donutloader | 3e1fb4cc6c8ce65e6ac79793cb7d482e6c18ba46dce36b0c51a259b511528d30

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payl.exe
Size 1.0MB
Sample260809-ah8g2swhrf
SHA256 3e1fb4cc6c8ce65e6ac79793cb7d482e6c18ba46dce36b0c51a259b511528d30
MD5 dea25a6b76f660ff1d464c88ce57e453
SHA1 e114092df6873c703be1a785646b171948d37980
SHA512 f5cb10060b1cbce9a460861c6b959926c0c7affd132d8a3c361118e0f17a08a719b20e8fd8a27d8c583d2091734fcdc33a0e2e84617c165445f8659a07b579a7
SSDEEP 24576:eOlOX6eCdBvm0+myIesqfFSZhGGtEoeJhkhfIkdb5:eOlC8H3Bf
TLSH
T13435CF163BF5EE01E2AA33B940A045D443F5E4199E86DF0A22D43AF36ADFF91DB06057
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader persistence privilege_escalation spyware stealer

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/2440-20-0x00000286B60B0000-0x00000286B62F2000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3520	powershell.exe
3960	powershell.exe
704	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Repair.lnk	payl.exe

Executes dropped EXE 2 IoCs

pid	Process
1280	CoreWorker_eISNxgiOXwxybMx.exe
2988	CoreWorker_eISNxgiOXwxybMx.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_eISNxgiOXwxybMx = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_eISNxgiOXwxybMx.exe"	payl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_eISNxgiOXwxybMx = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_eISNxgiOXwxybMx.exe"	CoreWorker_eISNxgiOXwxybMx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoreWorker_eISNxgiOXwxybMx = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_eISNxgiOXwxybMx.exe"	CoreWorker_eISNxgiOXwxybMx.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
8	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3584	cmd.exe
2796	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3788	chrome.exe
5260	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	payl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	payl.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe
2440	payl.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4904	chrome.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	payl.exe
Token: SeDebugPrivilege	2440	payl.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeIncreaseQuotaPrivilege	3520	powershell.exe
Token: SeSecurityPrivilege	3520	powershell.exe
Token: SeTakeOwnershipPrivilege	3520	powershell.exe
Token: SeLoadDriverPrivilege	3520	powershell.exe
Token: SeSystemProfilePrivilege	3520	powershell.exe
Token: SeSystemtimePrivilege	3520	powershell.exe
Token: SeProfSingleProcessPrivilege	3520	powershell.exe
Token: SeIncBasePriorityPrivilege	3520	powershell.exe
Token: SeCreatePagefilePrivilege	3520	powershell.exe
Token: SeBackupPrivilege	3520	powershell.exe
Token: SeRestorePrivilege	3520	powershell.exe
Token: SeShutdownPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeSystemEnvironmentPrivilege	3520	powershell.exe
Token: SeRemoteShutdownPrivilege	3520	powershell.exe
Token: SeUndockPrivilege	3520	powershell.exe
Token: SeManageVolumePrivilege	3520	powershell.exe
Token: 33	3520	powershell.exe
Token: 34	3520	powershell.exe
Token: 35	3520	powershell.exe
Token: 36	3520	powershell.exe
Token: SeDebugPrivilege	1280	CoreWorker_eISNxgiOXwxybMx.exe
Token: SeDebugPrivilege	1280	CoreWorker_eISNxgiOXwxybMx.exe
Token: SeDebugPrivilege	704	powershell.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeIncreaseQuotaPrivilege	3960	powershell.exe
Token: SeSecurityPrivilege	3960	powershell.exe
Token: SeTakeOwnershipPrivilege	3960	powershell.exe
Token: SeLoadDriverPrivilege	3960	powershell.exe
Token: SeSystemProfilePrivilege	3960	powershell.exe
Token: SeSystemtimePrivilege	3960	powershell.exe
Token: SeProfSingleProcessPrivilege	3960	powershell.exe
Token: SeIncBasePriorityPrivilege	3960	powershell.exe
Token: SeCreatePagefilePrivilege	3960	powershell.exe
Token: SeBackupPrivilege	3960	powershell.exe
Token: SeRestorePrivilege	3960	powershell.exe
Token: SeShutdownPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeSystemEnvironmentPrivilege	3960	powershell.exe
Token: SeRemoteShutdownPrivilege	3960	powershell.exe
Token: SeUndockPrivilege	3960	powershell.exe
Token: SeManageVolumePrivilege	3960	powershell.exe
Token: 33	3960	powershell.exe
Token: 34	3960	powershell.exe
Token: 35	3960	powershell.exe
Token: 36	3960	powershell.exe
Token: SeIncreaseQuotaPrivilege	704	powershell.exe
Token: SeSecurityPrivilege	704	powershell.exe
Token: SeTakeOwnershipPrivilege	704	powershell.exe
Token: SeLoadDriverPrivilege	704	powershell.exe
Token: SeSystemProfilePrivilege	704	powershell.exe
Token: SeSystemtimePrivilege	704	powershell.exe
Token: SeProfSingleProcessPrivilege	704	powershell.exe
Token: SeIncBasePriorityPrivilege	704	powershell.exe
Token: SeCreatePagefilePrivilege	704	powershell.exe
Token: SeBackupPrivilege	704	powershell.exe
Token: SeRestorePrivilege	704	powershell.exe
Token: SeShutdownPrivilege	704	powershell.exe
Token: SeDebugPrivilege	704	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4904	chrome.exe
4904	chrome.exe
4900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1524	2440	payl.exe	90
PID 2440 wrote to memory of 1524	2440	payl.exe	90
PID 2440 wrote to memory of 5992	2440	payl.exe	91
PID 2440 wrote to memory of 5992	2440	payl.exe	91
PID 2440 wrote to memory of 4812	2440	payl.exe	128
PID 2440 wrote to memory of 4812	2440	payl.exe	128
PID 2440 wrote to memory of 3904	2440	payl.exe	95
PID 2440 wrote to memory of 3904	2440	payl.exe	95
PID 2440 wrote to memory of 4904	2440	payl.exe	97
PID 4904 wrote to memory of 2464	4904	chrome.exe	98
PID 4904 wrote to memory of 4140	4904	chrome.exe	99
PID 4904 wrote to memory of 3788	4904	chrome.exe	100
PID 4904 wrote to memory of 4140	4904	chrome.exe	99
PID 4904 wrote to memory of 2868	4904	chrome.exe	101
PID 4904 wrote to memory of 2868	4904	chrome.exe	101
PID 4904 wrote to memory of 5484	4904	chrome.exe	102
PID 4904 wrote to memory of 5484	4904	chrome.exe	102
PID 4904 wrote to memory of 5976	4904	chrome.exe	103
PID 4904 wrote to memory of 5976	4904	chrome.exe	103
PID 4904 wrote to memory of 4232	4904	chrome.exe	104
PID 4904 wrote to memory of 4232	4904	chrome.exe	104
PID 4904 wrote to memory of 2012	4904	chrome.exe	105
PID 4904 wrote to memory of 2012	4904	chrome.exe	105
PID 4904 wrote to memory of 4912	4904	chrome.exe	106
PID 4904 wrote to memory of 4912	4904	chrome.exe	106
PID 4904 wrote to memory of 2356	4904	chrome.exe	107
PID 4904 wrote to memory of 2356	4904	chrome.exe	107
PID 2440 wrote to memory of 4900	2440	payl.exe	109
PID 4900 wrote to memory of 5580	4900	msedge.exe	110
PID 4900 wrote to memory of 4188	4900	msedge.exe	111
PID 4900 wrote to memory of 5260	4900	msedge.exe	112
PID 4900 wrote to memory of 4188	4900	msedge.exe	111
PID 4900 wrote to memory of 4188	4900	msedge.exe	111
PID 4900 wrote to memory of 984	4900	msedge.exe	113
PID 4900 wrote to memory of 984	4900	msedge.exe	113
PID 4900 wrote to memory of 5584	4900	msedge.exe	114
PID 4900 wrote to memory of 5584	4900	msedge.exe	114
PID 4900 wrote to memory of 5584	4900	msedge.exe	114
PID 4900 wrote to memory of 2704	4900	msedge.exe	115
PID 4900 wrote to memory of 2704	4900	msedge.exe	115
PID 4900 wrote to memory of 2704	4900	msedge.exe	115
PID 4900 wrote to memory of 1964	4900	msedge.exe	116
PID 4900 wrote to memory of 5532	4900	msedge.exe	117
PID 4900 wrote to memory of 5556	4900	msedge.exe	118
PID 4900 wrote to memory of 4272	4900	msedge.exe	119
PID 4900 wrote to memory of 4272	4900	msedge.exe	119
PID 4900 wrote to memory of 4836	4900	msedge.exe	120
PID 4900 wrote to memory of 4272	4900	msedge.exe	119
PID 4900 wrote to memory of 3928	4900	msedge.exe	121
PID 4900 wrote to memory of 4836	4900	msedge.exe	120
PID 4900 wrote to memory of 4836	4900	msedge.exe	120
PID 4900 wrote to memory of 3928	4900	msedge.exe	121
PID 4900 wrote to memory of 3928	4900	msedge.exe	121
PID 4900 wrote to memory of 1396	4900	msedge.exe	122
PID 4900 wrote to memory of 1396	4900	msedge.exe	122
PID 4900 wrote to memory of 1396	4900	msedge.exe	122
PID 4900 wrote to memory of 5640	4900	msedge.exe	123
PID 4900 wrote to memory of 940	4900	msedge.exe	124
PID 4900 wrote to memory of 2524	4900	msedge.exe	125
PID 4900 wrote to memory of 1272	4900	msedge.exe	126
PID 4900 wrote to memory of 3336	4900	msedge.exe	127
PID 4900 wrote to memory of 4812	4900	msedge.exe	128
PID 2440 wrote to memory of 3584	2440	payl.exe	129
PID 3584 wrote to memory of 3520	3584	cmd.exe	131

C:\Users\Admin\AppData\Local\Temp\payl.exe
"C:\Users\Admin\AppData\Local\Temp\payl.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1" --app=http://127.0.0.1:49895
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9d211c728,0x7ff9d211c734,0x7ff9d211c740
    3⤵
    PID:2464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,5669532784219200583,17572547686229812211,262144 --field-trial-handle=2024,i,7889233364615630423,708554777142994670,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
    3⤵
    PID:4140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1912,i,14687469748844350154,5997704360317015988,524288 --field-trial-handle=2024,i,7889233364615630423,708554777142994670,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1" --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,14453979373232979136,1398430906511175921,524288 --field-trial-handle=2024,i,7889233364615630423,708554777142994670,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:13
    3⤵
    PID:2868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,5954531236420897503,515801230569743918,2097152 --field-trial-handle=2024,i,7889233364615630423,708554777142994670,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:5484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,2755424422293693123,9339307460743787028,2097152 --field-trial-handle=2024,i,7889233364615630423,708554777142994670,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:5976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3524,i,286661485103959650,8154662159004329128,2097152 --field-trial-handle=2024,i,7889233364615630423,708554777142994670,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:4232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3628,i,5308838243473650367,16418552918731991455,2097152 --field-trial-handle=2024,i,7889233364615630423,708554777142994670,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:9
    3⤵
    PID:2012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4684,i,16256479822262428044,6840602454287334084,2097152 --field-trial-handle=2024,i,7889233364615630423,708554777142994670,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:9
    3⤵
    PID:4912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1" --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,7503297086269734339,13184138081395992531,524288 --field-trial-handle=2024,i,7889233364615630423,708554777142994670,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
    3⤵
    PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --app=http://127.0.0.1:50077
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7ff9d1f4c188,0x7ff9d1f4c194,0x7ff9d1f4c1a0
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,179947393457893326,3017853919214449142,262144 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,5551142725160470952,262344026831913265,524288 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,13626736465702667187,11557286853846515601,524288 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:13
    3⤵
    PID:984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,5539796214103814233,4190939643156947882,2097152 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,3823645837297054275,5897091324501971622,2097152 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4144,i,4378920648855676490,17503595352878868070,524288 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
    3⤵
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4148,i,10298671974459250950,11342870571521053088,524288 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:14
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4152,i,17813416648851759060,3644472360910504204,524288 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
    3⤵
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4156,i,1287223393335971024,13145682778143761856,2097152 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4276,i,11879636025521726380,16086366978936969606,2097152 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4296,i,2171843773384487307,18376552667213398425,2097152 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4412,i,13104968166160032385,1109620327724011137,2097152 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:9
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4820,i,8238378112843209549,8761334157727575594,2097152 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:9
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4796,i,4092725845293196939,6188138948591577188,2097152 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4832,i,17335203736383481820,16287243825681149577,2097152 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4848,i,7430334012675011939,3348328963314676898,2097152 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:9
    3⤵
    PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4876,i,7732668249042461801,10633940368189831266,2097152 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4888,i,15115631348728246153,6684765861527733446,2097152 --field-trial-handle=2088,i,10149876580506003942,13684057372585330208,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:9
    3⤵
    PID:4812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3520
- C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe
  "C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'CoreWorker_eISNxgiOXwxybMx-4927' -RunLevel Highest "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:704
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
    3⤵
    - Executes a command shell one-liner
    PID:2796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2784

C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe
1⤵
- Executes dropped EXE
PID:2988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CoreWorker_eISNxgiOXwxybMx.exe

Path C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe
Size 13KB
SHA256 ac1b5674bc96f344170df29bc59c38907370786a8495f33d75b20cff7f16a5f7
MD5 8f6f193d29649778778f82c815f0dcf5
SHA1 779e92a644084a2a3135cc410ccb960e9d8a932f
SHA512 1537c104e9377a26f8a347a493e32b0625cc44cd8eecae2c7595c67d8e768ae00b2f990247d6698d474e2af4469dfd30b8a666acd60a56c720cb8fb3d74e1aef
SSDEEP 192:lP4EDne8F9DTHoKiTizMVhmHGjrmbQSaZxGKTOkhEw3zzMRDTQsW7vm:p4EH9D8KiuRGjrmbQSgxLiR0Mx/W7v
TLSH
T1B0520904B7E18125E9BA0B39EEF355005A33F7635936CE5E14CC518B0B27680AEE2F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hluuamvj.il3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hluuamvj.il3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Crashpad\settings.dat
Size 40B
SHA256 6c8e34ce19df849035e4f0a5217a05a587a6473a15e7236de27ffbc0a39b457f
MD5 4795fc1d284986bd0d3e35df7f8a0914
SHA1 d964dbabea1e12b1f539b9701726fc9bbb9542c0
SHA512 f00a96bc108d4d057957ca312f8e5e851615667084db7e591833c6e714c825796c5240e5039fcb41ed864766025c02c2b57e1f10a4f46995c8f3c43b7d91f206
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 1c8f93df4f181e5ce5696c34d5c60db591aca3f86f3cb8e42eccf494dd2dd76d
MD5 8dd64aabddcf83fd4045c7213e2936ab
SHA1 c0eaa3b26eb2c4458612343243de2666f37e51fa
SHA512 e5e80bd756ddb9825f3268da37814c392a7bc2a3d38fb0b85e77e6f34e856b61d63d95c92e070f640821d9ec91bb4400bf0034be1030931739ee3c9bf1d636bb
SSDEEP 3:MsFl9tlGall64Eyl9F+flU5F/A+M7slXl1V+y//x6ll976n/:/F3XGuldl2NU5F/9yEXcG/x6/9W
TLSH
T1BD13922FE9C21E1AC041323C4043C3744FFA9AC0CA260B8759A23822A844342202D06A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 633eba98d1124186db0bba6bedd064437fcd91b6265cd7eec710a684966f8845
MD5 06d51a2d2de1003cb99489fb411d3d8b
SHA1 ef9ae307906f157ac0496e8e4abd45baac718c94
SHA512 1ce518f21454737f1f620cbf29ea964f1eee64d402dbedd954b4333fe1558cd15ae46115cedcad9685df1e695ba847b7a41dd4393d32f012500d94ecf6e8fdb6
SSDEEP 24:X62vy+U0S1R4Bj/ku+kFQkf2lk3z/mizbl:X6sSEBLkAP3zlbl
TLSH
T15444FDEA28888A49C71CC7BC15A35634DA32D1C13CBB9A4DF0A11DB01C74B88687C3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 2be88b7f76b832d7ec33e72821a6148174e6b82ad174f9928f6c2821f1a87bb4
MD5 0644f181cf51f7c16b53411444f80c17
SHA1 9a8e6e7d27e03b8b2a1cfc66f914656754089153
SHA512 6f325d1609fce9de1975af82cda242a2fd4f18bd468e40ea3c0f71f10963437f8424036daf7cb207a0b5fb79ec9ac4488930d79a9ae3b5f99759d84097030ba4
SSDEEP 96:cHTGYUfDPLGRgcRUv+ULtnyjfpE1bNBPlQqRvTqnnWFYEmjvoq:nYUfDPLGRgcRUv+ULR+BENPl7VC+a0
TLSH
T1D1161BB25F247D86D645DB70ABCCEE083CB4229DDCA25C92F022A1694FE1FC50B8416D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\Cache\Cache_Data\index
Size 256KB
SHA256 53c74150ba41890a5a74909cecc4077c1d77a909561f628bd77ec4487c2e5296
MD5 133da86ea6121567d1d2695d8242fd4c
SHA1 60b15c528bad8a3f2eaa6957ff1e5594bc847456
SHA512 0782e2e156aada3c8c0963fc7b12d2454568164dfe0085d151dc4a4b3430c838799f55b86d03413e301ca4ec9774ab3f281bbf6f75f61d2b966020c73cb9006c
SSDEEP 3:LsOlNllklkXlRAt0mltMNtl2lXl9lXl:LsK3lPSvmNm
TLSH
T11C44026A03C14C09C9D1517D441393301338C144C90FD747130455644CC37D50F5D0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 3b2838aa1187033e95d69c2025b3825d162b1817277c832d94805bb308fec2fe
MD5 81ce02ee479739edb8bbaa03af620380
SHA1 164640516fddf3f217359abbafdf17bd6928f4c4
SHA512 67d82869e0330acf7d0ed96d8aeb79467fabd79c61c0854a8b4d0806055a3b5a600115c4ab73fe841e3c920962832de63fd717fb76638d71280f6daf35bb9833
TLSH
T171E02B85874C0F0DD32DA6F7CDA603444A0A53C42ABE3643A880C2C233125241248233
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 27ebd49faf9425c97731cc4546a87ae275c26ebbbff998121b7b37bf8905d332
MD5 867223e51a1a359fb0adb2dd417f1e10
SHA1 87a3c660cb94ac95aed5aa62b742f18b5d120b03
SHA512 396b5c8a8d55e592341306d5b0a70eb5b0e5c62d36c7d4049d506378cc8f609a0f48784de6f44c1e8972b3c4151364c752dd3c79e57024a45484f0b968cd0220
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 76c81af6fc7909062259e27e76a859d6656d92e08f760b9e6763e83bd7432918
MD5 ce7bd7a3720a04a7edd27948fb5ccb38
SHA1 2a927d35a41f69f798f77a6753091126143c08b5
SHA512 3bb4b8db952b3e0dc1459e1f51a0e922a056ed708313bec0877137128f68e5148824a4c5042ee1be6eb4118dd7c112b18a1a124f5a6d83f9a27980ef1108bbbd
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\DawnGraphiteCache\index
Size 256KB
SHA256 46d7843f439909d84e4a8a454be2fe76f74bfb05323ebc3ee39995d96b4192d2
MD5 b4b90707e3e6e282c7ba4e7d796438b1
SHA1 8f209e2733d0c22db95019f8b0524c7af0601edc
SHA512 7700203e759bdc52413978e544a79f5f1e4d7b3024e60c3900f6e17a3dd994a888cc1064b1f29051819c30c292eefefebcaef8d0a8ae354abe094f4dad4f52b5
SSDEEP 3:LstlNllklkXlpt/:LsX3lPD/
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\DawnWebGPUCache\index
Size 256KB
SHA256 9e0f8434c46b64343971eb4cd645ed325b99561123fa241714af64957f71992e
MD5 ef960d2ffcc1943cb85a38b2185e2e2f
SHA1 ed1206a93eed54a83540f9907b45c676198a280b
SHA512 1df5e7fc1454b77c42e4502c8389e2c163866cd3b4493976da8f76efd6326c3ff79a173af7302cd168a2afacb92e0c46e3570817e02e3377e0cf1e4bf5c6106f
SSDEEP 3:LstlNllklkXljcNhl/:LsX3lP+/
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\GPUCache\index
Size 256KB
SHA256 e99f0d7812350ebe394ad32a8ee81bef77010e47109cfcfe106f60d495f05ca4
MD5 53cc911a3a482ffe2447ca49a675c2cc
SHA1 86b7ced8f841946e0a9684fe27fffa25f920aa18
SHA512 d0a6f3fd009379675a47a0a262416eded4a6a969eb5a02a47fba211c48b9da7065b1e24c1ae348681e1187b4e80eed35aef0717d7d9156f68bf3ec83f0da7edc
SSDEEP 3:LstlNllklkXlvCAu/:LsX3lPvCAu/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\Preferences
Size 3KB
SHA256 40a47d066ae589ed7705099781c3ca476562b191acf56a39964e10f1dc470c0f
MD5 4ca6c9b1dc1b2942172d6fa0543969cb
SHA1 490d9229c8a0fe2178372b1cc89f5aa00df26a66
SHA512 37632dad50fb6879824c310b12cb40587ea3c059aab052bd6db0afbc7c418e12484174fb9accec87185a1a5e6989367fa724311250628225a1538ce0f17db7b2
TLSH
T15361202DD8644CAB0DB26775B87A07C1F996463F12505D1A3C7E0A8E0F72DAB4181FAE
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 adfdcafb7a87b73515ddcfed622e22e1b2fe6cd644d82d1a322b962b5481525f
MD5 8c678bd85d2d7453fa801901b3660c0f
SHA1 b8972ddc98eb9d7187ff3c66e4e7e578ec654751
SHA512 31f83f07216c9ff7af4b6c839550b037fe0025316bbe446e8bc674460979874b9d264f7c5ff23afc398df9eb2c599664804e6a4cb5197af09d5939a918966341
TLSH
T162A0021112438614C10516F8280997C86200B979C000125377D4A75A8C600608915584
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 8a3fc267dcef24cc1133f999c4a6ec6aea6b12d4210aa1a2a66e87ee0ea91030
MD5 70c627128f79b05b97f221146428caec
SHA1 f4f3f1c3db656bb417dafdb3bad0a1075e91adce
SHA512 fdb170204f855b9177bddbd425370ff8b823e987230ec1c72ae709af9b619fa9ccc363260c0dec66ea5a027eca2b4f2413274a1dfa2ceea3a975ad523140a187
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\GrShaderCache\index
Size 256KB
SHA256 8b0cd1ecd757c1c74451ac45ac1beb8178a9a33d1cb4bf95d210911492188075
MD5 989f6306a04f5c5da18c2c23dad032af
SHA1 389bbf7eb257ee15358cec55615bf3d82e8b8436
SHA512 e86135a865fac05b04b19fac1afb4fe6c210f07cb20502da06b901e82e0a3a5c14afca32103ca336559aa42286d18e3ff80481375d2c2ab4dfe632e61d3cf3ed
SSDEEP 3:LstlNllklkXlb6ol/:LsX3lPb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\GraphiteDawnCache\index
Size 256KB
SHA256 6bdc194b5e3f2a210b21ee6679cacf5b961206dd70a2cdafb794a58894ca1031
MD5 0413a087cc24244791fa1ef26e445e9d
SHA1 2036b05d6685b1d7bd2073db161b1ab733eabe26
SHA512 0fbc9fa4b6098fed2f56a30ab0a5fab306d9d485acc6676dfea3005802da8db2a278e79261eb22e2c3c351e1dc1d48ba9a620e6c87ac851dfa2cd24e61a57194
SSDEEP 3:LstlNllklkXlWCNSal/:LsX3lPFAu/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\Local State
Size 1KB
SHA256 3d6f05aad0599946d91d68d31eb6494f72f85ce93b0dc15d9bdd635ce7e78305
MD5 1b22bd25ae46cc12124c8f1ffc2a643b
SHA1 747a601768c4f8b72914e493e744972d11a59b49
SHA512 de3e5007a71f060a2bdd5c1b4b023d688523963567a9ebbadb8acddf37d52ad56b8ac7636d9c9cd63358c21691139bae19595a31c5a6155202740d5673263639
TLSH
T1DB118270381836B2A9C2C54CE822BAA76F62623BD092DD982BDD1A1400762993612C38
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\uuubc1aw.xm1\ShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl\Crashpad\settings.dat
Size 280B
SHA256 e3312f29553f4f38df90f03b71b94be53c363eb240b29b8395196525a88c98f0
MD5 5402b0d858e90dc9e7495e8b06025367
SHA1 ee179f37e50db7e3ad8a16312133e24c2f2686f2
SHA512 04fdbea24187ff65841d858c4a71cce5fee909d296b3cc129ba4006d610210ddb3c616ddf80a9bee35259f7fd0a387255eaae80afd9afef76de94900b5eef309
TLSH
T105D0244033134107F100DC34D10C4D0433404D1DCC40554043454C140DDC70030C1544
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl\Local State
Size 4KB
SHA256 c6fdd09bda004f8769df2029372c3b7dd78365955f970072a7690e2c18b1883c
MD5 93dde02b669ac97cc841b2b7d6c5dfb5
SHA1 c2345fc6e9cfac6cfdceed816f88216a7a7f23d7
SHA512 96c66edfd6f7307d9010d25c3edff102fd45fc1fd41d7e540ecc75f5007283d17be902ec361c93d263125201f6b3e7b608addcf6c6aef58fe2a4e5f3a2b44355
SSDEEP 96:aqGNkJQsFfDLziT58Frh/cInURoDotovMwWDJuBGUvUAhNxo0eUnE6CKtyq4a:xGN9WLznooDUwSUlhNxoqgi/
TLSH
T142A186717434BC7B9BF19E45B5862713AFB4213BE0A53FA9DAEC1A1C04D76982342C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl\Local State
Size 3KB
SHA256 b150cf0e17efd13f291b0120a8ce90f8eaa450b2c660fb4a39993cb001a5c258
MD5 549fbb2fadd72463e3a58c26a70f778c
SHA1 3a2f68861fb0e6f9d6a786715616336114e439a8
SHA512 1cf319712abaf93a38893717eb4ae03bf9c5c33d6604d593d1a4490d3fc474a7701ddebec0ff806f6d364e9a2fb1d61b0c83d6f272a1c61e45d0d01277cdc333
TLSH
T1308195717434BDB7D7F19F84B64A6A139FB4313BD1612E64EAD9222800EB65C2346C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59b80b.TMP

Path C:\Users\Admin\AppData\Local\Temp\zgsms1e3.ikl\Local State~RFe59b80b.TMP
Size 1KB
SHA256 f0a27ed1ee2769935397dedfe622ee0e167114567e436e69021cb0c39669d846
MD5 c97c12e45d16c66009766f3f8986652d
SHA1 062b798507947616f10694d775aff209c4679e8a
SHA512 eea024146513c9b4213db5f242aac5e85d4b5f3b34851ca1cdf8ac884546b6d060a7d3ff9a00e9423b6e300fd3de28498f4b4c8c1a3a6b34a21dd20cb8892f90
TLSH
T1DA319570B426393BF8E04A95E38A77235E702536D0651E6852EC162D05F36CC2327C3B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/704-446-0x000001D744FC0000-0x000001D745072000-memory.dmp

Download

memory/704-449-0x000001D7450A0000-0x000001D7450BE000-memory.dmp

Download

memory/1280-438-0x00000242957A0000-0x00000242957AA000-memory.dmp

Download

memory/1524-30-0x0000017FFBC40000-0x0000017FFBC5E000-memory.dmp

Download

memory/1524-28-0x0000017FFBBD0000-0x0000017FFBBE0000-memory.dmp

Download

memory/2440-37-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-7-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-27-0x00000286B5610000-0x00000286B5622000-memory.dmp

Download

memory/2440-123-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-19-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-18-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-17-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-16-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-13-0x00000286B5B80000-0x00000286B60A8000-memory.dmp

Download

memory/2440-36-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-35-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-34-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-33-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-32-0x00000286B52B0000-0x00000286B5300000-memory.dmp

Download

memory/2440-15-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-14-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-12-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-11-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-10-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-9-0x00000286B51C0000-0x00000286B5236000-memory.dmp

Download

memory/2440-8-0x00000286B5310000-0x00000286B54D2000-memory.dmp

Download

memory/2440-0-0x000002869AAF0000-0x000002869ABFE000-memory.dmp

Download

memory/2440-6-0x000002869B060000-0x000002869B061000-memory.dmp

Download

memory/2440-5-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-4-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-3-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-31-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-20-0x00000286B60B0000-0x00000286B62F2000-memory.dmp

Download

memory/2440-21-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-22-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-23-0x00000286B6790000-0x00000286B69D2000-memory.dmp

Download

memory/2440-26-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-1-0x00007FF9D75CF000-0x00007FF9D75D0000-memory.dmp

Download

memory/2440-439-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-24-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/2440-2-0x00007FF9D7440000-0x00007FF9D7DE4000-memory.dmp

Download

memory/3520-425-0x0000013D8CCB0000-0x0000013D8CCBA000-memory.dmp

Download

memory/3520-420-0x0000013DA51B0000-0x0000013DA5262000-memory.dmp

Download

memory/3520-419-0x0000013DA5110000-0x0000013DA512E000-memory.dmp

Download

memory/3520-399-0x0000013D8CA60000-0x0000013D8CA82000-memory.dmp

Download

memory/5992-29-0x0000025F71E90000-0x0000025F71EA0000-memory.dmp

Download