bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vlc.exe
Size 1021KB
Sample260822-pekddayvbz
SHA256 bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389
MD5 f0a4d5c3492115bfe2f346bc7bdce396
SHA1 bfcbdc7d0cbb92b68d348090fe9f381b4358a587
SHA512 8e4b2e1852fbc821cab4a7c16675afbfa2588472faa1848600829c415bfbee7cbf4713568ba15a76916e6c761d79b0fff7c5a1ae087aabd912bb7063d38a560a
SSDEEP 24576:uGKuKkPztKt9cHPrLRAqKBAy1N1UGAmnnnFnnnZnnnGnnnsddodt:uGKuKkPzgt9cHTLRAqK81k8
TLSH
T1A9254B1BE7A345EDC56FC13487A7C772AA30B86942347E2E1D95DB221F10E609F2E724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery persistence spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002

Accesses Microsoft Outlook profiles 1 TTPs 47 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	vlc.exe
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	vlc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\svusfgctzkqgdb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlc.exe\""	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\svusfgctzkqgdb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\vlc.exe\""	vlc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
256	chrome.exe
5892	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
5808	vlc.exe
5808	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3340	vlc.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3340	vlc.exe
Token: SeShutdownPrivilege	2712	chrome.exe
Token: SeCreatePagefilePrivilege	2712	chrome.exe
Token: SeDebugPrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	2712	chrome.exe
Token: SeCreatePagefilePrivilege	2712	chrome.exe
Token: SeDebugPrivilege	5808	vlc.exe
Token: SeShutdownPrivilege	2620	chrome.exe
Token: SeCreatePagefilePrivilege	2620	chrome.exe
Token: SeDebugPrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	2620	chrome.exe
Token: SeCreatePagefilePrivilege	2620	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2712	chrome.exe
2712	chrome.exe
2620	chrome.exe
2620	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 2712	3340	vlc.exe	92
PID 2712 wrote to memory of 1112	2712	chrome.exe	93
PID 2712 wrote to memory of 348	2712	chrome.exe	94
PID 2712 wrote to memory of 256	2712	chrome.exe	95
PID 2712 wrote to memory of 5400	2712	chrome.exe	96
PID 2712 wrote to memory of 716	2712	chrome.exe	97
PID 2712 wrote to memory of 5160	2712	chrome.exe	98
PID 2712 wrote to memory of 1340	2712	chrome.exe	99
PID 2712 wrote to memory of 2168	2712	chrome.exe	100
PID 2712 wrote to memory of 4688	2712	chrome.exe	101
PID 2712 wrote to memory of 3320	2712	chrome.exe	102
PID 2712 wrote to memory of 2700	2712	chrome.exe	103
PID 3340 wrote to memory of 3320	3340	vlc.exe	102
PID 3340 wrote to memory of 3320	3340	vlc.exe	102
PID 5808 wrote to memory of 2620	5808	vlc.exe	105
PID 2620 wrote to memory of 5836	2620	chrome.exe	106
PID 2620 wrote to memory of 4504	2620	chrome.exe	107
PID 2620 wrote to memory of 5892	2620	chrome.exe	108
PID 2620 wrote to memory of 2916	2620	chrome.exe	109
PID 2620 wrote to memory of 248	2620	chrome.exe	110
PID 2620 wrote to memory of 4412	2620	chrome.exe	111
PID 2620 wrote to memory of 2592	2620	chrome.exe	112
PID 2620 wrote to memory of 2660	2620	chrome.exe	113
PID 2620 wrote to memory of 5860	2620	chrome.exe	114
PID 2620 wrote to memory of 3912	2620	chrome.exe	115
PID 2620 wrote to memory of 3888	2620	chrome.exe	116
PID 5808 wrote to memory of 4504	5808	vlc.exe	107
PID 5808 wrote to memory of 4504	5808	vlc.exe	107

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vlc.exe

C:\Users\Admin\AppData\Local\Temp\vlc.exe
"C:\Users\Admin\AppData\Local\Temp\vlc.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zauefplt.bef"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\zauefplt.bef /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\zauefplt.bef --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffdeae6c728,0x7ffdeae6c734,0x7ffdeae6c740
    3⤵
    PID:1112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zauefplt.bef" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,9699544744113613697,10494881132154797430,262144 --field-trial-handle=1892,i,8232512984677246487,7904158161696013786,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
    3⤵
    PID:348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zauefplt.bef" --force-high-res-timeticks=disabled --metrics-shmem-handle=1976,i,3265431173637086691,198702720381867214,524288 --field-trial-handle=1892,i,8232512984677246487,7904158161696013786,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:11
    3⤵
    - System Time Discovery
    PID:256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zauefplt.bef" --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,9181562959037365307,3465026307804189304,524288 --field-trial-handle=1892,i,8232512984677246487,7904158161696013786,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:13
    3⤵
    PID:5400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zauefplt.bef" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2868,i,14853262413139753862,7279355159887046085,2097152 --field-trial-handle=1892,i,8232512984677246487,7904158161696013786,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
    3⤵
    PID:716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zauefplt.bef" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2872,i,2687252116232798220,4688065729240344433,2097152 --field-trial-handle=1892,i,8232512984677246487,7904158161696013786,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:1
    3⤵
    PID:5160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zauefplt.bef" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3052,i,14713513642253146374,5314297837805688937,2097152 --field-trial-handle=1892,i,8232512984677246487,7904158161696013786,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:1
    3⤵
    PID:1340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zauefplt.bef" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3084,i,8127073933621965080,6928636703660450420,2097152 --field-trial-handle=1892,i,8232512984677246487,7904158161696013786,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:9
    3⤵
    PID:2168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zauefplt.bef" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3868,i,11750374953120620278,10650121003506586583,2097152 --field-trial-handle=1892,i,8232512984677246487,7904158161696013786,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:9
    3⤵
    PID:4688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zauefplt.bef" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4032,i,5533783809550659071,9641561420625189456,2097152 --field-trial-handle=1892,i,8232512984677246487,7904158161696013786,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zauefplt.bef" --force-high-res-timeticks=disabled --metrics-shmem-handle=4344,i,7091762366886007286,9959194261932063818,524288 --field-trial-handle=1892,i,8232512984677246487,7904158161696013786,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
    3⤵
    PID:2700

C:\Users\Admin\AppData\Local\Temp\vlc.exe
"C:\Users\Admin\AppData\Local\Temp\vlc.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tkwmts2w.iow"
  2⤵
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tkwmts2w.iow /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tkwmts2w.iow\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\tkwmts2w.iow --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x114,0x138,0x7ffdeae6c728,0x7ffdeae6c734,0x7ffdeae6c740
    3⤵
    PID:5836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tkwmts2w.iow" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,13072735956871813796,4439454147073259857,262144 --field-trial-handle=2064,i,10034978324584774056,2816383712835533008,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tkwmts2w.iow" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1816,i,17560420645347306135,10354001782748938400,524288 --field-trial-handle=2064,i,10034978324584774056,2816383712835533008,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tkwmts2w.iow" --force-high-res-timeticks=disabled --metrics-shmem-handle=2112,i,106874110725421264,5109223399959648810,524288 --field-trial-handle=2064,i,10034978324584774056,2816383712835533008,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:13
    3⤵
    PID:2916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tkwmts2w.iow" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2996,i,12116586842908321419,18311500546599719220,2097152 --field-trial-handle=2064,i,10034978324584774056,2816383712835533008,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:1
    3⤵
    PID:248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tkwmts2w.iow" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3012,i,3306112551789387403,1179627594846011188,2097152 --field-trial-handle=2064,i,10034978324584774056,2816383712835533008,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:1
    3⤵
    PID:4412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tkwmts2w.iow" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3188,i,13678878079268143420,11102689586125261809,2097152 --field-trial-handle=2064,i,10034978324584774056,2816383712835533008,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:2592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tkwmts2w.iow" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3204,i,9664064769767701352,2908582468922766575,2097152 --field-trial-handle=2064,i,10034978324584774056,2816383712835533008,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:9
    3⤵
    PID:2660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tkwmts2w.iow" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3764,i,12328981342233503990,17204693781609037480,2097152 --field-trial-handle=2064,i,10034978324584774056,2816383712835533008,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:9
    3⤵
    PID:5860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tkwmts2w.iow" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4200,i,9434847526825654454,6019274364362417863,2097152 --field-trial-handle=2064,i,10034978324584774056,2816383712835533008,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
    3⤵
    PID:3912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tkwmts2w.iow" --force-high-res-timeticks=disabled --metrics-shmem-handle=4328,i,12926333006148713946,4210129695423041010,524288 --field-trial-handle=2064,i,10034978324584774056,2816383712835533008,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
    3⤵
    PID:3888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 40B
SHA256 f726397df5f0ed71884b5352b37dd4272c4097e8f96c84809c8babfa92506daf
MD5 ccac76c22419b18eca859f8412d5d31c
SHA1 315a53b44931bb46d1e66306100e4efeaaf74ae1
SHA512 b6bbc6ca60be273e0fa22d34f2e65b06742df3ac8c03b26d35406025f8a016e42ffff7f056775f493360d0edd8ce3005342952cc5819eab2b12d60805596ad03
MD5 SHA1 SHA512

Submit Download

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 8B
SHA256 6b2b31b0ed6b61f962bf026592372e6b76f80d97bd7543026ec9792dd5a2d82c
MD5 b0ef16404912d0c458fd3e6f7eea2a24
SHA1 7949c5fd74561df6ce849de04d10e15d905b7ee2
SHA512 714f3386f857d16274f4b156821d193034fb8bfe176b91b3ac8f5dccc018e3400d9017f7ad7e12c9ebefe87eb7d52ec0bdf7b189bc987f98470bb1d0de152861
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Crashpad\settings.dat
Size 40B
SHA256 b9e30a30d6e49dae787a995f9f4ac69c667685b10963655ea4f4da397c82be75
MD5 cc0c80be88eb6f8c788cd00e73709eb3
SHA1 1c117cdd2009d1922ebdefe1ade5595268b8dfaa
SHA512 60453a02369e0c6af1f0ebed2aae17532f314c53c74a270e91a43918e08ba4dacdeb22f31bee637cfb26becc0b1ce3daff32a2a0dcc50fd1d5021cd3c5f9eff1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 20c29152eb2fdd6d2fb74e14100cdc9de40b69dae232551f5a90677662827a8b
MD5 03668ffd254bd7f80a9b2500b4f36adc
SHA1 7d6f71d7012a05ef27b426ae5f2bbe423715ed85
SHA512 6dabf7cc1980ab3cd2facabbbb0978e5a9da647565a2c602c4fd78f8bfd8a6fd6528f613d59cbd4a5a84262a0ad06e92ae5aab3edec324cccc82b0b30f5fe1c6
SSDEEP 12:d7XnKTKK/1NQDITKK/3Am8gYDJOekEEQCYr/6OPWK:d7al/1WDIl/3Yd9O7EEZYr/6OP
TLSH
T1F1135E3C8A40CE73D39024BC5A8A2FB373F044049B21C20B04A438246D0DF8F400F140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 aa8cc792caa7cc96d2da406da33aa615225d1040aad8626d9c0b707a4f9d1948
MD5 d69c6bb53ee310bcacf2e969eefb38e5
SHA1 f467c7c70a1d2a7652d4713802f95d314a7de746
SHA512 778c45838f83cffcee07f8f4e0e809918d92bf568c658e3c710e964b5bd476054fe94e072237fc1acb052b2d8beb9dfdb21ecb319c2b0a3306ae31955133e2cf
SSDEEP 48:dldYpvbP3zlblQL5HAM1XgmQ/7XoHt8MmXsdVEPLVBKWwtl:napzhblQ6ugDrC8jKVOLHKWol
TLSH
T19C44C9F72D04CAD6EB14CBF45C41A23CDE3256162DABFD79F17504B201509EB32286B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 aa6f4c2e9bac0c086ec4b1d9b69df904d79969a765bfa3d4d8060f1222873cd4
MD5 f60c05bb1a89216a8a9f108ac0b6144f
SHA1 ac15e5af97a632a0e9adadfa87b138009239f4b1
SHA512 27b617b057bf110f450a0ef50d26f82577b72d57aa1389b3c18ae3b2eb540a7e3c2a013783406cef095df1b1f6df26e41769c30ba4fb4d1251c788d7a2ae65ca
SSDEEP 768:qUfDPLSgcRUv+u4bUfDPLSgcRUv+N4FfDPLSgcRUv+E4WUfDPLSgcRUv+O4e7vgW:Nm6YUfKVzd5fKCfK
TLSH
T1F3164BB64F24B546E689EF70BBC9DD1C2CB033A5AC92AC92E12342794AF1FC51BC115D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 60185061a584e57f43491e4a4457efd1f8f780a6035d007caf8b14c0bab349ca
MD5 7cca27829d8bece66749c8b1d20274de
SHA1 6bd8d4538ff0581acd0402f44bbd9de9570e3c70
SHA512 4cdf6a6a55b1d1847a3d7174f4047345991976f2f423fdd719b6b828e8a52a53394b7e6e500ade40a386a3045d8e01dceb158c060d089a1e2ed38e2bd70480bc
SSDEEP 768:QrzjkBEQ40qHSbVk3jEh84a7Ck9v6e83SiDb0mfNXhXrNpUPytqdRxPU9Vx7g/6r:S3kBELn7Ia7bbsbxluCqXFqxEC
TLSH
T1E703F198D52BE1F19EC196B9038C5BA7DD22320863B5C4260E6F63233DA7051177BABC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Cache\Cache_Data\f_000002
Size 72KB
SHA256 0df3c4f39d3f7f318e5e9c31c07d7ff54b52d551ac30ab1c709743167f53a64b
MD5 718bfb329979c646da12fa79376bae76
SHA1 28dacce140caaad9a8492766e18ed92b0c93d2c2
SHA512 cb670c914b72c530362c7df9c2eb5b77bdbbe3c6d10f089be55a01e7534b21042203eff4edf3780b3369942a371aaeb317adb6dc34783dad39fc8f7a681433b5
SSDEEP 1536:GuNC1lRrqCNDEMmaSTJ2ed+oQK7vsmLMv29xy68oaVBOMS5In3N:LMlQCNYZTJkPAvsmz9N8oavOP4N
TLSH
T141730246A7ED93FDB5EC33E31742A406180908A8DC7A9BDFFD1F07AA1C1CA0195D895E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Cache\Cache_Data\index
Size 256KB
SHA256 359e215b82471688bc187fac965bff75ac460fe3ccc92c8e43906cf4ddf72ba8
MD5 63faf4dba33025e7a7161e936d189721
SHA1 90c9f753654bae7ba0644a5b98215903aa8f5c88
SHA512 be9bda9b7fd975a2b361be7fa1938f9f2f2cb674d0c43bccdd876c42f32456611bbc9e5c8480b4aae1cefec365d45a9fb8d44ce367b699706f787252ca8235f2
SSDEEP 3:LsLllFlklNllklkXlxUtallLll/ncll//ZNtlmNtl3Nl/l5llll/wlNlXl:LsRa3lPKtuilthkNHtlll
TLSH
T1FD44113EC3C0AE22C2C002FC80838B203338CA0ACF8F8B03030022223CC83802E0F020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 4431a1591263d9f988e6dbfbc0f0b7c8ba56ec2c7722ef2a97349a035f10fddc
MD5 1491fd06eccd55516b39796b29068500
SHA1 1b87d9c27973c46248b047856bd72063807a70f2
SHA512 09b0dc5d25514485ee9a73cef558e65484728dbb13c2b2f0e7cf3c05a6bf183b3d1315cb6f8f93e05991fd4edaa8ec961cbdb362a36966f1a06c6eef81621bf0
TLSH
T12EE02B95828D0F1DD72D96F7CDA643044A0A42C429BE3A03A980C6C23312424125C523
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 565b63bff4d3421789e4a620d606bf6c075f2d8cb47a9c6232e8fd7db5b8bc29
MD5 bedbc705419f429e4a4511ae1be622e2
SHA1 f69647e915393237ad0c961aaa98353714082426
SHA512 70e45ac9c23c57949670bcac5ec5d38ec7e61e037ac4deaeaed867508f896413c627079526ac61ccbd38de69b97576de4be7ad9af3fdfe66cd1e31ed5c9d4ec5
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 0aa42112bc265d1a3117973796fb24aea7b278b22749a817a13043ff0b318a2a
MD5 5bb832aae2c9d0532bd5c88011f197a2
SHA1 67cb0a142695f5bee0f578b0dc3912675fa2bb6a
SHA512 73c9eb0fcc57a4e34cf10e13c870af1dff177b3027805e2d44f12b5123d5bdf051cfa545a335d0db5c0bedfe66afc308a2551887e83319c720e1c89434dccf52
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\DawnGraphiteCache\index
Size 256KB
SHA256 b37734ea42ddfb8c79c67275fe2e48c0fe34f36f25d74890d11758538e1b06d5
MD5 7002e45d90ab17040fa525896e4418db
SHA1 a77c686adb998dd83b53ca6781804002b80b0ab6
SHA512 79ebe8cb86f66c1a1820699088c84a8395500f7a26fd646bec6da5c69b2033bfb579e31912827c248851ee78e48502c0261a81239739260fecb55f9850f70f45
SSDEEP 3:LstlNllklkXlS/S:LsX3lPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\DawnWebGPUCache\index
Size 256KB
SHA256 8054c67ed6af04bf21d776b4295d483da87fbaa44085b87478cebd1333c3ff82
MD5 3dbaabbda5d76419cc7a9503e1041db0
SHA1 a579b1a8c0b49ffc95376e9aeb7ad3e8d03829f1
SHA512 243ea883285b0faa5093b672ad4ec0baa8a2d1e6f74676d133117a63a5bc62a3c3074f2a99eb4e2e381a796edbd059b6b9cd3d06db51e22e2448467af250d09d
SSDEEP 3:LstlNllklkXlm/:LsX3lPm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Favicons
Size 20KB
SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
MD5 198e1617955c70ad9263e5ae041f3c36
SHA1 623233da85a56e3b75fbd55f5159d83f764db270
SHA512 ca7a586adc01389778c75ac85b1968f8604f39138362db57684b0ff7099be46653f8f98706b0f9aec9059d437a604b82021bc7be8c18dff6a7e60df89c40d2f0
SSDEEP 24:LLiwExh0GY/l1rWR1PmCx9fZjsBYuI+Qo66UwcEv+75fBmI:NeBmw6P1U1kmBmI
TLSH
T1F592AA075E387407EBA11E7D266A183A9E3FE26D9FA29CA4347410618CF8582D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\GPUCache\index
Size 256KB
SHA256 aba38a1d93ee78eeb9980cb3a155663bd7dba601eac41a196f1f51b1d71e8e43
MD5 fdb9ca56a0858c21761a4735cb286b7d
SHA1 147d04ba7067ecef60b19cc7ab5585dce016e830
SHA512 c0878d3e86f382a637b7df5db3d1d51d0bdb5e2dae9283e60124dc6cd44f80720ea72c9a5d1b992c9114d3bdac67c82e979b69365611bed6563d196224730f7b
SSDEEP 3:LstlNllklkXlJ//:LsX3lPx
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Local Storage\leveldb\LOG
Size 279B
SHA256 0ad8c2afca5eefe647bb48aa3b605b2bd8cf7aee937e155be861b84425fd2f4c
MD5 81a6e71913ca788b6235f42fa19f14da
SHA1 6b5dabaf2052ebf490a822dd57583e2dda5ca034
SHA512 68f9ac98bfed899e7be0589b0073345fabfe4647a81277a1774c81cea07f9e20ba320ca50544edffe4dc5c848966ba1c8dd3d5b9821f770d094c475d1e5ff63b
TLSH
T17ED0CD508097C15B0A44949FA626731DCB74284CDAD9771C8D40D5C834A900D87D1282
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Login Data For Account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Network\Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Network\Reporting and NEL
Size 36KB
SHA256 473cee21f162f3a7a25635fadf8a9264238ac53cf89f7bb67ede9fbcdc676cfc
MD5 56e8276cedbc027359e31311dd2f91ed
SHA1 5aead8213b1fdeb895b9d51975126c5527ed8949
SHA512 c6ae5450f3ec31cb87fe6deb33b79c9c7919f637343e93cd0866d52c9fdaf674ab82eec261d77aeb0da4a5ed9f2960431657474cde55067a8b49c58c5a12888b
SSDEEP 48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:uIEumQv8m1ccnvS6
TLSH
T195F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Network\Trust Tokens
Size 36KB
SHA256 61747eae344a1ed6b1bea06522e094eba6879049db5f918e55423dbd8981a881
MD5 f2a84020dd3bf7c981b9b69dc6b8951e
SHA1 362b54cbf3c0ad6473ca595d4b72930ad9268890
SHA512 75ef07c38033b51286eb208d494d3856e7238bf0b1e928c8c35b5ececa05e8b591fc908ff83f89a1695ba74ed2bd155e49d35222a8cfdf8dbe936daeed7ae1f9
SSDEEP 24:TLn3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T731DtX5nDOvyKDhU1cSB
TLSH
T1A5F2469BA93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

ServerCertificate

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\ServerCertificate
Size 20KB
SHA256 55c38a40a44105325365ebfb7615e7d38e55d7d02853c1002fa2a9ae98974140
MD5 c36580cb88a6268715ad1c3213ee3e62
SHA1 0e829bd8521137f80ac1b6fc9439c2622e3c89f8
SHA512 268e6d3593d346f2e9289d3b1505282d8bb684f4a829fecf1d807a04645a93d94f4267a50bf99df54047612023388a4afdb809781ca362581ee1e8a7826a56b4
SSDEEP 12:TLiNXB+TR0wfQQ+aoMllfIHFxOUwa5qgufTsZ75fOS:TLiZkZC6UwccI5fB
TLSH
T1D492468F9F843935E8A947B9458706E00F7AD73E8382AD6352E848503F90D8081BD45A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Service Worker\Database\LOG
Size 283B
SHA256 fbe61ee6a0452e6b5faf145bc229d60199e2b2ced9383236c6f9294090bdb433
MD5 e5620e79e05af123716d0e9cecfe2140
SHA1 579b0a52eafc7582b8cb5cfc304ce6360447b0ae
SHA512 99f0f6e3ba9c51e499cdfb0d6691f3b34b46fad889908f9b787d2a8cd647892c0249aa3da1b97890fd8377b7e70ef217ecf8c5feee61b99c843448dd2edde407
TLSH
T127D0C21040C2C6BE195780D71E37931ECB98BC5AD6D83A198F60CA8811AAD0D63A6200
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\zauefplt.bef\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3320-620-0x000001782CE40000-0x000001782CF34000-memory.dmp

Download

memory/3340-240-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-42-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-680-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-679-0x00007FF7A2880000-0x00007FF7A2983000-memory.dmp

Download

memory/3340-678-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-677-0x000001C9AF240000-0x000001C9AF252000-memory.dmp

Download

memory/3340-0-0x000001C991160000-0x000001C991161000-memory.dmp

Download

memory/3340-479-0x00007FF7A2880000-0x00007FF7A2983000-memory.dmp

Download

memory/3340-2-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-480-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-482-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-483-0x000001C9AF290000-0x000001C9AF2E0000-memory.dmp

Download

memory/3340-256-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-251-0x000001C9AEED0000-0x000001C9AEF02000-memory.dmp

Download

memory/3340-3-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-4-0x00007FFE10650000-0x00007FFE109F1000-memory.dmp

Download

memory/3340-250-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-5-0x00007FFE11BC0000-0x00007FFE11C87000-memory.dmp

Download

memory/3340-246-0x000001C9AEF70000-0x000001C9AF064000-memory.dmp

Download

memory/3340-7-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-245-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-244-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-243-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-242-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-241-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-1-0x00007FFDF4B75000-0x00007FFDF4B76000-memory.dmp

Download

memory/3340-239-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-237-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-238-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-236-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-235-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-234-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-233-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-232-0x000001C9AEC10000-0x000001C9AEC5C000-memory.dmp

Download

memory/3340-231-0x000001C9AEAF0000-0x000001C9AEBC8000-memory.dmp

Download

memory/3340-230-0x000001C9AEA70000-0x000001C9AEAEC000-memory.dmp

Download

memory/3340-228-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-229-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/3340-222-0x000001C9AE800000-0x000001C9AE8D2000-memory.dmp

Download

memory/4504-818-0x000001BAA3B90000-0x000001BAA3C84000-memory.dmp

Download

memory/5808-255-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/5808-283-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/5808-249-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/5808-248-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/5808-481-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/5808-548-0x00007FF7A2880000-0x00007FF7A2983000-memory.dmp

Download

memory/5808-252-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/5808-247-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/5808-258-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download

memory/5808-253-0x00007FFE10650000-0x00007FFE109F1000-memory.dmp

Download

memory/5808-681-0x000001601B0F0000-0x000001601B122000-memory.dmp

Download

memory/5808-254-0x00007FFE11BC0000-0x00007FFE11C87000-memory.dmp

Download

memory/5808-819-0x00007FF7A2880000-0x00007FF7A2983000-memory.dmp

Download

memory/5808-820-0x00007FFDF4B40000-0x00007FFDF4CFC000-memory.dmp

Download