donutloader | 3e1fb4cc6c8ce65e6ac79793cb7d482e6c18ba46dce36b0c51a259b511528d30

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 06:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payl.exe
Size 1.0MB
Sample260809-gyzcmsan3x
SHA256 3e1fb4cc6c8ce65e6ac79793cb7d482e6c18ba46dce36b0c51a259b511528d30
MD5 dea25a6b76f660ff1d464c88ce57e453
SHA1 e114092df6873c703be1a785646b171948d37980
SHA512 f5cb10060b1cbce9a460861c6b959926c0c7affd132d8a3c361118e0f17a08a719b20e8fd8a27d8c583d2091734fcdc33a0e2e84617c165445f8659a07b579a7
SSDEEP 24576:eOlOX6eCdBvm0+myIesqfFSZhGGtEoeJhkhfIkdb5:eOlC8H3Bf
TLSH
T13435CF163BF5EE01E2AA33B940A045D443F5E4199E86DF0A22D43AF36ADFF91DB06057
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution donutloader loader persistence privilege_escalation spyware stealer

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/5452-18-0x000001CE7D8F0000-0x000001CE7DB32000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3080	powershell.exe
5744	powershell.exe
6128	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Repair.lnk	payl.exe

Executes dropped EXE 2 IoCs

pid	Process
1268	CoreWorker_eISNxgiOXwxybMx.exe
5716	CoreWorker_eISNxgiOXwxybMx.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_eISNxgiOXwxybMx = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_eISNxgiOXwxybMx.exe"	payl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_eISNxgiOXwxybMx = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_eISNxgiOXwxybMx.exe"	CoreWorker_eISNxgiOXwxybMx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoreWorker_eISNxgiOXwxybMx = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_eISNxgiOXwxybMx.exe"	CoreWorker_eISNxgiOXwxybMx.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4908	cmd.exe
1260	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3904	chrome.exe
5208	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	payl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	payl.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe
5452	payl.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5452	payl.exe
Token: SeDebugPrivilege	5452	payl.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeDebugPrivilege	3080	powershell.exe
Token: SeIncreaseQuotaPrivilege	3080	powershell.exe
Token: SeSecurityPrivilege	3080	powershell.exe
Token: SeTakeOwnershipPrivilege	3080	powershell.exe
Token: SeLoadDriverPrivilege	3080	powershell.exe
Token: SeSystemProfilePrivilege	3080	powershell.exe
Token: SeSystemtimePrivilege	3080	powershell.exe
Token: SeProfSingleProcessPrivilege	3080	powershell.exe
Token: SeIncBasePriorityPrivilege	3080	powershell.exe
Token: SeCreatePagefilePrivilege	3080	powershell.exe
Token: SeBackupPrivilege	3080	powershell.exe
Token: SeRestorePrivilege	3080	powershell.exe
Token: SeShutdownPrivilege	3080	powershell.exe
Token: SeDebugPrivilege	3080	powershell.exe
Token: SeSystemEnvironmentPrivilege	3080	powershell.exe
Token: SeRemoteShutdownPrivilege	3080	powershell.exe
Token: SeUndockPrivilege	3080	powershell.exe
Token: SeManageVolumePrivilege	3080	powershell.exe
Token: 33	3080	powershell.exe
Token: 34	3080	powershell.exe
Token: 35	3080	powershell.exe
Token: 36	3080	powershell.exe
Token: SeDebugPrivilege	1268	CoreWorker_eISNxgiOXwxybMx.exe
Token: SeDebugPrivilege	1268	CoreWorker_eISNxgiOXwxybMx.exe
Token: SeDebugPrivilege	6128	powershell.exe
Token: SeDebugPrivilege	5744	powershell.exe
Token: SeIncreaseQuotaPrivilege	5744	powershell.exe
Token: SeSecurityPrivilege	5744	powershell.exe
Token: SeTakeOwnershipPrivilege	5744	powershell.exe
Token: SeLoadDriverPrivilege	5744	powershell.exe
Token: SeSystemProfilePrivilege	5744	powershell.exe
Token: SeSystemtimePrivilege	5744	powershell.exe
Token: SeProfSingleProcessPrivilege	5744	powershell.exe
Token: SeIncBasePriorityPrivilege	5744	powershell.exe
Token: SeCreatePagefilePrivilege	5744	powershell.exe
Token: SeBackupPrivilege	5744	powershell.exe
Token: SeRestorePrivilege	5744	powershell.exe
Token: SeShutdownPrivilege	5744	powershell.exe
Token: SeDebugPrivilege	5744	powershell.exe
Token: SeSystemEnvironmentPrivilege	5744	powershell.exe
Token: SeRemoteShutdownPrivilege	5744	powershell.exe
Token: SeUndockPrivilege	5744	powershell.exe
Token: SeManageVolumePrivilege	5744	powershell.exe
Token: 33	5744	powershell.exe
Token: 34	5744	powershell.exe
Token: 35	5744	powershell.exe
Token: 36	5744	powershell.exe
Token: SeIncreaseQuotaPrivilege	6128	powershell.exe
Token: SeSecurityPrivilege	6128	powershell.exe
Token: SeTakeOwnershipPrivilege	6128	powershell.exe
Token: SeLoadDriverPrivilege	6128	powershell.exe
Token: SeSystemProfilePrivilege	6128	powershell.exe
Token: SeSystemtimePrivilege	6128	powershell.exe
Token: SeProfSingleProcessPrivilege	6128	powershell.exe
Token: SeIncBasePriorityPrivilege	6128	powershell.exe
Token: SeCreatePagefilePrivilege	6128	powershell.exe
Token: SeBackupPrivilege	6128	powershell.exe
Token: SeRestorePrivilege	6128	powershell.exe
Token: SeShutdownPrivilege	6128	powershell.exe
Token: SeDebugPrivilege	6128	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5024	chrome.exe
5024	chrome.exe
4296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5452 wrote to memory of 2416	5452	payl.exe	90
PID 5452 wrote to memory of 2416	5452	payl.exe	90
PID 5452 wrote to memory of 4488	5452	payl.exe	91
PID 5452 wrote to memory of 4488	5452	payl.exe	91
PID 5452 wrote to memory of 5024	5452	payl.exe	94
PID 5024 wrote to memory of 4880	5024	chrome.exe	95
PID 5024 wrote to memory of 1872	5024	chrome.exe	96
PID 5024 wrote to memory of 1872	5024	chrome.exe	96
PID 5024 wrote to memory of 3904	5024	chrome.exe	97
PID 5024 wrote to memory of 5688	5024	chrome.exe	98
PID 5024 wrote to memory of 5688	5024	chrome.exe	98
PID 5024 wrote to memory of 2584	5024	chrome.exe	101
PID 5024 wrote to memory of 2584	5024	chrome.exe	101
PID 5024 wrote to memory of 3364	5024	chrome.exe	102
PID 5024 wrote to memory of 3364	5024	chrome.exe	102
PID 5024 wrote to memory of 716	5024	chrome.exe	103
PID 5024 wrote to memory of 716	5024	chrome.exe	103
PID 5024 wrote to memory of 4692	5024	chrome.exe	99
PID 5024 wrote to memory of 4692	5024	chrome.exe	99
PID 5024 wrote to memory of 4328	5024	chrome.exe	100
PID 5024 wrote to memory of 4328	5024	chrome.exe	100
PID 5452 wrote to memory of 4296	5452	payl.exe	104
PID 4296 wrote to memory of 6064	4296	msedge.exe	105
PID 4296 wrote to memory of 5364	4296	msedge.exe	106
PID 4296 wrote to memory of 5208	4296	msedge.exe	107
PID 4296 wrote to memory of 5364	4296	msedge.exe	106
PID 4296 wrote to memory of 5364	4296	msedge.exe	106
PID 4296 wrote to memory of 4024	4296	msedge.exe	108
PID 4296 wrote to memory of 4024	4296	msedge.exe	108
PID 4296 wrote to memory of 3520	4296	msedge.exe	109
PID 4296 wrote to memory of 4784	4296	msedge.exe	110
PID 4296 wrote to memory of 3520	4296	msedge.exe	109
PID 4296 wrote to memory of 3520	4296	msedge.exe	109
PID 4296 wrote to memory of 4784	4296	msedge.exe	110
PID 4296 wrote to memory of 4784	4296	msedge.exe	110
PID 4296 wrote to memory of 4648	4296	msedge.exe	111
PID 4296 wrote to memory of 1692	4296	msedge.exe	112
PID 4296 wrote to memory of 5176	4296	msedge.exe	113
PID 4296 wrote to memory of 3472	4296	msedge.exe	114
PID 4296 wrote to memory of 2372	4296	msedge.exe	115
PID 4296 wrote to memory of 5904	4296	msedge.exe	116
PID 4296 wrote to memory of 5412	4296	msedge.exe	117
PID 4296 wrote to memory of 3264	4296	msedge.exe	118
PID 4296 wrote to memory of 4460	4296	msedge.exe	119
PID 4296 wrote to memory of 5624	4296	msedge.exe	120
PID 4296 wrote to memory of 3472	4296	msedge.exe	114
PID 4296 wrote to memory of 3472	4296	msedge.exe	114
PID 4296 wrote to memory of 1884	4296	msedge.exe	121
PID 4296 wrote to memory of 1124	4296	msedge.exe	122
PID 4296 wrote to memory of 2372	4296	msedge.exe	115
PID 4296 wrote to memory of 2372	4296	msedge.exe	115
PID 4296 wrote to memory of 5904	4296	msedge.exe	116
PID 4296 wrote to memory of 5904	4296	msedge.exe	116
PID 4296 wrote to memory of 5412	4296	msedge.exe	117
PID 4296 wrote to memory of 5412	4296	msedge.exe	117
PID 4296 wrote to memory of 3264	4296	msedge.exe	118
PID 4296 wrote to memory of 2160	4296	msedge.exe	123
PID 4296 wrote to memory of 3264	4296	msedge.exe	118
PID 4296 wrote to memory of 4460	4296	msedge.exe	119
PID 4296 wrote to memory of 4460	4296	msedge.exe	119
PID 4296 wrote to memory of 5624	4296	msedge.exe	120
PID 4296 wrote to memory of 5624	4296	msedge.exe	120
PID 4296 wrote to memory of 1884	4296	msedge.exe	121
PID 4296 wrote to memory of 1884	4296	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\payl.exe
"C:\Users\Admin\AppData\Local\Temp\payl.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y" --app=http://127.0.0.1:49868
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffe8e5fc728,0x7ffe8e5fc734,0x7ffe8e5fc740
    3⤵
    PID:4880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,11202767544591634211,10735077169963656202,262144 --field-trial-handle=1884,i,5961224690458912421,16406661225091224646,262144 --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:2
    3⤵
    PID:1872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y" --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,9707057744973157789,10378218171709140590,524288 --field-trial-handle=1884,i,5961224690458912421,16406661225091224646,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y" --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,16385855466584765335,3263006637699612670,524288 --field-trial-handle=1884,i,5961224690458912421,16406661225091224646,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:13
    3⤵
    PID:5688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,8416539894635344176,16427404111331711233,2097152 --field-trial-handle=1884,i,5961224690458912421,16406661225091224646,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:4692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,14581206239260002547,3834154114965673979,2097152 --field-trial-handle=1884,i,5961224690458912421,16406661225091224646,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:4328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3628,i,3216465287922462485,14214043725897709712,2097152 --field-trial-handle=1884,i,5961224690458912421,16406661225091224646,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
    3⤵
    PID:2584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3660,i,2023626535023069876,5573822574726907292,2097152 --field-trial-handle=1884,i,5961224690458912421,16406661225091224646,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:9
    3⤵
    PID:3364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4400,i,16530673417702145490,12049142173644226656,2097152 --field-trial-handle=1884,i,5961224690458912421,16406661225091224646,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
    3⤵
    PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --app=http://127.0.0.1:50048
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x290,0x7ffe8517c188,0x7ffe8517c194,0x7ffe8517c1a0
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1936,i,2063381549500557797,18336919995052246525,262144 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:2
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,13090503392404406316,11564633522206094192,524288 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,8761532362052255042,1483609033365692654,524288 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:13
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,18011037336819558400,11260964627160342226,2097152 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,10762215625759126642,16386329855037666000,2097152 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4056,i,4149433660177091,4886773830908142358,524288 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:14
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4116,i,3834525504958925217,655914350101186727,524288 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:14
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4120,i,13548910405043100480,10907198615465138395,524288 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4148,i,14513041150139166089,1098874439215521205,2097152 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4176,i,13236645504880496537,305273916813793854,2097152 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4204,i,5725139352507192774,16644694592714798157,2097152 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4228,i,3965566989652486140,8085783576909377420,2097152 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:9
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4252,i,917255923118732393,3200768621653075014,2097152 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4352,i,11789899176541447837,17528930663020633657,2097152 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4140,i,8839451462273670919,5333467907782177301,2097152 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:9
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4420,i,4475230392975089544,8454677871751162414,2097152 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:9
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4460,i,13284386230251267261,8270078326881297985,2097152 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4552,i,14250568064537757074,7902609858781273280,2097152 --field-trial-handle=2660,i,13704563578356197733,14137798044803921577,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:9
    3⤵
    PID:2160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
  2⤵
  - Executes a command shell one-liner
  PID:4908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3080
- C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe
  "C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1268
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'CoreWorker_eISNxgiOXwxybMx-1644' -RunLevel Highest "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:6128
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
    3⤵
    - Executes a command shell one-liner
    PID:1260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:5744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3708

C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe
1⤵
- Executes dropped EXE
PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CoreWorker_eISNxgiOXwxybMx.exe

Path C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe
Size 13KB
SHA256 ac1b5674bc96f344170df29bc59c38907370786a8495f33d75b20cff7f16a5f7
MD5 8f6f193d29649778778f82c815f0dcf5
SHA1 779e92a644084a2a3135cc410ccb960e9d8a932f
SHA512 1537c104e9377a26f8a347a493e32b0625cc44cd8eecae2c7595c67d8e768ae00b2f990247d6698d474e2af4469dfd30b8a666acd60a56c720cb8fb3d74e1aef
SSDEEP 192:lP4EDne8F9DTHoKiTizMVhmHGjrmbQSaZxGKTOkhEw3zzMRDTQsW7vm:p4EH9D8KiuRGjrmbQSgxLiR0Mx/W7v
TLSH
T1B0520904B7E18125E9BA0B39EEF355005A33F7635936CE5E14CC518B0B27680AEE2F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_m0cizwld.4au.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m0cizwld.4au.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Crashpad\settings.dat
Size 40B
SHA256 7ecf573456269c1683ba7b9320318e1859c7ca8602dd4ebd57baac8bdb2ee58f
MD5 3dc7d192037f1c37c08eb9e4bb38d600
SHA1 89f5ebd86eadc96e5914bd7d2d6f9f390f766559
SHA512 45d0beaff34af9a44708e9c6a38c51dc2f5f0e2a11b40200dc0f5627caa1ed167b941dbdf0d038baabb6420416beefeb2270737581c3da3301a22fc98953d09e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 7262ab60355d0cf22ac06d325314d9010186e2730a947a7a7e317660a6efa3af
MD5 a4830d4d2d91a54212fad732a41f21f6
SHA1 6c0efe85d7fef41426b357d163a841dac2ad50ef
SHA512 40f3387182bef677909c52ea5e70248156de0b1632890ca8c397a37c43118584eb7f98d01d180090b3eda24eae1d0d0e6de562e41a4212100363911e8499c832
SSDEEP 6:/F3XGuX7ikeAsSHuS/9i/rJIJrZXWB+/:d3XTHeAsZmaJIFA+/
TLSH
T1EF13923E9CC38F83DA651174940EBF741B718982EA34178F79A0EE11BDA838A02DA118
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 81cd519df170519e1600589b41105dd8da3aa4a34dcc4a2075ac5323b8b41b6d
MD5 686073830de707ff072153e215312b8c
SHA1 35e549add60d07197642acbcc11832120d61073e
SHA512 95c0600e3c921aabf88064f6ab387aa652ec8e41d01f878b9baeda9ababa198bd9e75279bf3419dae5f3e3af4270b702b9e436fc2e665ea4d8085d372459b0e0
SSDEEP 12:U/MmXT5vpqp9ikxQH0lhZam90IR2jBEhVkZS0y+XSAc:JmD5Cas1R4B4ka+iAc
TLSH
T1444428FA2C429A85D71AC3BD15A72735D966D1C03CAE9E4DB0214DA50824E40A8A9244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\Cache\Cache_Data\index
Size 256KB
SHA256 6b5dc78fa5d3184d467ac31d30c20e616dd6e34ceaf54c421a906e8ca93f8981
MD5 eba23afde8af377780319c1782c663e1
SHA1 8f830e76422b72ecbf2286a199144f9dc668379f
SHA512 d121adb1565e5446e74d4e65a2f8fd4852d5a676fd34c3ac299f89677c6a8cf98cc7ba9780d95974f919693f72eecb35786d41b41bd650861b12b10cc8434e6c
SSDEEP 3:LsOlNllklkXl/s/e11nIlXlmNtl9lXl:LsK3lP0/r+N
TLSH
T17544012A03C50C06C980127C4443A7310725D0548A0FC347230485200DC2BD40E8A140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 b0fde6eed3179a46c7b285ac715177c7f9f0a62a58e803210ac78e97437c521d
MD5 7f3396512e5443bf15e388604a18da39
SHA1 80d29cb9d1f71373ee673cbd7e0a0f52f013c0d1
SHA512 71b0a4245536bb71015e59d60c7f8e0b6815f9d967599de44cd867319a115c51b5a491ed6e7b0b93e4987c3771ad07757c915a4b1342ead191f7a78ae0ca96d4
TLSH
T16AE02B81828C0F0DD32DA6F7CDF603444A0A83C42AFE3603A980C2C233124341258223
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 20df2c81cf5c4b37bd9e81a5d0ec4f0416bbd24627aebdefb1bea67208a944ea
MD5 13e84e03b899e934e1d15263063ce3c0
SHA1 3242f4a8d85c64729251d6099903f1d401fb0f39
SHA512 1ea1d3866a3f6d847548c091fae2d0cc0ecf2ae606c123554c5b6c68237b728c0c476652c4a316b62b59039a8c1fa91600feefd14bfc21ef0bd4ce792ccb1fd2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 e38b704634b0424459ddea879c5cae514d4794b63149970b60af1cce598b49ba
MD5 103288f7b991b2de2051cbdd6d801333
SHA1 1d9ed71028b05392d58b1827c44932c1d1693ac9
SHA512 3efa1a7f20ec5a2e88afc1ae7bc0e37ce328496181322daa675fc19099c5586c3d36bd69a124a51b7634d1eed8b3fa4d7acf6f45ccc1bee42cd83b92aebaccec
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\DawnGraphiteCache\index
Size 256KB
SHA256 a5e48bf605301d4d834f0e8deda479fb58a5e22e24eb2259f736fc5abae21adc
MD5 fb3cca0dc3e7a29f41cc5711c1a66740
SHA1 390e9c4e36eb049aad4d94c09a20170302f27dfc
SHA512 9607945c29382580ab60e4b6aa895d2cb0af6caec2f6cfd1e124d20e1644cd2f4924bdc6107e3129f4b603f5a8bbeedd9d8a7600bcefa636ff772290da81e7b6
SSDEEP 3:LstlNllklkXlzIS+X:LsX3lPzv+X
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\DawnWebGPUCache\index
Size 256KB
SHA256 64081a0400eb42d71c8d494a8c1558a931e3073c1178bf11aff0b49c9a350f64
MD5 f439498013b98f5ba180e8302b5e1111
SHA1 0ae492513cd6b62dfd2b322c1720056a9e785493
SHA512 941d5e670ad199166b1dedbd5c6397c35cb3fb51e31fa9bc09efd9db4bb913f812aa6ea7e6aa009b9a122b6b062c5d87ebde6793d10651b60d90ae78a0ca63cd
SSDEEP 3:LstlNllklkXl//t:LsX3lP//t
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\GPUCache\index
Size 256KB
SHA256 d2ff575e51d2e4fc06c54089a86c45dbbfc99e5fe5831f56966715ae321fed5e
MD5 886248e36fc54e41760f6d9f971fbe50
SHA1 7593c3fe1a115436469d5fdfbee0693986d7d709
SHA512 52adbae7ce758f196c6078f9406add80fe317a77fa6f2aebb47700cef273d49facbb27d40ce1b72096b993373a9219ae88ede7f8d26ed069604fdce5a53e2eec
SSDEEP 3:LstlNllklkXl4GSat:LsX3lP4wt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\Preferences
Size 3KB
SHA256 40a47d066ae589ed7705099781c3ca476562b191acf56a39964e10f1dc470c0f
MD5 4ca6c9b1dc1b2942172d6fa0543969cb
SHA1 490d9229c8a0fe2178372b1cc89f5aa00df26a66
SHA512 37632dad50fb6879824c310b12cb40587ea3c059aab052bd6db0afbc7c418e12484174fb9accec87185a1a5e6989367fa724311250628225a1538ce0f17db7b2
TLSH
T15361202DD8644CAB0DB26775B87A07C1F996463F12505D1A3C7E0A8E0F72DAB4181FAE
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 27bb5b787428c1c37ddbda245416b46eb7e3b5677be68cd628191f7d2c70660c
MD5 5d8c4eedfd190123ade241a43cbbb060
SHA1 e41ee2d0ff941d53ad3cb2e6759098ca60f30a59
SHA512 f1447d8ca4d14a8b6dafc36d9eb52a0e6abded6fa29f83c9173a8ed73be2fcbf7da420968b1425059e01a4d2f88623029f896839be179684f9bb9b20583b840c
TLSH
T15EA0021502809110E11452B428119BC85A00BE6590000337BAE043469CA30645951545
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 939583f231dae746d822c7a68eb0c8ea4a5f857508552b69f8a7cac1cb96d5c2
MD5 ff5dbb77d23162e65e263fa06bc759be
SHA1 38057b46d3619d72acd34b427a71db47f5126a34
SHA512 ed3c7d2c733790001556ceb4db58749bb6daef9ced9ebfda24d069732101a57ce90df9b57870d3ecaa982ff17a296a024852511711b024f45c7682916f64e8a5
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\GrShaderCache\index
Size 256KB
SHA256 be93c40a9158a9d33a9c1550966f161c87da6960547dc2c9bb5091c90e9ddc05
MD5 525092cc8daa7d78098c35ab8512073f
SHA1 ba4002e40e53ceb069ad6b1997540872013ae8b3
SHA512 d9134fb3a9592770b86494529391a8768c36c6861853c007b08405a1d1c5dbbd5f998f28a1a378521a09229f0a537f77dec1e99ae9c54ac28a6a212ecbfa5755
SSDEEP 3:LstlNllklkXlzSS+X:LsX3lPNe
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\GraphiteDawnCache\index
Size 256KB
SHA256 5cfd2be3db7e440b0719db33721d7357537fdf01cadfb4b3b9e8c7d4b1bbd6be
MD5 7e25346ca41ea92cbb6f7d516eec12db
SHA1 9151256fdee5f50a5f56221296b90b48ae8fbf97
SHA512 3195f1de3d20226c30e49eceb17b55e47a0cae84f3452a80dac44f11555be89a834fdfc724df251be3cc453a0fe75c99d95adcf40abca3ad4d216d881d4c3e98
SSDEEP 3:LstlNllklkXlo2:LsX3lPo2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Local State
Size 1KB
SHA256 7fa583da559beab6b72ae4c449497cc2153f06ed6bcec2a665aac3b61ea88c78
MD5 a02777a13dedd4c4d48bf7bde33b8bd6
SHA1 195e9f960236494b6cf9137f81d553ac6919585f
SHA512 5e96fa31776d5c82ce7b5a11f3f4f76733e3f1ccf36fe192148aa118ccefbf6640a03557ebc9defc53704eda4abc1c48a2ea1ccc97687bf87e3a9a6107ec69ef
TLSH
T1C611757031343B715CD6868C6D26B5EB4E31B26BD157CC486DCD25281F7629C1301E3A
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\ShaderCache\index
Size 256KB
SHA256 f6311fec39032e42a24c54911b0312211302f67e6d05b79ca2dd72f6834bebba
MD5 3df506a625fb81bfdb341358b058dc5b
SHA1 1dbbb8c6de135819a6cbdb341605f0db89e100bd
SHA512 3e3bb5edbed09dcdd507bc586b7972c48725c8e7afbcc48ee50b2a0010a6279e12db829156f35c81798400f0c5e1328f0ffefb4598b7b3192380854c6a115f18
SSDEEP 3:LstlNllklkXlY7X:LsX3lPmX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Temp\gusrchjx.h5y\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg\Crashpad\settings.dat
Size 280B
SHA256 569e6aa0e9d2e92724ffee7634982148e735f39b5ed63feda089dc08da9a8ff6
MD5 89aae1c2233ef57f83ef984eeb07410c
SHA1 ea95ff5b746db89ea328ff92e5f2c3914f555bad
SHA512 7b212f1f76725e389000db658b75aa486067a5ccd5994fe276c6929a4daae37ff18e35b32e90ba14d29dd7148d428edc8bafc97b2e00377c6db8216f0bc4e0e9
TLSH
T1DCD0222BA3003AB0E0C0033AE028830088F0AE3030C38300B823030BAC0280C8822FC3
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg\Local State
Size 4KB
SHA256 bf3cdb1e4a6e51c7cc64ee9918a859f60d3ba09687680d4b3b971a32e79abcc4
MD5 1310247cfd65a28673f290896d857d4d
SHA1 d50fb18f815875be97e38c74fb4473fc89dfdc63
SHA512 cb288ac2eddda27c54c797939165c4cf6efa5dea46ea385da256ec460de26208dce8c48b37ca659fe398961d5fc5aaa4ae95a3567d924e8bce75f2a989dd9d23
SSDEEP 96:wqGNkMQsFfDtc9s58Frh/cInURoDotovHqzDDBH+vCUDXq0eUnQECxcq4a:7GNgWtWooDUwKHd+DaqWn
TLSH
T184A18531A478BC779EF29F05B68A3A03AFE5713BE4947F94DAD82A1C04DB2481345C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg\Local State
Size 3KB
SHA256 536efde9aabb75887dfc19e32473f98495a2d47e275fa80520681d8395722166
MD5 3d6a778c69bb0cd313f0042d27b8c063
SHA1 f03b42e713fc30ad5d61d88acd4f058754650687
SHA512 e6b7d51947ada2d07a50cce6aeb9bac51f57f2964a6a4f46305df94802c91f7fb8d78cd4873baeb564878b76604f6b284015d9a48a78cc241a87898ee956ccfc
TLSH
T1FE818631A428BCB7DBF25F45B64A7A039FF9B17BD4616A54D9C5221804EB25C1305C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59aa50.TMP

Path C:\Users\Admin\AppData\Local\Temp\lwuczmzt.3pg\Local State~RFe59aa50.TMP
Size 1KB
SHA256 6216020017cabce917840d722de3fa33038a2e3f6809e56c99b1731d4a7bf19c
MD5 362c6b082fa562093e3b81beebd6764a
SHA1 7dbfe46b7c4398cdab88c14d54f08c813191bbf1
SHA512 15f25fd6e2b64141ec2e80a374c6c4d054f5a021eaf5b94bdf5b9f138ad3c57e0c5695e264f5f4727fe8b284aa3de54deb16f3e5bba8e7cb44c4f391ce865b7c
TLSH
T19431B5B1E86C7DB7F8911705B38ABB535E71B631D0559A9892DD250900EB28C5215C3B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1268-442-0x00000291C1730000-0x00000291C173A000-memory.dmp

Download

memory/2416-25-0x000001F48D530000-0x000001F48D54E000-memory.dmp

Download

memory/2416-23-0x000001F48BBE0000-0x000001F48BBF0000-memory.dmp

Download

memory/3080-420-0x0000022890100000-0x000002289010A000-memory.dmp

Download

memory/3080-419-0x00000228A8CE0000-0x00000228A8D92000-memory.dmp

Download

memory/3080-417-0x00000228900E0000-0x00000228900FE000-memory.dmp

Download

memory/3080-413-0x0000022890030000-0x0000022890052000-memory.dmp

Download

memory/4488-24-0x000002797A7B0000-0x000002797A7C0000-memory.dmp

Download

memory/5452-16-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-3-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-14-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-13-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-12-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-11-0x000001CE649D0000-0x000001CE64A46000-memory.dmp

Download

memory/5452-10-0x000001CE7D520000-0x000001CE7D6E2000-memory.dmp

Download

memory/5452-8-0x000001CE63020000-0x000001CE63021000-memory.dmp

Download

memory/5452-9-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-7-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-6-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-5-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-17-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-18-0x000001CE7D8F0000-0x000001CE7DB32000-memory.dmp

Download

memory/5452-4-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-0-0x00007FFE8B8FF000-0x00007FFE8B900000-memory.dmp

Download

memory/5452-347-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-15-0x000001CE7DC20000-0x000001CE7E148000-memory.dmp

Download

memory/5452-19-0x000001CE7EE90000-0x000001CE7F0D2000-memory.dmp

Download

memory/5452-21-0x000001CE7D310000-0x000001CE7D322000-memory.dmp

Download

memory/5452-414-0x000001CE7F2F0000-0x000001CE7F4BA000-memory.dmp

Download

memory/5452-418-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-22-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-26-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-421-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-428-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-427-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-429-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-2-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-27-0x000001CE7DB40000-0x000001CE7DB90000-memory.dmp

Download

memory/5452-444-0x00007FFE8B770000-0x00007FFE8C114000-memory.dmp

Download

memory/5452-1-0x000001CE62AC0000-0x000001CE62BCE000-memory.dmp

Download

memory/6128-451-0x0000025F75DC0000-0x0000025F75E72000-memory.dmp

Download

memory/6128-454-0x0000025F760F0000-0x0000025F7610E000-memory.dmp

Download