104e9377a26f8a347a493e32b0625cc44cd8eecae2c7595c67d8e768ae00b2f990247d6698d474e2af4469dfd30b8a666acd60a56c720cb8fb3d74e1aef
SSDEEP 192:lP4EDne8F9DTHoKiTizMVhmHGjrmbQSaZxGKTOkhEw3zzMRDTQsW7vm:p4EH9D8KiuRGjrmbQSgxLiR0Mx/W7v
TLSH
T1B0520904B7E18125E9BA0B39EEF355005A33F7635936CE5E14CC518B0B27680AEE2F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_21aufw5v.1ya.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_21aufw5v.1ya.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho\Crashpad\settings.dat
Size 280B
SHA256 6ca91ef54e61dfcb246ff1ce0bab881af7679cb93abd89d0e5c9998acaa00dce
MD5 d8c24661185050cd401094a206f0fc88
SHA1 f3adfc455fe141b168c5f1e7d43758859b85c7a2
SHA512 4e8c1cc71e554e980d721867818a51707bb7accb0bff9b3cf61e7bb1e839228dae317e8782b01ca3d153edb2e350e111b22ee7ce84a2e47c5d1880e87aec910e
TLSH
T190D0223033803232CC83283288802B233300C0080038308080A0A03A0C20F0C0082A80
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho\Local State
Size 3KB
SHA256 b36d5d0a628403871937adeb936173c87c1adad57480411a55621b4b6b22bb93
MD5 d2c488fc2b8341ca4ae49bad217fa101
SHA1 e776a6f98f4a2e86292a89ad137b8948036c6a7a
SHA512 3d8567cb88784126bf7987b2f802d02835bba9e1c532f302a70453e4dea951aa1f2849b1a2ff993e300423ee5e34250856f9b338a5b70a1fc88255047995749b
TLSH
T13681837268347CB7ABF25F45B94676139FB8B16BE5A13AA4EAC8071C00DB65C2305836
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho\Local State
Size 4KB
SHA256 ba319e96422badf114c33c34447081396e5d7062a78a626e84a23f08df9748d2
MD5 71ca5708c0706b404d6f7dd9f6ed8aff
SHA1 fd1ac618562994ad89e47247f67c6ef4985f2623
SHA512 9fa0206f82c5159d5aa77f7d64a0b6dd93cf7d95abf1abdd377094c28c5eea6e052eb3e9adba5fe0981c2cc40c28e271ea155f6a257ebea13b23b4e91c72e3a9
SSDEEP 96:MSqGNkZQsFfrjTM/o58Frh/cInURoDotovwp/D9B+/vDLPI/P0eUnwCB6q4a:MpGNRWjTMbooDUw6jGPI/PqBB3
TLSH
T13FA185766874BC7B9FF29E45B9863703AFA4713BE5903B98DAD80A1C00DB69C1305C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe583c58.TMP

Path C:\Users\Admin\AppData\Local\Temp\l1ucp50s.pho\Local State~RFe583c58.TMP
Size 1KB
SHA256 60bb18619f60006aaa645c60a281a9a697b5e586be13f2d14b91b41b6cc45592
MD5 6441961d97a8c721f0bef101c28b8542
SHA1 338f75c6e2c4bdddd5e161dfe5896d970cb412c0
SHA512 c01ca3a2d2b1185dac9356f7f7715aad3fb83504a712721dfc992e8dc8b27d37226663077e8f178c10038c63e6d60fb704ebf1e741a5934882a5d4b969099f21
TLSH
T1023195B17CA83C7BBC914A4A738677A32F34B172E191369C41DC060C11E769C6215C3B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Crashpad\settings.dat
Size 40B
SHA256 b33227aa60bd70c5dc51f136401790320e233b0d8b6841536df107d6847f5f01
MD5 2362d8e4d1e09cbd52a5ce209acdd209
SHA1 1a6ab56944eb2ea9087909f96a92f43541074f02
SHA512 3e233ec7aac634d488fc10c115df07bf7e03b7d0e6d22e57a50a31bc87bd3f8df3b50230787b62005f61c640ffc745bfb23681153b92f1bc3ced098cd43d840a
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 721776ebbb5d2d187dcb6e52d3334422d59ac445104a96b1e8c0a9e901773974
MD5 ae418bd2f7a7480be0cae8d51e6f3ec0
SHA1 7ff44a40e5b182ffeee53f61c39660a00594ea3f
SHA512 bdbfb1367a96e6e2d208d733e83f2ad6b5278012a6c9c7212c50046758b6167073438455b449d9de3b952511ae81ea0570e6928bd244e00780cd5412a54ed548
SSDEEP 3:MsFlTlrllkl2p46MtvikellrRKBtv1MU/cl:/F02p46Mliket8//U
TLSH
T1AA13926F98998803C5D400B5504653A03230862085A65B0F602B20229F433C2081A200
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 d2731040da06f9bbb38697156cdbecb5f949f510bf5bba2109d48c81229ea660
MD5 91c315bcca3410e8b717363c61128a96
SHA1 e7e5122c5903a48c1db4a9829045e66c8f8760db
SHA512 4fb95c51f02d17026d8787258a7e19aa11a0a63639d82f62187e89051ac792bbd56b8b1d2c9d01175103bc8f0cd693595c34a6b6c1a04953c579ec55fd0069a1
SSDEEP 12:U/9/If4jpqp9ik+XAhCk3yhZi90IR2jB/8Gfez0y+:G7Fw1R4B0Gfe5+
TLSH
T1FA4497FF6954CACBC22983F508B32B24F922C2842CDA8E8EB0391A740ED0A455C67780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\Cache\Cache_Data\index
Size 256KB
SHA256 f53a29ab0fbe15064142b311b09a4346aed41a5c083caee27e3b86a98ffaf8a2
MD5 be7e0ecde800c1e17fdf5fad51951e63
SHA1 c3ce95fecbb8cdef6228dba40f6c9aad57a285b9
SHA512 4bd49a3f41d2f24892843200f33a9012746640f1b02a5f39f59e3df0fafc8fab8d771e95b2b69383774fd9421908e307b71a07039d5cc0d3aaa6182fbe94bd19
SSDEEP 3:LsOlElNllklkXlvxkllflUltnvlXlGNtl:LsKM3lPvvMN
TLSH
T10644022A03814C06C581077C448283293334C140874F8347030941306E917910E0E040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 216e909627df97cec148ebce65f9608733dcbc7c6132fefa1cf4affcae525eb8
MD5 905e823c88dd60615842a90b67b2abff
SHA1 082d0911895c35bbb30055cf19d0631b3b73af30
SHA512 f0a68ad0f897797ca83ac0d9821ca496c2f7e5c5fcfd84ef5600071beb2efd195aa1185d809d4aef3b59ec662345a58183eb6d6c841d67e18d7f4f6da2639b89
TLSH
T135E02B91834D1F1DD32D9AF7CDE603484A0B42C42ABE7A43B880C2C533124642248522
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7cbe3a25ec9eb0a28bb877fd76afb7c96b2633ba0c6753a167b0346462456c20
MD5 fe0d8b4f426fbc3192df8b741993eb27
SHA1 b0a5fcd32023fd40ea877b193fbf2eb802b963ce
SHA512 a86ec2f55f4610b83ab6ee3ba6c69dc8c470b9af51b48a876774ff104ee056645082d4cf3a126ef8e23ab16e20e7871c2771a3354d835e349a87ea6407e307bc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 288920a01a9493acb91608e73f9f56b43a987323be0474effdf63036580b3698
MD5 68d34ddcbcce7b671a5a362e205c7142
SHA1 f5e901add7e64de6f5b725ce951388388bf05102
SHA512 3362853f0840c0f282ab777a65df3dce577d4f8463edb474125c8be09354a456e27504985436ed077f0fe76d1e7cceed4cf41cedf829f7c559b81ea1ccf025ed
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\DawnGraphiteCache\index
Size 256KB
SHA256 2868b7d1a50829c84f8eaf2882700edae1ef7fe7d1c9d9fd6cc6897220c99a5b
MD5 33bcec09c094351950bb21f34a062f5d
SHA1 1651faa0b817e3cbdea53d6732e3c6fc8df414eb
SHA512 28a6493169b23223a84446248c9b3403370efef1a571b13db2a34128f1e0ae82d654d7b1334fc401bc951b958b29b0c639ec9d62078ac3a6907b6172cae1dc9a
SSDEEP 3:LstlNllklkXlD//:LsX3lPDX
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\DawnWebGPUCache\index
Size 256KB
SHA256 b5841509627b8bf57d48b269e1da73f4e2bc0afd3adf261933876ae5d345fbf4
MD5 4b0a5cb8a0f13fb51dccef6c6a86dc1c
SHA1 3f146cbbcb1ba29f35a23b40caddc40fdf751a9c
SHA512 f26d3d9e9fa6db70f4b3f1e66b2be82cc4b9c404e550fc9d71cfead7ef74906cc2160f1054936fd37324aca71ff86dea8aa033273131c338876b4e039a6bad4f
SSDEEP 3:LstlNllklkXlusu/:LsX3lPuB
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\GPUCache\index
Size 256KB
SHA256 556af4824b1c3b10d6a0439ad98ccd604389b0aaae0879021a30d579cd6cd432
MD5 8252cd3870f2d2dc920879dad0b93125
SHA1 add602d502c543f66188c45081cb711a715ea06d
SHA512 18e72a828e47c1f120928347639b32d58e73735c11bc040ba86c514399503e69f18409b3c9f7de4252d719e9d9f13855d71b660042f1c63020d5ef34ceda9929
SSDEEP 3:LstlNllklkXlyrt/:LsX3lPyB
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\Preferences
Size 3KB
SHA256 393b18786d77793345610c3244bab532acac3a2ef71d3f3d0330b586088b2039
MD5 de2be9be01e686164f206d1973f40628
SHA1 df8ad5abb446ef325b37d20e485b751b6f208926
SHA512 b6aad45e74fc699f6305013649f226da530ac7f4f80e3db5df8b07722770464855cebb6ec7ce3e6f346110070fa50a220e1151e56a7485d296f11bb379afa139
TLSH
T1CE611068C9A81DA31DF676A9B47E1342FEE1036F015068167A7D45CC4FB2A379480FBE
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a27aa0221482ae0e74c84c70320ceed8eefa619bfbb691b752d0ca0df7312ed6
MD5 3d590de6e6911d7f5394d35b9528232a
SHA1 bdb1917351c95de782d3182a90e5d75b0e3e85d0
SHA512 86665a6d5ef275ccc07dec134e778ca5a383f3a2c0e914c426f01149312fa515a13fae0b23e73f7043aac015b5d1503cd2bddab9e34e47052dee37cf3e4e9bdf
TLSH
T145A002154241C119C15007B0385583882650B9359140132FBADD034B8E70060892668C
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 91d864d96cb723a1869c03100d5d57fc2fe10d0a296bd13c4936fc3d820e7d24
MD5 89987083c1ec4738d96674cfdc77b027
SHA1 cd8d1162512c52b4656fc22de330720977ba9081
SHA512 ff2d80000580a16bf9da7c24b51f3bae12648afd8aacb3ffa68fbba3f1acfa6d5ff3b668a4fe7d82a75ed0589ada86fda9024a7ab9087d55b63190776c9ad258
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\GrShaderCache\index
Size 256KB
SHA256 525316b5a9ee6c529987e81ec35ae707a78a490fab2ba4f7253f290459222b8a
MD5 7676140da6dcc331a9fe159afb67605a
SHA1 88ed084e32cb1db9d383ab70dd8887ba67901c03
SHA512 7bc452e16cd156fcf44dde9821a8a3742a7d5c3124b71b23e34cf5c6963fd290400ff53cd1a40d581ee483d02431d2c756b8de328b03615a3d6aed8974eb29fd
SSDEEP 3:LstlNllklkXlcxu/:LsX3lPr
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\GraphiteDawnCache\index
Size 256KB
SHA256 be53102eed7e2080cf7159705ced0abce313e5fe1dad53aa8d4c84511a552cda
MD5 cabc2e4ea3b07224040e623639c80a1e
SHA1 eb84cc5498ef4ab676a8ae3fcec822a8e527005d
SHA512 a5e47b71a31e9af192cd2fd5d85f3d74513ec08745f8a13ee7433fd7e87e1f3956f7b20b566a0a28e79bf14732713310378233347ce1b1d8baaf93a30feddb0c
SSDEEP 3:LstlNllklkXli+//:LsX3lPLX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\Local State
Size 1KB
SHA256 a2f9fc471b21fec11c6cd7b2f1e36f8e64c84e6e1a020ec2738fd2231faececa
MD5 39d55a68942de60987f5db68608ab06c
SHA1 25e07f9572281c63c258e0209dbd5350b55ec8c8
SHA512 7941f5d2206ef392e4336e9025aa7185c56eb45fbd8d8d224685139c440cdc20a8060433ae7c7be1d6370a16f346dcf23f467b5db36cfd79434f8bb4c6629ec2
TLSH
T1331179F174E832617DB88A4AB201C7EB4DB5A367C4E15D1C1BCD050016F66FC141CD34
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\xq1qsydm.pef\ShaderCache\index
Size 256KB
SHA256 bcc3ed4016e2f7efb6d7c62337f87fdbeb419df7e4535580190992e990c6a72f
MD5 fa99ee7d5cbe29dfc6e57a768fd2258f
SHA1 194913ca374b8525517132cfdca60cc00c66ceef
SHA512 2e8631ab736dbd5063c35b7dc38114cce803624bf7e93ac3b163efa350ce5344d6f6b671666687319e99daea2f71bc258988428ecffce1ea632c8f282f28cd28
SSDEEP 3:LstlNllklkXlyk/:LsX3lPyE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2220-350-0x000001A76FE60000-0x000001A76FE82000-memory.dmp

Download

memory/2488-431-0x000002945B040000-0x000002945B04A000-memory.dmp

Download

memory/3464-17-0x000001C11FFC0000-0x000001C11FFDE000-memory.dmp

Download

memory/3464-15-0x000001C11FF50000-0x000001C11FF60000-memory.dmp

Download

memory/3928-13-0x00000230AAB90000-0x00000230AABA0000-memory.dmp

Download

memory/3928-4-0x00000230921E0000-0x0000023092256000-memory.dmp

Download

memory/3928-9-0x00000230ACCA0000-0x00000230ACEE2000-memory.dmp

Download

memory/3928-10-0x00000230AAB90000-0x00000230AABA0000-memory.dmp

Download

memory/3928-7-0x00000230ABFF0000-0x00000230AC232000-memory.dmp

Download

memory/3928-6-0x00000230AC520000-0x00000230ACA48000-memory.dmp

Download

memory/3928-5-0x00000230AAB90000-0x00000230AABA0000-memory.dmp

Download

memory/3928-20-0x00000230AACD0000-0x00000230AAD20000-memory.dmp

Download

memory/3928-14-0x00000230AABF0000-0x00000230AAC02000-memory.dmp

Download

memory/3928-8-0x00000230AAB90000-0x00000230AABA0000-memory.dmp

Download

memory/3928-0-0x00000230904E0000-0x00000230905EE000-memory.dmp

Download

memory/3928-3-0x00000230AAD70000-0x00000230AAF32000-memory.dmp

Download

memory/3928-11-0x00000230AAB90000-0x00000230AABA0000-memory.dmp

Download

memory/3928-22-0x00000230AAB90000-0x00000230AABA0000-memory.dmp

Download

memory/3928-2-0x0000023090970000-0x0000023090971000-memory.dmp

Download

memory/3928-358-0x00000230AAB90000-0x00000230AABA0000-memory.dmp

Download

memory/3928-21-0x00000230AAB90000-0x00000230AABA0000-memory.dmp

Download

memory/3928-413-0x00000230AAB90000-0x00000230AABA0000-memory.dmp

Download

memory/3928-414-0x00000230AAB90000-0x00000230AABA0000-memory.dmp

Download

memory/3928-1-0x00000230AAB90000-0x00000230AABA0000-memory.dmp

Download

memory/5328-16-0x000001B2EB1E0000-0x000001B2EB1F0000-memory.dmp

Download