Overview

overview

8

Static

static

3

GitRelose ....1.exe

windows10-ltsc_2021-x64

8

GitRelose ....1.exe

windows11-21h2-x64

8

GitRelose ....1.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    98s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/07/2026, 15:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    GitRelose Setup 1.2.1.exe
  • Size 83.7MB
  • Sample260722-syetsacj81
  • SHA256 709faca3fb587719c8d185478ddbb4c4083d4218c6b79a7ff9ea749c106e6014
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 21 IoCs

    Using powershell.exe command.

    execution
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 13 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GitRelose Setup 1.2.1.exe
    "C:\Users\Admin\AppData\Local\Temp\GitRelose Setup 1.2.1.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq GitRelose.exe" /FO csv | "C:\Windows\system32\find.exe" "GitRelose.exe"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1852
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq GitRelose.exe" /FO csv
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:980
      • C:\Windows\SysWOW64\find.exe
        "C:\Windows\system32\find.exe" "GitRelose.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4460
  • C:\Users\Admin\AppData\Local\Programs\GitRelose\GitRelose.exe
    "C:\Users\Admin\AppData\Local\Programs\GitRelose\GitRelose.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5904
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Windows\system32\chcp.com
        chcp
        3⤵
          PID:3408
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "WHERE smartctl 2>nul"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5900
        • C:\Windows\system32\where.exe
          WHERE smartctl
          3⤵
            PID:5124
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
          2⤵
          • Executes a command shell one-liner
          PID:6116
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_ComputerSystemProduct | select Name,Vendor,Version,IdentifyingNumber,UUID | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:6064
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_DiskDrive | select Caption,Size,Status,PNPDeviceId,DeviceId,BytesPerSector,TotalCylinders,TotalHeads,TotalSectors,TotalTracks,TracksPerCylinder,SectorsPerTrack,FirmwareRevision,SerialNumber,InterfaceType | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4584
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-PhysicalDisk | select BusType,MediaType,FriendlyName,Model,SerialNumber,Size | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4604
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:764
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_baseboard | select Model,Manufacturer,Product,Version,SerialNumber,PartNumber,SKU | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4628
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_physicalmemoryarray | select MaxCapacityEx, MemoryDevices | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3068
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_bios | select Description,Version,Manufacturer,@{n=\"ReleaseDate\";e={$_.ReleaseDate.ToString(\"yyyy-MM-dd\")}},BuildNumber,SerialNumber,SMBIOSBIOSVersion | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1340
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_ComputerSystemProduct | select UUID | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3728
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance win32_VideoController | fl *"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3772
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4432
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance win32_desktopmonitor | fl *"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1864
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1296
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3452
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3588
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4572
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2772
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; (Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3160
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1252
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; reg query \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\" /v DisplayVersion"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2428
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion
            3⤵
              PID:1692
          • C:\Users\Admin\AppData\Local\Programs\GitRelose\GitRelose.exe
            "C:\Users\Admin\AppData\Local\Programs\GitRelose\GitRelose.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\GitRelose" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2404,i,5612861527375473409,568192957896887298,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3756
          • C:\Users\Admin\AppData\Local\Programs\GitRelose\GitRelose.exe
            "C:\Users\Admin\AppData\Local\Programs\GitRelose\GitRelose.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\GitRelose" --field-trial-handle=2404,i,5612861527375473409,568192957896887298,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:11
            2⤵
            • Executes dropped EXE
            PID:3680
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5680
            • C:\Windows\System32\reg.exe
              C:\Windows\System32\reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
              3⤵
                PID:1548
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance MS_Systeminformation -Namespace \"root/wmi\" | select systemsku | fl "
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5388
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:3916
              • C:\Windows\system32\findstr.exe
                findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
                3⤵
                  PID:5736
              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "$OutputEncoding = [System.Console]::OutputEncoding = [System.Console]::InputEncoding = [System.Text.Encoding]::UTF8 ; Get-CimInstance Win32_bios | select Version, SerialNumber, SMBIOSBIOSVersion"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:1804

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  powershell.exe.log
                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                  • Size 3KB
                  • SHA256 18d5722b4bdd546da121b4c8756096755cab8cb7c40126d93644910d9292f343
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 527583dacd97ac0330fcd30a301b422dc2b9894b292a38188ade6c96df764667
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 b065f20df1e7636079345fdcbad128fb0491ca3301f7fe34f0d2caa84e08cca2
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 6c4a24d763a4b654e4bd73ca3f4b388dcdbfa44225d265938d07ffdd01f9506a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  chrome_100_percent.pak
                  • Path C:\Users\Admin\AppData\Local\Programs\GitRelose\chrome_100_percent.pak
                  • Size 144KB
                  • SHA256 6ce0ccf6a0cc4ea8be11262d168a344bc3ee78a4a6365d755ffb5570bc48d6d5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_ezs5xefq.yov.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ezs5xefq.yov.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  LICENSE.electron.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\LICENSE.electron.txt
                  • Size 1KB
                  • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  LICENSES.chromium.html
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\LICENSES.chromium.html
                  • Size 11.7MB
                  • SHA256 5d67aba37acc9e0e0a88546d940ed23f29ea3441aac7dd06dcc08a1b1c93b0a9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_200_percent.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\chrome_200_percent.pak
                  • Size 215KB
                  • SHA256 68e92cde2557d68eddcf8df21ce4d1ef7a85581fb28cd5ab93db20812217e073
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  d3dcompiler_47.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\d3dcompiler_47.dll
                  • Size 4.7MB
                  • SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ffmpeg.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\ffmpeg.dll
                  • Size 2.9MB
                  • SHA256 99fbd8bd11696e24479d22e29b490c7e96c7d9875ab4392ff12307ddfb5a9503
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icudtl.dat
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\icudtl.dat
                  • Size 10.0MB
                  • SHA256 a9f6072e858ea29cb66501847856d403c862f23d03cac2656d1e0fa2865fdc7b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libEGL.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\libEGL.dll
                  • Size 481KB
                  • SHA256 e55fb10fb929b28446583ebc5afa89fc647bafc2eebf3b12e6a0adf91a7bb202
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libGLESv2.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\libGLESv2.dll
                  • Size 7.6MB
                  • SHA256 2289eb00380b7f143d81df224d5bb412dec9b5eb6002b5213518e295ae8256b2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  en-US.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\locales\en-US.pak
                  • Size 492KB
                  • SHA256 cc7d18d3a6606b645ede826de9417c961d6ebb815f7250bad3a930da89dcd3a3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  resources.pak
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources.pak
                  • Size 5.7MB
                  • SHA256 4d22a8976b3e6d5bca66d59cc24f1d2db6df2163f12f9624bc07c5846adfbab6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  etmdDVZn26HDXuc9.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\Screenshot\etmdDVZn26HDXuc9.bin
                  • Size 60B
                  • SHA256 f14173c8ed84dbcac6db215602c28214629654593d41e1a4bd19d0d1d11776ca
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  etmdDVZn26HDXuc9.enc
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\Screenshot\etmdDVZn26HDXuc9.enc
                  • Size 3.7MB
                  • SHA256 f64c960db02fec40ebb14e9116fd01c2fe3785fe5450b404bf5d46c343176986
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  byto.enc
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\Shortcut\byto.enc
                  • Size 564KB
                  • SHA256 175c4652f00b9ef6893524646da2edef9e4a78e432fc606b80a0f21e61492eb0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  svsv.enc
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\Shortcut\svsv.enc
                  • Size 385KB
                  • SHA256 c36746b8e21cc0fe187034070fadf6c5bc8fec3dbdc654a62892fb3b1ccfd193
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  app.asar
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar
                  • Size 17.0MB
                  • SHA256 515af0a264ac4285b322bd30c316f6b290e25fefcc839620992d702d2f7e4653
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  dpapi.node
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\bin\win32-x64-133\dpapi.node
                  • Size 126KB
                  • SHA256 a0c16a0eb9e48d376480c63aed0ccb5dbd7d909dc2e6e2b182cee7a60e653dc1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  index.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\dist\index.js
                  • Size 1KB
                  • SHA256 3043aeba077d86d8b2e7fbbd6e1ecc3438c65ab184a2bda9fa0179976c5b0170
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  package.json
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\package.json
                  • Size 936B
                  • SHA256 be14494278f32ab162d3b3cf8f5d0bdbcf02c4bd8785428119a2e225e1cd482f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  @primno+dpapi.node
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-arm64\@primno+dpapi.node
                  • Size 122KB
                  • SHA256 6a5cc9c5b3e390fe08fea0de3a22248d5836cea0b26aa6a80d9447c45ec04b12
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  @primno+dpapi.node
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
                  • Size 134KB
                  • SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  better_sqlite3.node
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node
                  • Size 1.8MB
                  • SHA256 901381b3f1fd78cf8858bcc14fb60a55242a9832da937e8effcafe6b889a3532
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  copy.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\copy.js
                  • Size 897B
                  • SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  database.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\database.js
                  • Size 4KB
                  • SHA256 02ea23bdd23d7ac5de0675a2f32fc686e76d5c6a32bd3e3891f360e72e07f61f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  index.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\index.js
                  • Size 110B
                  • SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  aggregate.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\aggregate.js
                  • Size 1KB
                  • SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  backup.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\backup.js
                  • Size 2KB
                  • SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  function.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\function.js
                  • Size 1KB
                  • SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  inspect.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\inspect.js
                  • Size 174B
                  • SHA256 4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  pragma.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\pragma.js
                  • Size 536B
                  • SHA256 8b1c54475bd4340b15e25c50d53d06308be65f8f919ecbe4aa9d285ca859ad5a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  serialize.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\serialize.js
                  • Size 625B
                  • SHA256 7a10ee5c2735384b7f0c361811bc6d017db29f62b203fd3c68a35f667e2c2605
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  table.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\table.js
                  • Size 6KB
                  • SHA256 97c42d9ded1aa96c7d916b5b92f96b4e59581d50eaf629cd2c7afb78ff26a9ea
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  transaction.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\transaction.js
                  • Size 2KB
                  • SHA256 bc8624a3ef689d8f78e5669020ad121e17acbc93b1d5ee5afe26860b1084c66c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  wrappers.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\methods\wrappers.js
                  • Size 1KB
                  • SHA256 a150a6271d23f4e5f8953b129f370ff096c7cdc4b812afbf080a6cf4ab741bcf
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  sqlite-error.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\sqlite-error.js
                  • Size 717B
                  • SHA256 2582d61c27680dead168543f392eb102be621dfbef282a4ca4c7c21aa5e7c75d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  util.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\lib\util.js
                  • Size 331B
                  • SHA256 92b2e39e2151b43a2252e10b6d6de876ecaf0008336a4fa1dfe1317b20f1916f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  package.json
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\package.json
                  • Size 936B
                  • SHA256 8c3051989ac570e45f1bcef4cfa2859d380a43cfd48d26ee3b8ec18b79160b02
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  .prettierignore
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\registry-js\.prettierignore
                  • Size 102B
                  • SHA256 12fa21eee0c543b12b40854c69351b4380cb40c787086a7fd84ab2fe57ee732f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  registry.node
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\registry-js\build\Release\registry.node
                  • Size 680KB
                  • SHA256 c46fa65cb72a22c4ed846df91c4ca733c5ab7b6bfff711eb2510dba15b1e3033
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  index.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\registry-js\dist\lib\index.js
                  • Size 658B
                  • SHA256 f8a6cc69584e07a08a4e72ba1c89bfe791af854a62d2085f230a95a6e2ed8da4
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  registry.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\registry-js\dist\lib\registry.js
                  • Size 5KB
                  • SHA256 41589ec896a2d3b80311fc2325e1385f9d91dd15d0bf384c85dda403ac3e7871
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  package.json
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\registry-js\package.json
                  • Size 946B
                  • SHA256 53b66cfa9694e7c62e40a59683000ed73b5ed8db4598c8a9ca7dbfce25dc26c0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  robotjs.node
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\robotjs\bin\win32-x64-133\robotjs.node
                  • Size 176KB
                  • SHA256 c34a3fecb56d781a3a681452419c4310aa59ef31359abddd1c0e0d95b591af38
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  index.js
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\robotjs\index.js
                  • Size 937B
                  • SHA256 8bf3e9c7d85cfd50e58068b6f0cfc7a154d82deae8e53052f2eb7015f41dd0ff
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  package.json
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\app.asar.unpacked\node_modules\robotjs\package.json
                  • Size 610B
                  • SHA256 388dd9c273e7c6c787563ffc71e9f878d31edc63317abd6ac41aa4e4593ae222
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  elevate.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\resources\elevate.exe
                  • Size 105KB
                  • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  snapshot_blob.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\snapshot_blob.bin
                  • Size 324KB
                  • SHA256 69d9b2ecbc649fed6c41ca18e94f3a36b6770ff7038e9a0d07ae1ab824d9f7fb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  v8_context_snapshot.bin
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\v8_context_snapshot.bin
                  • Size 685KB
                  • SHA256 462919f1b49c9e913042f9e9a738e9510884d5920a426a8a5f1b188e28c4da91
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\vk_swiftshader.dll
                  • Size 5.3MB
                  • SHA256 bdf28efb95d1618e211aafafd2060df77ad53b98af8db685379f88aa852c0e00
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader_icd.json
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\vk_swiftshader_icd.json
                  • Size 106B
                  • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  vulkan-1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\7z-out\vulkan-1.dll
                  • Size 882KB
                  • SHA256 2f0ae7c191a962a49abe65c8c5c056262de5e2108e1f341b105844034153915f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SpiderBanner.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\SpiderBanner.dll
                  • Size 9KB
                  • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  StdUtils.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\StdUtils.dll
                  • Size 100KB
                  • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  System.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\System.dll
                  • Size 12KB
                  • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nsExec.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\nsExec.dll
                  • Size 6KB
                  • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nsis7z.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\nsc7E63.tmp\nsis7z.dll
                  • Size 424KB
                  • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/1296-528-0x0000019F293E0000-0x0000019F29402000-memory.dmp
                  Download

                  memory/3772-643-0x0000013147040000-0x000001314705C000-memory.dmp
                  Download

                  memory/3772-646-0x0000013147090000-0x00000131470BA000-memory.dmp
                  Download

                  memory/3772-647-0x0000013147090000-0x00000131470B4000-memory.dmp
                  Download

                  memory/3772-645-0x0000013147030000-0x000001314703A000-memory.dmp
                  Download

                  memory/3772-644-0x00000131472E0000-0x0000013147393000-memory.dmp
                  Download

                  memory/4604-735-0x00000217AC9F0000-0x00000217ACA0C000-memory.dmp
                  Download

                  memory/4604-753-0x00000217AC9D0000-0x00000217AC9DA000-memory.dmp
                  Download

                  memory/4604-754-0x00000217AC9E0000-0x00000217AC9EA000-memory.dmp
                  Download