c9c535ab5ae7109d6b0b98cafbaddefa9de2b9309668a759aa889f34f8c40776

Analysis

max time kernel
299s
max time network
314s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/08/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PanmenaGame_BetaTest.exe
Size 215.0MB
Sample260811-pncd5ashpg
SHA256 c9c535ab5ae7109d6b0b98cafbaddefa9de2b9309668a759aa889f34f8c40776
MD5 e69ef9be58e59b43dc192d19d752316b
SHA1 6beae4ffe5bbb0b74bf30a8fd71ef837a98b7d85
SHA512 6170d49fb4ddf215f2456dc80465597ba406a5caa9dd549924e5f49cb341a62c1eeb5f50d8c337a95c5b695c8a46eae455122718e4990353bbec195abbd1ee5c
SSDEEP 1572864:4Oa3GJV1iPuKYncvg3LOL9Yez2OTe1lKrnzGjxuJm0p6TQLCfTQFHk4KmntuykGe:HximKYn2KwgF8V8
TLSH
T18BB88C03F29641DAC05DC1B98B5A9633FE71B8454B24A3DF2B5447522F66EF82B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4784	data_helper.exe
2216	java.exe
1800	javaw.exe

Loads dropped DLL 26 IoCs

pid	Process
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
1800	javaw.exe
1800	javaw.exe
1800	javaw.exe
1800	javaw.exe
1800	javaw.exe
1800	javaw.exe
1800	javaw.exe
1800	javaw.exe
2216	java.exe
2216	java.exe
1800	javaw.exe
1800	javaw.exe
2216	java.exe
1800	javaw.exe
2216	java.exe
1800	javaw.exe
2216	java.exe
2216	java.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\emre = "\"C:\\Users\\Admin\\AppData\\Local\\emre\\jre\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Local\\emre\\emre.jar\" --startup"	reg.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4232	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3032	cmd.exe
2408	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2500	chrome.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PanmenaGame_BetaTest.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PanmenaGame_BetaTest.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PanmenaGame_BetaTest.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PanmenaGame_BetaTest.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 20 IoCs

defense_evasion

pid	Process
4500	taskkill.exe
2144	taskkill.exe
1036	taskkill.exe
2232	taskkill.exe
2828	taskkill.exe
848	taskkill.exe
3048	taskkill.exe
576	taskkill.exe
2036	taskkill.exe
1548	taskkill.exe
1160	taskkill.exe
3760	taskkill.exe
4532	taskkill.exe
3492	taskkill.exe
5048	taskkill.exe
848	taskkill.exe
1908	taskkill.exe
2428	taskkill.exe
4976	taskkill.exe
2584	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309257415391321"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2232	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4232	powershell.exe
4232	powershell.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe
2216	java.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3604	chrome.exe
3604	chrome.exe
3604	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4784	data_helper.exe
Token: 35	4784	data_helper.exe
Token: SeSecurityPrivilege	4784	data_helper.exe
Token: SeSecurityPrivilege	4784	data_helper.exe
Token: SeShutdownPrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeCreatePagefilePrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeShutdownPrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeCreatePagefilePrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeShutdownPrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeCreatePagefilePrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeShutdownPrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeCreatePagefilePrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeShutdownPrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeCreatePagefilePrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeShutdownPrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeCreatePagefilePrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeShutdownPrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeCreatePagefilePrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeShutdownPrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeCreatePagefilePrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeShutdownPrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeCreatePagefilePrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeShutdownPrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeCreatePagefilePrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeShutdownPrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeCreatePagefilePrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeShutdownPrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeCreatePagefilePrivilege	1728	PanmenaGame_BetaTest.exe
Token: SeDebugPrivilege	5048	taskkill.exe
Token: SeDebugPrivilege	848	taskkill.exe
Token: SeDebugPrivilege	2036	taskkill.exe
Token: SeDebugPrivilege	1908	taskkill.exe
Token: SeDebugPrivilege	1548	taskkill.exe
Token: SeDebugPrivilege	1160	taskkill.exe
Token: SeDebugPrivilege	4976	taskkill.exe
Token: SeDebugPrivilege	2428	taskkill.exe
Token: SeDebugPrivilege	2828	taskkill.exe
Token: SeDebugPrivilege	4532	taskkill.exe
Token: SeDebugPrivilege	3760	taskkill.exe
Token: SeDebugPrivilege	2232	taskkill.exe
Token: SeDebugPrivilege	2216	java.exe
Token: SeTcbPrivilege	2216	java.exe
Token: SeImpersonatePrivilege	2216	java.exe
Token: SeAssignPrimaryTokenPrivilege	2216	java.exe
Token: SeTakeOwnershipPrivilege	2216	java.exe
Token: SeRestorePrivilege	2216	java.exe
Token: SeDebugPrivilege	2216	java.exe
Token: SeTcbPrivilege	2216	java.exe
Token: SeImpersonatePrivilege	2216	java.exe
Token: SeAssignPrimaryTokenPrivilege	2216	java.exe
Token: SeTakeOwnershipPrivilege	2216	java.exe
Token: SeRestorePrivilege	2216	java.exe
Token: SeDebugPrivilege	3492	taskkill.exe
Token: SeDebugPrivilege	4500	taskkill.exe
Token: SeDebugPrivilege	848	taskkill.exe
Token: SeDebugPrivilege	2584	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	576	taskkill.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	1036	taskkill.exe
Token: SeShutdownPrivilege	3604	chrome.exe
Token: SeCreatePagefilePrivilege	3604	chrome.exe
Token: SeShutdownPrivilege	3604	chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4288	PanmenaGame_BetaTest.exe
1728	PanmenaGame_BetaTest.exe
3604	chrome.exe
3604	chrome.exe
3604	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2216	java.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 1728	4288	PanmenaGame_BetaTest.exe	79
PID 4288 wrote to memory of 2352	4288	PanmenaGame_BetaTest.exe	80
PID 4288 wrote to memory of 4636	4288	PanmenaGame_BetaTest.exe	81
PID 1728 wrote to memory of 3032	1728	PanmenaGame_BetaTest.exe	82
PID 1728 wrote to memory of 4492	1728	PanmenaGame_BetaTest.exe	84
PID 1728 wrote to memory of 3292	1728	PanmenaGame_BetaTest.exe	85
PID 3032 wrote to memory of 4784	3032	cmd.exe	86
PID 1728 wrote to memory of 2408	1728	PanmenaGame_BetaTest.exe	87
PID 2408 wrote to memory of 4232	2408	cmd.exe	89
PID 1728 wrote to memory of 2216	1728	PanmenaGame_BetaTest.exe	90
PID 1728 wrote to memory of 2232	1728	PanmenaGame_BetaTest.exe	91
PID 2216 wrote to memory of 5048	2216	java.exe	95
PID 2216 wrote to memory of 848	2216	java.exe	96
PID 2216 wrote to memory of 2036	2216	java.exe	98
PID 2216 wrote to memory of 1908	2216	java.exe	99
PID 2216 wrote to memory of 1548	2216	java.exe	103
PID 2216 wrote to memory of 1160	2216	java.exe	104
PID 2216 wrote to memory of 4976	2216	java.exe	107
PID 2216 wrote to memory of 2428	2216	java.exe	109
PID 2216 wrote to memory of 2828	2216	java.exe	112
PID 2216 wrote to memory of 4532	2216	java.exe	113
PID 2216 wrote to memory of 3760	2216	java.exe	115
PID 2216 wrote to memory of 2232	2216	java.exe	117
PID 2216 wrote to memory of 4500	2216	java.exe	120
PID 2216 wrote to memory of 848	2216	java.exe	121
PID 2216 wrote to memory of 3492	2216	java.exe	122
PID 2216 wrote to memory of 2584	2216	java.exe	123
PID 2216 wrote to memory of 3048	2216	java.exe	128
PID 2216 wrote to memory of 576	2216	java.exe	129
PID 2216 wrote to memory of 2144	2216	java.exe	130
PID 2216 wrote to memory of 1036	2216	java.exe	131
PID 2216 wrote to memory of 3604	2216	java.exe	136
PID 3604 wrote to memory of 4728	3604	chrome.exe	137
PID 3604 wrote to memory of 5008	3604	chrome.exe	139
PID 3604 wrote to memory of 2500	3604	chrome.exe	138
PID 3604 wrote to memory of 5008	3604	chrome.exe	139
PID 3604 wrote to memory of 2040	3604	chrome.exe	140
PID 3604 wrote to memory of 2040	3604	chrome.exe	140
PID 3604 wrote to memory of 5000	3604	chrome.exe	141
PID 3604 wrote to memory of 2076	3604	chrome.exe	142
PID 3604 wrote to memory of 5000	3604	chrome.exe	141
PID 3604 wrote to memory of 2076	3604	chrome.exe	142
PID 3604 wrote to memory of 3900	3604	chrome.exe	144
PID 3604 wrote to memory of 3900	3604	chrome.exe	144
PID 3604 wrote to memory of 2288	3604	chrome.exe	145
PID 3604 wrote to memory of 420	3604	chrome.exe	147
PID 3604 wrote to memory of 2528	3604	chrome.exe	148
PID 3604 wrote to memory of 4680	3604	chrome.exe	149
PID 3604 wrote to memory of 668	3604	chrome.exe	150
PID 3604 wrote to memory of 2856	3604	chrome.exe	151
PID 3604 wrote to memory of 2856	3604	chrome.exe	151

C:\Users\Admin\AppData\Local\Temp\PanmenaGame_BetaTest.exe
"C:\Users\Admin\AppData\Local\Temp\PanmenaGame_BetaTest.exe"
1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Local\Temp\PanmenaGame_BetaTest.exe
  C:\Users\Admin\AppData\Local\Temp\PanmenaGame_BetaTest.exe
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\emre\data_helper.exe" x "C:\Users\Admin\AppData\Local\emre\data.7z" -pTFwU0aCyMYeP -o"C:\Users\Admin\AppData\Local\emre" -y"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Users\Admin\AppData\Local\emre\data_helper.exe
      "C:\Users\Admin\AppData\Local\emre\data_helper.exe" x "C:\Users\Admin\AppData\Local\emre\data.7z" -pTFwU0aCyMYeP -o"C:\Users\Admin\AppData\Local\emre" -y
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4784
- - C:\Users\Admin\AppData\Local\Temp\PanmenaGame_BetaTest.exe
    "C:\Users\Admin\AppData\Local\Temp\PanmenaGame_BetaTest.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\panmenagamebetatest" --field-trial-handle=1896,i,10058393957450211120,2238594672287763199,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1900,i,12113470814714156200,15770495730962734331,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1948 /prefetch:11
    3⤵
    PID:4492
- - C:\Users\Admin\AppData\Local\Temp\PanmenaGame_BetaTest.exe
    "C:\Users\Admin\AppData\Local\Temp\PanmenaGame_BetaTest.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\panmenagamebetatest" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1896,i,10058393957450211120,2238594672287763199,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1900,i,12113470814714156200,15770495730962734331,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1888 /prefetch:2
    3⤵
    PID:3292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\emre\jre.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\emre\jre' -Force""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\emre\jre.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\emre\jre' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4232
- - C:\Users\Admin\AppData\Local\emre\jre\bin\java.exe
    C:\Users\Admin\AppData\Local\emre\jre\bin\java.exe -jar C:\Users\Admin\AppData\Local\emre\emre.jar
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM "Discord.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5048
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM "DiscordCanary.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:848
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM "DiscordPTB.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2036
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM "DiscordDevelopment.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1908
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discord.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1548
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discordcanary.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1160
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discordptb.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4976
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discorddevelopment.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2428
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discord.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2828
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discordcanary.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4532
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discordptb.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3760
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discorddevelopment.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2232
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discord.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4500
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discordcanary.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:848
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discordptb.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3492
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discorddevelopment.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2584
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discord.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3048
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discordcanary.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:576
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discordptb.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2144
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM discorddevelopment.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk --app=file:/C:/Users/Admin/AppData/Local/Temp/exastealer15195674008663001153/beta-game-setup.html --disable-pinch --allow-file-access-from-files --disable-web-security --disable-translate --disable-infobars --no-first-run --no-default-browser-check --disable-dev-tools --noerrdialogs --disable-component-update --disable-background-networking --disable-sync --disable-features=Translate,ChromeWhatsNewUI,InProductHelp --hide-crash-restore-bubble --lang=en-US
      4⤵
      Drops file in Program Files directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3604
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb5f5c728,0x7ffdb5f5c734,0x7ffdb5f5c740
        5⤵
        
        PID:4728
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=1932,i,4827168364476442880,10382001492467742827,524288 --field-trial-handle=2028,i,16076042364274227192,1977394310562442701,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2060 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2500
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,12948720942510448737,1002545749908381556,262144 --field-trial-handle=2028,i,16076042364274227192,1977394310562442701,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2024 /prefetch:2
        5⤵
        
        PID:5008
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,8427430466798184328,2193269110932287865,524288 --field-trial-handle=2028,i,16076042364274227192,1977394310562442701,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2600 /prefetch:13
        5⤵
        
        PID:2040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,4457042739159688368,7652080473202608253,2097152 --field-trial-handle=2028,i,16076042364274227192,1977394310562442701,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3276 /prefetch:1
        5⤵
        
        PID:5000
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,5897974792423946870,6295995929724248981,2097152 --field-trial-handle=2028,i,16076042364274227192,1977394310562442701,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3344 /prefetch:1
        5⤵
        
        PID:2076
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,2258331452438544601,13191814374813818647,2097152 --field-trial-handle=2028,i,16076042364274227192,1977394310562442701,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4484 /prefetch:9
        5⤵
        
        PID:3900
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,5536801281599387312,8489079678834758416,524288 --field-trial-handle=2028,i,16076042364274227192,1977394310562442701,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5412 /prefetch:14
        5⤵
        
        PID:2288
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,14510752894179719201,14747766414806173434,524288 --field-trial-handle=2028,i,16076042364274227192,1977394310562442701,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5656 /prefetch:14
        5⤵
        
        PID:420
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,10788453935900619019,7729527171683604878,524288 --field-trial-handle=2028,i,16076042364274227192,1977394310562442701,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5440 /prefetch:14
        5⤵
        
        PID:2528
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,2070307095308767434,17193328484846870016,524288 --field-trial-handle=2028,i,16076042364274227192,1977394310562442701,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5604 /prefetch:14
        5⤵
        
        PID:4680
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --noerrdialogs --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1228,i,16967692040570187570,12410624053833896739,262144 --field-trial-handle=2028,i,16076042364274227192,1977394310562442701,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4452 /prefetch:10
        5⤵
        
        PID:668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --noerrdialogs --force-high-res-timeticks=disabled --metrics-shmem-handle=3884,i,15145717589597908008,3796581859089890648,524288 --field-trial-handle=2028,i,16076042364274227192,1977394310562442701,262144 --disable-features=ChromeWhatsNewUI,InProductHelp,Translate --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4492 /prefetch:14
        5⤵
        
        PID:2856
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v emre /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\emre\jre\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Local\emre\emre.jar\" --startup" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2232
- C:\Users\Admin\AppData\Local\Temp\PanmenaGame_BetaTest.exe
  "C:\Users\Admin\AppData\Local\Temp\PanmenaGame_BetaTest.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\panmenagamebetatest" --field-trial-handle=1644,i,8063817990904955968,10906657598139959136,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1652,i,13260290298715619567,18318222074236572268,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1784 /prefetch:11
  2⤵
  PID:2352
- C:\Users\Admin\AppData\Local\Temp\PanmenaGame_BetaTest.exe
  "C:\Users\Admin\AppData\Local\Temp\PanmenaGame_BetaTest.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\panmenagamebetatest" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1644,i,8063817990904955968,10906657598139959136,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1652,i,13260290298715619567,18318222074236572268,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1640 /prefetch:2
  2⤵
  PID:4636

C:\Users\Admin\AppData\Local\emre\jre\bin\javaw.exe
"C:\Users\Admin\AppData\Local\emre\jre\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\emre\emre.jar" --startup
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:1800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 99eb20c4c1c404b5c91b95760b07e18d6553a0b569998b926d5977aa03c9e64f
MD5 50819f7d978948ecaac298d6517e320e
SHA1 8c8477670aba4cbf20f371cdc0b49d2cc75eacfc
SHA512 35d2542fdabcf933b11584c44feb76e26fd76bd36621a7a05ee2be0f4911608ade543b19fdbcdfcf6cedb1be9a63ba4908ae099bbbb8328c786524ad289d85d8
TLSH
T198E022A9DC21EC7B08FD172C20901A86F750031B3A8159AF3A3C920DCFB177E428686C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 20f4565de03ba4fc3994ea9663d56411edf78839a3e3073aa367aeb9509e3ded
MD5 5da97e0fb7777727c4f765e32319478a
SHA1 ecd2f863be5347f06b90752dbd79759d1361b629
SHA512 3373ee4af6193607b6a6e3203b39b00948fbd28a31dd93d72bdbdb4e56dfd44b05ea0d894363a0ed09c395824c6541c7641afbeec91f2b8afdb05b84a20b1ef2
TLSH
T154419EF793B4857D890192F4DA15AE1FCE6D0525035C3CA689D46E1B43F2972D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bcd6e3baf73dd264349fcdf4230a4020eb7941c1f84082389dffbea9feb39d34
MD5 29f4d97c075c94d4f118f41775bc3c2e
SHA1 8d8120916a13e473dcbebfc41ca0c0c3636af615
SHA512 a4f0ab3bc0b6de745f228e547a99266385762532470c2c9379e28115ccce67f3624704bc110f3b159489d92ca431066df1655f9343ff1a057d29cf515935cf2c
SSDEEP 192:GRZDX2xllGMCv7+pAPRp23p9uHsb+WNnDrPR4eC2Bb7PaEoVyIsnAUge:GRZDAO6UXmUwPPG2BbjaFe
TLSH
T10842C62EAA64797B5CCFD229F9267723D7F5102231902E84F6FC992C15E76CC212741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7db5320115a3bd49f8f8479e7984a89a7bc84b48ca025db41bd7991069876225
MD5 4e14ad6ae8304b21a8d1089a77a55461
SHA1 7ea8503eaa1ed8fb5a4cddd861bdf8e4c7c1904e
SHA512 4f4cc193eb25aaa229f57e0871f2b94f77f163f8b488897544afc7ca58e76eabb7631b7a8ab6a31ffb97bfcc63071530f7a97ac9227314ffedddb1f12f31d207
SSDEEP 192:GRZD32xllGMCv7+piPRpw3p9uHsb+WNnDrPv4eC2Bb7PaYoVyIsnAUgE:GRZDgO6iXUUwPPk2BbjapE
TLSH
T19152B72EA950797B5CCBD229F9267763E7F5102231902E44F6FC992C15E76CC311742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
MD5 04c2655e775a571e3b09dcdcd782d924
SHA1 84dda5dbd4088a2a3591384e8279d568339c383c
SHA512 38ea57f7244c49bbd8e846e3f0d5342b6c186f24c011ef661cc6a4f6836da0e0f816f76146075af79a69abcd50476432db60bf14c0daf6c81fe144ac588ce833
SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLuLcSjBsXODLi+ErU3ZSHG7Ep83wCv:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427p+
TLSH
T18C7208676C4C9E370F94D6C8D8267B4FADB5024B65DD886493FA982903D4BCF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 72450569e77751f04fc981c7c95323165fcd907266b6e6f80572fc62d51379b0
MD5 98dd6032ee6234cd6714161ce2f1ec85
SHA1 d20ff1fbb34ac25a798440791f1407e2d1d82814
SHA512 0c02921a5dc2ee639e421cb53cf6be73dc66531c095c228764c66a103b724b1fa4468efa21c4300a63fcd03d0053ac264ade5448721f539a470702523bec2fc0
TLSH
T1ADB0120180016211C45602F116921C9C71546F15D70A170143F07DA2D8251618024071
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b953.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59b953.TMP
Size 96B
SHA256 7c1c5021e6d31fb9df50af14f5e3903cc5b1afd8be1d921a9de847c2c261a41d
MD5 760b79976019c7e86ab2f758bd03dda9
SHA1 f28c9dc5eacbe9b66bf19ee9546e960e7dd509bf
SHA512 a16dc5d99d5364fa3950d1d6b73d9c27a8f79e34dc79fa920cf0ad3beae37b1f20489b8371b2f0772b1193f9a7534991fc563fc2355aa786a49976126689bb97
TLSH
T1CCB00259C3036712C44263B827D595DC71E0DF25C603221292E02BA7EC35A7245655F0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 07987f0bc108a8e592dcfedd1f6cbbbf146fb6f6cf3394917093b0ce3a79bffc
MD5 894d3c70677ea8309241340aad63b678
SHA1 9eb73ba503a498d7486eb00e3807505ec86929b7
SHA512 2f43092406e667187611150abd0383092ea1e71f18756ca41bf6a11c1e1b21e9650f44476b01bb23324ad2b15ce084c1395b51b7a8ba0edbfc786467324cdc3a
SSDEEP 3072:z8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:FwCcmXKegIh6jh9JvexhQ
TLSH
T120C3125928273DA688FD6EB3B40733828AE353A16C05F55E90C8DF0A45DEDB415EF8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 696259dd3a1598880070ae8f019c5f5929ea01712fc16d447d9999881a3b7be8
MD5 721470f7dd2d016e36c6646b3685afc7
SHA1 889a255d5ff3a8a63a8d68c7a475197235a6eb1a
SHA512 d5a27f12e725e22f7be32cd311c3d8d38f2512cb84fdf47f7464d8c6248ca7ff7ccdad962b49445e1edb2428efb2b062d8b2c72f0a293725a9ca5907740a961b
SSDEEP 3072:BXJ8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:VPwCcmXKegIh6jh9JvexhQ
TLSH
T11CC31259282B3DA68CFD7DB370473782869203A26C09F54EA4C8DF0A45DDDF915EB4B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 01c8e89dcdc8a4a1475225a3e9865aa7e8073dff6b29ecc1c3bb937d43277cc4
MD5 824261fb81aec8646fbaad357dd9b9a8
SHA1 fe58e97df95712f95f204542d590113a5f18e726
SHA512 22d5b426ea195f15ecdf8654edbbc24cdac0e14a74615e54cfe7cc37757fa4eb5f976cb5702d9c5bb6ded846d406f619dc02a28a742b7a25e494e6c033d50f61
SSDEEP 3072:Y8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:+wCcmXKegIh6jh9JvexhQ
TLSH
T1AEC3125928273DA688FD6EB3B40733828AE353A16C05F55E90C8DF0A45CEDB415EF8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fdebefb58bc757e4b06546780642046be7daa3bb2b45d1e0ff68d001bc6470ce
MD5 b27e702cf1d6ea090c3eca269f74f33d
SHA1 6e199e89a7cb24f2bf919cf9e015d1ee77116d9e
SHA512 56b32ee0043217f1208c37a1209f457f8d23d21eebba1290f23773266edbb849df74054fe116ee903ee2dda6b7401a52d37ec3f4c4e6df2e408b96cebe8e0cb9
SSDEEP 3072:pXJ8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:NPwCcmXKegIh6jh9JvexhQ
TLSH
T1E3C31259282B3DA68CFD7DB370473782869203A26C09F54EA4C8DF0A45DDDF915EB4B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b881d38004b5c5f4eabdcabe7e6d20ff343469362b8816dec52f054ef31d14d1
MD5 67c155486a527ac71f8e998be1422c73
SHA1 6cc78aa3b31a70b671ee7e55dbb9e9a83a6b403b
SHA512 c8518225d7135d110305e72f4d8694531d6d6c202aed8f17039b1a934f8aa534add662d988a7c945bf9b1f16981fdb0544517dd8e2bf2515a9f4b0b93f3f0a69
SSDEEP 3072:m8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:gwCcmXKegIh6jh9JvexhQ
TLSH
T191B3125A29273DA68CBC6EB37457338286A353A26C05F14E90CCDF0B45DDDB415EB8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_kxqpp02l.2al.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kxqpp02l.2al.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

db_12652001641137717806_places.sqlite

Path C:\Users\Admin\AppData\Local\Temp\db_12652001641137717806_places.sqlite
Size 5.0MB
SHA256 3a989d98bd6ec844e3902a506eb1e9f6d5f3d977b007a1e1f9a761fdda5a7539
MD5 30a84b959bda2885dd667ef21a68f63f
SHA1 566b60757067221ef78885c2c88e829aeb62a558
SHA512 e546fa01008db3fe4cca5aea6bf824dd78f3c59f0b755daade228fd157db339492911559abc491b19bbe828e1dc3ba8c607d9f259d57d08d46af64d903f07851
SSDEEP 96:D4k1e/wAaF8M9Te9kjQruHtZroSzPFRPRYoa5Af22iV7qIsFw2iwRI7c2xfXsZ8G:M8rJQaXoMXp0VW9FxWHirs5yT1EZm
TLSH
T1B536320F7A205150C4EAA132EDE31F1A1C3F7016863776933AA4556E4DE1B23B96DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db_17425812920865447825_places.sqlite-shm

Path C:\Users\Admin\AppData\Local\Temp\db_17425812920865447825_places.sqlite-shm
Size 32KB
SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
MD5 b7c14ec6110fa820ca6b65f5aec85911
SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA512 d8d75760f29b1e27ac9430bc4f4ffcec39f1590be5aef2bfb5a535850302e067c288ef59cf3b2c5751009a22a6957733f9f80fa18f2b0d33d90c068a3f08f3b0
SSDEEP 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

db_3822997755544692778_cookies.sqlite

Path C:\Users\Admin\AppData\Local\Temp\db_3822997755544692778_cookies.sqlite
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 1KB
SHA256 11c0ae0df544bf142b2d66ed8778ae3763e2fe49559de066b02b415c09c8eea8
MD5 9dc39bc48392100456c0ee518288b922
SHA1 f91c19f29e7792f0d8b2f90f86d35ea6714e3031
SHA512 8aec559f05652335b1d21c8f59a8874a2ea4333302d7e1a049d378811d09632b5ddb2adfdf556f039719cc6f9f9c4400c81f8cb92f211976bfb2c2e7ac6aae29
TLSH
T1C431842ADEFD18674DAA50EE9CBC1E8D5B1A324ABF244F427B268A0134E9705DD07006
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 2KB
SHA256 7b8eabd61611fc76ac86312f1871ad9d12c4ae2705aaf3c543bbdf6ca5270436
MD5 8038b9fd069393ba162ff61495643f89
SHA1 8a3a86ed433ccb8f93471f87a33ebe6e7a65ef30
SHA512 ad175340defdc6d3d0fe5725164eda6af55df18fd195449ca4ef7ef7372b4e821a6e8672aeee4c9581e081124cf017388e4a54a936b216d48599102ad63d01e7
TLSH
T10C510C2AEEFC19770DBA10ED9CAC1E9D5B1A324B7F204F457B2A8A0538F9701DD0700A
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 6KB
SHA256 31b8a32f400b8567d0d74f6bfa7310027e86b957b5b61b90f219c9616d8cfb87
MD5 e51a44ddd4c249f4e5269531a0eb313d
SHA1 9e3d52b1049f93a3aa1236347fb3c9f62a50c100
SHA512 e3f1c45f2c899882f7b511f49bbe01f41adc316dd5d5aa246165d0c93f7d8903aaa2a03872d8cf29317fceff250747a8f1c19fb762cd115f4b9d03e961e90f77
SSDEEP 96:oFh77rr/gE1fx44v94Tfbror5krctrDrXrXr5emwvmJm9sHvsHKsHbe/gElm/Z//:8afwpc8NgDElue70
TLSH
T1E9D18817EEFD196B0DEB50AEACAC4E8E5A15310B7F101F057F2AD9183AE97069C4B109
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jna9699361788935023114.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna9699361788935023114.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher_debug.log

Path C:\Users\Admin\AppData\Local\Temp\launcher_debug.log
Size 4KB
SHA256 c8094b049c92f72c3e2fddb68cbd2c073f0a494cce5695e9ce2b7a5ec8929581
MD5 8398447a7492209447f82fe8c5505bf4
SHA1 da04a02ada00242a591de3d5f92abb792228aeb0
SHA512 7e5648b8ac83504e61c1287a75a909a56afe66b668742f5cba6ed72d1ae21c7d8249a34ad1722d2f93de8700d1a5a23ba4d2f5d0b0b5c86af5e03e9232d28905
SSDEEP 96:K/GFkGnUdF4ofuvC6Aug1utWSmWtwm4LofgqzRme47/w/OSZVBnfs:h3A/XjinVS
TLSH
T1B7910784DED5C91A0CD319AF967D9BABAC69340B6B6E3760BF31C819205E40D7C9F00D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher_debug.log

Path C:\Users\Admin\AppData\Local\Temp\launcher_debug.log
Size 1KB
SHA256 08ed2dae8a026cf9455f83b844753f98ea21f0fc8871bb68569de8c40334487c
MD5 ad51b2496f006795736706395cbeaf9f
SHA1 308e9a4095b9fcf924361a415a2cc10a66861667
SHA512 643f216a52131aeeaf658c207f9983328286b89e3efb62a85942642e286b8baf607d6d74234497c3f1e333d6d98c6892a30e1e8869966a79736db66c9b1af4b4
TLSH
T12231D644EEE5852B0CA756EB9A3D9BA69C6C355F25EE3B217F20C84A244900D3DA740D
MD5 SHA1 SHA512 TLSH

Submit Download

launcher_debug.log

Path C:\Users\Admin\AppData\Local\Temp\launcher_debug.log
Size 2KB
SHA256 da3858a07ea3ab1de1062d9cd8d14e7a91c6d8e7c60005ca1290f585c8cb1982
MD5 64723521837084d8ec02775aee438717
SHA1 4132a505c1547bf7abb49221ca7659399562176a
SHA512 9c458c851f976791b9c1937adbd5ed087d525f25b773ad324fe67d476645b4a199114f22041949c29cabf639ce64f0c48f75d9d894ce782a52700630f0913f11
TLSH
T12A41F844EEE5852B0C9315EB963D9BAA9C7C390F66BE3770BF30C80A244900D7DA750D
MD5 SHA1 SHA512 TLSH

Submit Download

data.7z

Path C:\Users\Admin\AppData\Local\emre\data.7z
Size 39.6MB
SHA256 bffdd19540ba38688802d8f77552142a0a9d0588d2f0b85a438f01380af590af
MD5 561c8167ad7ba7bf1cb1bac5aa622433
SHA1 17cc5d210f06bfdc67e566e7a893ccb1f39cb63e
SHA512 7fd65fe974aafebe5a66fb4c8828c0ab389d6ae65c68db0cf09b63da0410fae0760d8f49dce3ca537e67142bf69cd47b96d4db2ae13a903085815d33c0061ab0
SSDEEP 786432:gtUXd5eyi2IMX0blPhvS2KjuBIy4v6DAQznxjQLpQcIZfVtIzdv+mBSx4yB0:gKXd5o2HO8Z1jxQLxmpQcQfVtwsmyB0
TLSH
T13997331A536E920813B5B764D7B89AF7B606F86B407EE6CF3138046D36646F1CB84237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_helper.exe

Path C:\Users\Admin\AppData\Local\emre\data_helper.exe
Size 1.2MB
SHA256 b0cfdeaf429f5cc53f85123dd8f5a5feb92c19d31aa34df257edf9a26be05f95
MD5 b7b7473472c9806bee3e7ae6c1adda23
SHA1 2dc03597a0d9c7ff97250f90d47bdeaf9b5753e7
SHA512 544949f1213817599fdb09dbb9834aeeb370b3f6225c3d835a29797b006bd36aa37b8a246a22204277f40d3865a01bc8d029a531d17d6bb43d9ddd3db7370580
SSDEEP 24576:zXWmPnP3K4fhiFvAEV0R9TzPeHLSoU1Ja:zXWUny2hiFmR9erSoU1
TLSH
T110452A56F6788375D073C0B9C5D2AB9AEE72308517308ACB1246876D3F17BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

emre.jar

Path C:\Users\Admin\AppData\Local\emre\emre.jar
Size 10.4MB
SHA256 0f15b827022d6110ab3b3e590cb2d71af110265f14e12c33d8fd027e6bc106ae
MD5 d6f93d7663ba52ebe2cab445718511c1
SHA1 40cf5b4719da54401fa47c62863cb897955dab17
SHA512 88191669a1a94e325ed82c5e8c8cda8028fbfbd086b5493b507fc3a28d492b640f68c21db1b29eebe8e916843da3a136f3d32b12877ea6602d5018ea17da5af4
SSDEEP 196608:TnXXlvg1f6tFuBAjnnZ3sN1TE6GIrYKdMrAUjitkcaf8NthOxHaT:TYf6synqN9GIJCrAUjwkcaf8JCaT
TLSH
T117B60217E819B426D95B63B250CB4BF1E43E13D0E80B906E5BF40EC2EB934DA5B1276D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jre.zip

Path C:\Users\Admin\AppData\Local\emre\jre.zip
Size 30.1MB
SHA256 84592c688d99a2849f2320872a6d91f3e92fd0dcce09b0c55b8ea336919149cd
MD5 ca75006879450f67899008b80e852872
SHA1 91993ce427911ec35a82c23c662b0482156a21e0
SHA512 54efd1232d7a9349d1801342eb5122dfe9d6be8d2dcfa1c75ba028bf2871963d1f2b8539453d91c12fa9f5c7f034b2be0fc646a77fc9084ae4c58c2c683751bc
SSDEEP 786432:0y7+qDFpJim/2Qj18dQk3GcBhAQiJ6R/xGjmvQlqgpLTQg9:0ieQjCdQCGcBCaR/xjv233
TLSH
T1E667335CC92ED9CAB223F13890A6D3C800C55CBB96D14E3CFB2191C92F9E1CD65A6D8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\java.dll
Size 121KB
SHA256 c23149eed11d1afb4111d88ff35cf97e72f5212ad54930a8d2f976c6bca4898e
MD5 c26f2b433814e03537fb819a0ec2a60a
SHA1 86793ed280ff5aeb258869b423e85e3a28554d13
SHA512 8abafde93cf2a338a6b30157093c09f4039cb2ad9aed5d6ec67611ddd20f5e6f1853b85ef8344eb90b4a74f6c54b71c4ce1d58395632b697e1d5b4c1c748d358
SSDEEP 3072:xNHgEZEjjMHopM28G6nR5n4xNb92SD8yNG3QxNRDrMxOOVRZV05:x2EZE8Ho4z54zJ9DzyxOOJV05
TLSH
T1EDC35B0BE6A54082F42AB5BCC413590ED77174720191E34F436AD68E9FEF7313D1ABA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Local\emre\jre\bin\java.exe
Size 53KB
SHA256 8c6d49b508d222cda1e3765e66c74905dffa3312db4044a43547e5196a2e94c4
MD5 fe458c4412b42bad20f0814ce63db2ca
SHA1 eaf6d309674c0d60d8acc21882babdc740f8d510
SHA512 477b9f7169a4e83767d9a9d2347eeee08a97a0b57100873f523e209becd0bc610d5d3d9226b27382de9186a37c6e3996fbbdfafeb52eacb757d4c7f2b5552b2d
SSDEEP 768:OtZsFBLAuDeGJiqrmehiVSrmaBP39VGq5pYi1VWHZ5ALu:0L7qjh3rmKPNQq5p71VG
TLSH
T1A03319B2F104A885DA0BC9B3D86DDC3164F23DED99E0464E22F9712959B33D2109AE5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Local\emre\jre\bin\javaw.exe
Size 53KB
SHA256 2e40eb710dc9d8ae06e15d11331fcde819569654ca68c3866f6aedc1807ba804
MD5 7e1d812ef17e61705768826e0527a5b6
SHA1 44ae57ae86559b8e990aa7b3da047cd966bb4985
SHA512 1b85b750a9784054feba6bf2d6a4cce90a04b1b7ff600b7f64152f7e2b078af37af1fb19a250639efbe1c41f94614cfd44fe0241cff8cb11cc1cccb0711a4fc8
SSDEEP 768:vHcN826LAuDeGJiqrmehiVSrmaBP39V3u5nYi1VAH5AL0:vcNl7qjh3rmKPNtu5n71VM
TLSH
T1993329B2F104A885CA0BC9B3D86EDC31A4F23DED99E0455E22F9712959F33D21099D9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\jimage.dll
Size 33KB
SHA256 38dea48088997cfee5526ed306f6219cc6b56c3cb22ad7546e66f7d474d6bde1
MD5 b24cb49793d0cd1e65897e34538c59e8
SHA1 4e290a2e8e79fff7b8f085b21aed422d93587426
SHA512 fb0377949125e32c0e650a58ca3613b81de64a17aefb1a8cd691697d63430f5b196fbd42ad4a572a585a8e8bcc3b3661023471eef63b89da5b859fcf7216148b
SSDEEP 768:SpClA+BttulzrYnzvhaY3Yi1VkLd5AL+H:b8zy5aY371VC
TLSH
T1A0F28D56E7945855E967D938C8979A2BE6F1FA514F90C3CF2320825E0F333803E6D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\jli.dll
Size 90KB
SHA256 0ef29bb01299efc5250193a9d7fc8aed0a28a7e942105ca52a6d94abd0bd9d24
MD5 dd8460da262e664bdbe1d89bd3d03644
SHA1 fde9374cdf75f265d48f60a39116295a03ea0025
SHA512 5962af9f6903d313ba43838d5cb98babe28e9d10a509c1fbedeb3f20de32b4fc14fa50a3aa12efec67ba724825434ce52caa57459eb6311704a385a051328a14
SSDEEP 1536:TWQqhv62L0Z0Djhz6DVVdI0YWIO9wwT5/K56tFtwxG1u71V6:Rqhv90Z0pYVHX9wwT5/K56tFqxG1uZV6
TLSH
T192939E4A53D021E0DDB699B9DDB1561FD3F1B0962721838F0368819A0F73B223E1DBE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\msvcp140.dll
Size 562KB
SHA256 b99eb28a471311113f5c4109cb3c463f39cfd9bdb3b07f706204dedddb4516a1
MD5 7acbc57d268a691247b4a94fecfa42b4
SHA1 67bd76111b4ab8f4c0692919153dde2e7c8070f1
SHA512 b08140ce86ea78b481b78644f086359326616a56fb3a3953da16a7fc2bd15a493652f22d4d2fcba3675c668b9832fdb7d5f17a8aa6ccdb74e7b746a79df60b88
SSDEEP 12288:O9zqgpPAgLqMpP85TAfvULhNaYv0nJxgQEKZm+jWodEEVhEU9:O4wPrALhAYvogQEKZm+jWodEE7p
TLSH
T139C41923B74905E0E195E3B891878306D7F1BC4A8312A3C792EBD69D2F677D1673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\net.dll
Size 59KB
SHA256 050df83f9dac281595e0cbea9f68721d3d363a34bf28ac150706ca4400aba42a
MD5 de3e8d001d6ccf7a753fe7617871e4b3
SHA1 cfe77d08ff100819f6abc773b7c2b2f9be754fb6
SHA512 4883487c3367b56885bb20343d45d2ffbb5e3976b970769ababb1f1debf1a10403e0b30ee95c4f48302c1ec2487496ffb7588ee78c0bed09feab0c742f887465
SSDEEP 1536:/K9xRTQvuv55er8BsWAcqqXqEVUEg71Vhgz:yHHezWvkKUEgZVhgz
TLSH
T11A434B1297E41480E827C978C963151FDAB1B860629087CF83BAC65EAFF37716F19792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\nio.dll
Size 79KB
SHA256 7d73eae689125688dc7619e01cec28c9eec44cee71c18726aed087fa99ab31de
MD5 44e75fd53f0eed7cf4431745eee95062
SHA1 cdc9ab401b8acadd60adb93aee002e92f1892f2a
SHA512 025aebd1f5fa1ffc9a56c870cfa01d01147c2782abf8a66c4247fcdcb438d1ff4dce01ba9a68be2d200cc34768dc39a1e1bf94adca560c5f03be811fb8fddda6
SSDEEP 1536:yifr6nnXJvMNZo44m/FMFPAmxRSpi3MWr71VE:yLxMNiEJIRSpi3/rZVE
TLSH
T1CA832AA253B4889BD87A7138865B535AF372BC104510974F5328CB6AAF2F2733D3D792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\server\jvm.dll
Size 12.8MB
SHA256 58bc68a22238a118b8bc7f067a83401e83a49fe1fc7df05f04434e2da029b73b
MD5 7ee54d95dafdc596d7e3b9631b9a495c
SHA1 5e8d643dfc26341753f16d175c734907b64c090e
SHA512 c758c4eca447ef3655d02e16bcf82366a4eac6f8291384b60daf927bd436e421f6639db87c2388acb73725fe58ce23a4dcb7073e5bf3763ac37c20b4df730427
SSDEEP 393216:3CYef4bLxMZJ8jJ9pnefiTn9nDkGM+tiIRCPp80hSGZhXr4sI8NHJvEIONPoPq1H:ZUo
TLSH
T1D6D67C17A7A550D1C12BC179CA678E0BC7F2B5988331D7DB51A01AAE6F23BE1593F320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\vcruntime140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\vcruntime140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Local\emre\jre\bin\zip.dll
Size 87KB
SHA256 03758468915b3c771c365c18d87b8f44f49523a978ea248a19df9225726b5641
MD5 1984348d56036975e90c87af8fd8b193
SHA1 d6020e45dfda962ec5fad130b740104ec9de1159
SHA512 f32778896ef16c74b0d0511aadfcf0e6424b2e4619a5a0c8ef40cc9300b8dea12ab7de3aa71d56a18d3dc966e9ca14dc04ddd8a1e2e3710e9a74b1718346190b
SSDEEP 1536:dYY8ylqFqo0CWuKqhdIOQIOhWi6+71Vix:dYYx4FqRfurXGhWi6+ZVK
TLSH
T17F939C5199A05294DEF795B0C9F24A3ED3BAB04116E0578BA35C839A2F533612F4C3FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\emre\jre\legal\java.logging\COPYRIGHT
Size 35B
SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
MD5 4586c3797f538d41b7b2e30e8afebbc9
SHA1 3419ebac878fa53a9f0ff1617045ddaafb43dce0
SHA512 f2c722ae80d2c0dcdb30a6993864eb90b85be5311261012d4585c6595579582d1b37323613f5417d189adcd096fa948e0378c1e6c59761bf94d65c0a5c2f2fd3
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\emre\jre\legal\java.logging\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Local\emre\jre\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

modules

Path C:\Users\Admin\AppData\Local\emre\jre\lib\modules
Size 22.2MB
SHA256 791d73ababff2952861a7b06bdfccabf484b6fa04fe545159ffa25d3d5f7ac3c
MD5 22120c0f4bcc34892300ad87f81edb27
SHA1 317732c95861ea5d2e5e144775f199d402b80b2d
SHA512 c2b4f5ec3a59c6d93dcb370b4076fefb8262afcb19fc391314fe704499c95fdd92507d2e91523d9257c3db0e55ac21d319ec62285477d85ea9a9cbdf48eff6c1
SSDEEP 393216:ACxijWX1OWNA3abaGDrWtldLI5f0Vou1AYLw/r6Vbbu3tZO:AjyYIAy5Dr+l7x1AYOG5u3+
TLSH
T12B37224DB8C18B50D99A99F78562A6D1673094C0FE89438F2185362E3CBB953CB3F5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Local\emre\jre\lib\tzdb.dat
Size 100KB
SHA256 7be2a3adf10ff841579629f7725b15f0db41e8856527ec72847b5477073a3d29
MD5 4eb7143fa50aa5537eb0644f468bf695
SHA1 57ce5168a4c09b20b2505ba25ee4e80a875cb203
SHA512 1eb614f1d1bb5be7a2a56e0a8e16acb1853b9110aef8252f3f5b222e7feb9f7639350e61121e17a46640e43ff7e114143e4abbe2e99a9eea297e21d3823886e3
SSDEEP 1536:n0ExeF8dhPdr92L674jAGubVj0Lg/////UzJbPdJPNL0mIT/M4a3jyxU:nPeqdhPdrcWzbVj0hJzdxuT/6ToU
TLSH
T190A3C3B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Local\emre\jre\lib\tzmappings
Size 21KB
SHA256 b41575b332809b37ad423bdca30c7c48cdef3d82f82fa9d534781a6f15d6a2ab
MD5 4c30d7867505379a18a27d0e8f03198c
SHA1 0cc871d5bd91e061d676a861749af68bbc0ca9c6
SHA512 873d329682ce67267f438b88eee0fc25cecbbcc1f7d694118417ad12756ec2b6ae7502ec4eea0cc9b4ae8b9e68f5f8877762fa13dea89c4a6dcd54fd8bf82c56
SSDEEP 192:3nqW46ARn1+RQ7wbNQQSaapvQZglEcCDqvOCJqGic3yzA6bbAdOFmYXKhJmBW:3nqW46ARnGQqN2KhcQ+qAa9W
TLSH
T1CDA25386B06662D4C073EC0D7B527AD3F886F3C899C69A4D2943C366BD019B767E1837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\panmenagamebetatest\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\panmenagamebetatest\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 fe28a7bd6957c3f54be0bc2148939908eb84790e3c50f12d169958d36f6c3a93
MD5 d9f059554cb186dfb6430ad14dd4d67c
SHA1 e0aa838c5cb40f2033f1199311e6146fb23a9988
SHA512 9c13dd8c35af0f61ed74c01aea7af3afec08e2e84929ecc541a63e37f0d8c3700997ba5fc5e71ca2d33fc0d37f8f2d548a14d24d85bae972a2fd7428ddadd238
MD5 SHA1 SHA512

Submit Download

DIPS

Path C:\Users\Admin\AppData\Roaming\panmenagamebetatest\DIPS
Size 36KB
SHA256 8673aabf07ee1bbacfda8c21d8426bccacabe068f7e3ed15c8265eb3170f4b43
MD5 3cebe6889cf5ab71ae28fa537244f5cb
SHA1 a1bb9f0d58bb20d7308183328a4c43273889407a
SHA512 9c4e93eb9adde264b9d75c163b200bf0499a6df3c2a500e76fe994fd57de0f19927728aabd451cdde3c2fcd4767c4cb74fed087fb2066f6b0ec582f1fb3d16b4
SSDEEP 48:TTQq3qhmr/O43vY+uIW9WjWbfl4pwU1aB:lEmrm43vnuIW9WjWbflf
TLSH
T1F1F2108B8F293C22D0CBC63686C14AEB0F79071CE3576EA865E414911ED1A8481BA0FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\panmenagamebetatest\Local State
Size 490B
SHA256 f2a8be4b7bc51d09a4fa55d78ecb39133d000afabc1597f166b1c2a8d3254f1d
MD5 d9f48039d7d244b5af1e82675e33c6be
SHA1 514713228575010bdc0450077c939540dc9f1e11
SHA512 2d5d14e0d585cb768f26f7d1652c1e49e6f5a66a8f5729bf61afe0f27389697df95de2706782278e79b00a2ebf8d0d0a50a991244eba781f9ee21d69086f019e
TLSH
T162F0D4F678D25A756B5D8B6C416B63170C2425AB4D021F00F68F2203479A8DD530BD77
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Roaming\panmenagamebetatest\Local Storage\leveldb\000003.log
Size 30B
SHA256 8bd2ea70a0b70c91de138a5b87c7936c6a6fa7c4275c54b97f4ef0ccc5b79bb4
MD5 7e957d693bbab6ad7dec1d3aa28bd69b
SHA1 50369f74c280d83046d6b779ecbde129b8ac3b98
SHA512 0228357b6c4b73f3ef20a333b7afe71fb589efe438bc28a3e04df3fb64f367b7b463dc9c9792921c531124b7bde600524827b40f2cc5aeddbc1df8b3ed822cbf
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\panmenagamebetatest\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\panmenagamebetatest\Local Storage\leveldb\LOG
Size 269B
SHA256 384d9184b2f287d41282b668e9944d68d03f3eeb532b9664ed44b71e32ff9309
MD5 74cc27fd05ce1e894e9742509b6a31af
SHA1 a3a41cfb908de26576ed58727fbab0381364c76d
SHA512 bf2c74c6d8057137d0a3e588c6166899643d0a6ebe98a5c019f791b8de1ebcbe49026bdcd4b1fa0164f118922f6753b76d0394ba5294c97c1c366d05cd781c85
TLSH
T17DD0CDB005EA854F5D5485D7E1357325CB787044699D270C4D51DC9834D5088F5560C3
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\panmenagamebetatest\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\panmenagamebetatest\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Roaming\panmenagamebetatest\Network\Trust Tokens
Size 36KB
SHA256 8b5a62a399e316009e0c0ee1727ede327893d7f82f38a136e795422b3f9c333c
MD5 a0f27d9946f49134d0d23e62d1882541
SHA1 9a39769dd453efb04c526dff62a7c7770b3a3d13
SHA512 392ed08a0cddd45589041820792d951658fe0c1ba0b00dc57e88a97ebb6f579c10e92109cff7126cdc62c34f00b9b82f3a85d0dd96b797cb0cd5c56f37030af5
SSDEEP 24:TLY3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T031DtX5nDOvyKDhU1cSB
TLSH
T188F2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\panmenagamebetatest\Preferences
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\panmenagamebetatest\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 b2d2c7915c4bfb6b77d6e2416ff9e120f60e78a4fdbeedd2078eab451b60b4d7
MD5 4549ce17327053db904254dc2b052408
SHA1 b8c1517f11f9a79ed97a04b697bf04e29c9cf58d
SHA512 4e4b8a33016b5e4e6fb95a7aff776cb98077b158876de88c1ad6f33cdc98b788f110dc37c7eb1c0f2a3d1a496b837417564842689c3006bbd8a4b77d3f90cd75
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\panmenagamebetatest\Shared Dictionary\db
Size 44KB
SHA256 fbb86c665b2fed35c372ce8996eb1c4e31082aedd6ad5fc6086cfac889c3471b
MD5 3dbd7f6297feb0b5b14541072081233b
SHA1 d48400e771c013867225e49e3a6d5a6d917d3be8
SHA512 51fcad55e0aed1cf9e95e14444e4c0bb20095afc406a290105dda2aaacb6cbeba7efa29e83d89bbccdc3c07ef67421a79da9e259e6727abb9e516e79416cae66
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:TROIy4m1b3fbUdeqSB
TLSH
T18913BB0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2216-642-0x0000022584090000-0x00000225840A0000-memory.dmp

Download

memory/3292-362-0x000001A07ADC0000-0x000001A07C639000-memory.dmp

Download

memory/4232-147-0x000001C4FAFA0000-0x000001C4FAFC2000-memory.dmp

Download

memory/4232-154-0x000001C4FB040000-0x000001C4FB05C000-memory.dmp

Download

memory/4232-155-0x000001C4FB060000-0x000001C4FB113000-memory.dmp

Download

memory/4232-156-0x000001C4FB120000-0x000001C4FB12A000-memory.dmp

Download

memory/4232-157-0x000001C4FB120000-0x000001C4FB132000-memory.dmp

Download

memory/4232-158-0x000001C4FB040000-0x000001C4FB04A000-memory.dmp

Download

memory/4636-133-0x0000022D71BF0000-0x0000022D73469000-memory.dmp

Download