7f012ba395bd4261647d73b756870900f398b57b1ae69afed0142c9084ed1441

Analysis

user interaction
yes
max time kernel
900s
max time network
901s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/08/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client(12).exe
Size 8.6MB
Sample260822-tmceysfe65
SHA256 7f012ba395bd4261647d73b756870900f398b57b1ae69afed0142c9084ed1441
MD5 3e54c393a34b60c0358f59417bf530c7
SHA1 df1fd79c176480e88e4fb531b75777a88ee9f2b1
SHA512 18d09450d1b3d6b80267e81f6ac1a7adab9dc96bdff8a674186b12ffbaa27cf915024babe077e0101715600327f1bee6d4d993b0bc36ba1514f121f93a5f990c
SSDEEP 98304:wLvfWszoaANNuduE8oFEvBcuZSYkyMKvS:k7zoaANJE8xvBcxyMKv
TLSH
T14B965A47E89045A8C4BDD634CA728223BA717C884F3563E73B50F7686F76BD06AB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4696	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	2	Go-http-client/1.1

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318886668662470"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3232	powershell.exe
3232	powershell.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
4936	powershell.exe
4936	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5156	client(12).exe
Token: SeDebugPrivilege	5156	client(12).exe
Token: SeDebugPrivilege	3232	powershell.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5156 wrote to memory of 4772	5156	client(12).exe	82
PID 5156 wrote to memory of 3232	5156	client(12).exe	84
PID 3784 wrote to memory of 5748	3784	chrome.exe	86
PID 3784 wrote to memory of 6088	3784	chrome.exe	87
PID 3784 wrote to memory of 6088	3784	chrome.exe	87
PID 3784 wrote to memory of 4696	3784	chrome.exe	88
PID 3784 wrote to memory of 5340	3784	chrome.exe	89
PID 3784 wrote to memory of 5340	3784	chrome.exe	89
PID 3784 wrote to memory of 2536	3784	chrome.exe	90
PID 3784 wrote to memory of 3616	3784	chrome.exe	91
PID 3784 wrote to memory of 2536	3784	chrome.exe	90
PID 3784 wrote to memory of 3616	3784	chrome.exe	91
PID 3784 wrote to memory of 3804	3784	chrome.exe	92
PID 3784 wrote to memory of 3804	3784	chrome.exe	92
PID 3784 wrote to memory of 3836	3784	chrome.exe	94
PID 3784 wrote to memory of 3836	3784	chrome.exe	94
PID 3784 wrote to memory of 3632	3784	chrome.exe	96
PID 3784 wrote to memory of 908	3784	chrome.exe	98
PID 3784 wrote to memory of 908	3784	chrome.exe	98
PID 3784 wrote to memory of 4612	3784	chrome.exe	99
PID 3784 wrote to memory of 3148	3784	chrome.exe	100
PID 3784 wrote to memory of 2888	3784	chrome.exe	101
PID 3784 wrote to memory of 6048	3784	chrome.exe	102
PID 3784 wrote to memory of 6048	3784	chrome.exe	102
PID 3784 wrote to memory of 4388	3784	chrome.exe	103
PID 3784 wrote to memory of 4388	3784	chrome.exe	103
PID 3784 wrote to memory of 4808	3784	chrome.exe	104
PID 3784 wrote to memory of 5568	3784	chrome.exe	105
PID 3784 wrote to memory of 5568	3784	chrome.exe	105
PID 5156 wrote to memory of 4936	5156	client(12).exe	106

C:\Users\Admin\AppData\Local\Temp\client(12).exe
"C:\Users\Admin\AppData\Local\Temp\client(12).exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5156
- C:\Windows\system32\cmd.exe
  cmd ver
  2⤵
  PID:4772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe74b1c728,0x7ffe74b1c734,0x7ffe74b1c740
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,10907890685141452352,10529924649272990989,262144 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,17907306183874924519,4858456619212384800,524288 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,12557667041269605817,11151697553610381050,524288 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2376 /prefetch:13
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,4852001360889380840,9428444570972891969,2097152 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,593511370973234358,9941947918798120595,2097152 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,3463185050417478759,17830325024877834839,2097152 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:9
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4668,i,7455193301487620620,9468927981752269549,2097152 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,10301082453091929889,9529876740697079983,524288 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5512,i,9941810937175070575,15442343396676335435,2097152 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3488,i,2179268207181238742,6892637203139039786,524288 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3600 /prefetch:14
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4452,i,7330658906786352939,14357317373037367124,524288 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3532 /prefetch:14
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4448,i,10020549518697898291,13270234720736711462,524288 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3592 /prefetch:14
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3544,i,9576150969897320444,17903018096621203812,2097152 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1208 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5812,i,14716342903266046455,1117842207778231751,2097152 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4308,i,1754708676023213687,18041576758526097117,262144 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:10
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4600,i,1065921282554905103,9623649993969998384,524288 --field-trial-handle=1796,i,17844420707232566891,36970742370760145,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:5568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e7a7a2bf2fb6b06d3cf1d8151450deb40564f0698124d0a2dd21bc4ede89fcf1
MD5 9baf25e81701033a009b3637a2740636
SHA1 5c33011260f4a374e4efe06a87eded0ad059aeec
SHA512 7c639ffa582d1e771a08f148d2750ae470e0d825c9087e3980d94ed5e848c1d6ecd46c682366a9da6f13275b0297958bc595097dbb098be25b947b374c5444cf
TLSH
T1B3E0E5A5C861BC270CFD5B2861550645E66803272B80595F3E3C900C8FB1A3B414981C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 5d1df7693b13c876675d567cf9f2467131aee4cb73264c721f5836665e44e0f2
MD5 a7ee3d62ea8e037cf34cc2dec4058a70
SHA1 a174c42743175d729e75d6f58b85fea8fb9be174
SHA512 eeb715767a411696eb2a208e676bdd66cb23f5fa14ed4fbdc3364e54191ec2a0ffbdc762a987795a12d670846eae26dd2295a447cb01c86593493bfe0f64884a
TLSH
T10CC0121D97C9C8C5CF4999B8A4A960A4B4BC39A664D7FD4E81B4026F6DBFFF45000643
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 960B
SHA256 e7a80d7d2ad48e9d8ee50a4cf6ae1a319b52aa07e97260d56549aa596f38eb39
MD5 a9998d0191b17af5ee08cb000d533a9e
SHA1 afe58cddcc0d5572536098b41667e865d853b3b6
SHA512 ee38c9b79284b6fd5f854b4ec28e4161c68b93cd75d696d013fea521d127000430315cd987db6bd460b9e50e8ee8d7d5a5da76be3386a2b4b550bf476c1aee6a
TLSH
T11C11D8CCDCC81093EF64ACB4B8CE2C7968780994244E9F4F046444FB2C23FE07022A8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 fbe7fddadbcf7a02906e0e965fa222de17afef41872ec8ab7950fb9986387cb2
MD5 ecda5caf0b1a390b9c2f9eecee170236
SHA1 912665a40d2a635f5d0bc147298f3d79d9047d05
SHA512 e7563ddbe9b6af7c93d6c7021ee1144cc0c81282714ca256af4930ddee56ccb01416fe1dcda058cf97cd2958a6f2f48a29fa62f7aff8f999e9278df47b6401d0
SSDEEP 48:YALlqzqkhmhXIlEzaXYfoKsyrgmzsafsdosIVKss1+sXqzsGts6csq4sjqs1WgYr:DkV8uCaILrlEiK19m12jLxYYjhq
TLSH
T138A18DF7C3E9CA2DC90156F4AB156E1FCE290A24532C3C67C8D4AF5B93E2472D24165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 77baac646d9ed82b90e83759e99f87bbc864c5626e7086490973afcc50eb3581
MD5 57cb03b7bd99082bc45264b93ac6a492
SHA1 6a5efd2a27e009046e310649a90551f95683e9a7
SHA512 d9ed09f5e734c21658051afe196b8fc23527c0825022f5008649a82efaed177a6592da2ac8129c9a03959293429cf698651fbd6328482c51201d0999187497a7
TLSH
T134718DF7C3E8D92D891156F49B256E1FCD290A24532C3C67C8D4AF6B53E2872D20135E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 4f41ac66e8ac1b13967e7824d6067e921736cbbd07048828b1ba958638bddbfc
MD5 1d8c6f344d393b33b5f3502aa8b5eac5
SHA1 951beaf0af5928d0d1a7608dfff38f984dc33c72
SHA512 21b5541869af8ca2f817b1a2922e861b0261ceb5c0c85dca6904de829ab5cd07edff6d18c5f6acd0ba36f0ea98954140a8a57c29452d273c280b586528ff8e19
SSDEEP 48:YALlqfqXhzhEl4PhsaXYfoKsyrgmzsaEdKss1+sXqzsGuZNWgYfsFjhhnONzsTja:D0uVu6+aILrlEdK19muZNxYYjhxW
TLSH
T16A819BF783E5CA2DCA0196F4AB156E1FCE290624432C3C67C8D4AF5B93E2572D24179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 853B
SHA256 fa57c1e3065231cf41c825d529146b0dda4483c3ed97ae401065825430167bb2
MD5 f294f23977f91790bb18f0084bf1e127
SHA1 83d388e98fcb2ed8214c78ef1a4da4555df27e26
SHA512 ef8c794b4b4dcfbf2f53c6288579751b9b7fa64c1dd0fa2dbd8eba93a1915a09fd667bb6c0631d23406a976e14978b63d180eaf255f38cea37a91e83637850ae
TLSH
T1F7016F97D2BD745B10F948AF1D06BC0DABB1A430118274F8DE97D26CE0824F32B12067
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a3de0d332b50ff3233333004be67e48743fced24913c4d40aac934389fbd3d10
MD5 45303f14b4254af05a9b25685259f8f5
SHA1 34b50ef908ac3ed40e00e668c382fca911337768
SHA512 a803393aa536807f881ab912194e792732e0335a178b9ea14acf2c3e21697c46863062c714de10fdb176bb2045cb246f6c214051043d0e34c397edd75b29d19d
SSDEEP 192:tR2nvmQDK7N4dZxv7Hp2PRpUZ+q9DHsb+WN0SLBXgTdN+P1IMkLYykwfn8yIsnAq:tR2vLD2SdZhj+XY5wZtgfgIlLYy/Me
TLSH
T10552F92AA9106A3B5CDAE229FA15BB57E7F5203165D41EC8EAFC892C05D75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b853660148ba2fafc8079bf4cf6eae08867bed08caa888d0a7f1288007786f56
MD5 e119645979d207bb7214edac6151ddf5
SHA1 e41e581465717571e0060577c9e3daa7dea6272c
SHA512 8b5b315f18a30cc8aef150850b8e16a542b330da1b6a531acc1eb5fc04c19912b3713edb5b44126bd854193fc4e63ee7fed6caefb30d5435a9cc0366118edb35
SSDEEP 192:tR2nvzQDK7N7dfixv7HpAPRp2Yp9DHsb+WNnBX4dL2XkLYykwXnVyIsnAUgtaJ:tR2v0D2xdfihjUXN5wxi2ULYy3B8
TLSH
T14A42D62EA9106A3B5CDBD229FF297B57E7F5103125D41E88EAFC892C15E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 29f5c2bc68ccd4451ac0800ccc32b76d32ad3be802733de132c4fcf58f5b6447
MD5 e65498183395dca3390a1e709f425c37
SHA1 e35330650630ec63e29bb86e19126b14f5706cb3
SHA512 d9575f1442418809f1bc4927a69e0ad518066205370272bad2452d679453a85fc60951d7011cf7e1e0050a7337c1c63997a048dcd0043232351d7e3af91e0087
SSDEEP 192:tR2nvzQDK7NSdfixv7Hp2PRpUYq9DHsb+WNnBX4P1I2kLYykwfnVyIsnAUgraJ:tR2v0D2wdfihj+Xo5wx6I/LYy/Be
TLSH
T1E252E92EA9106A3B5CDBE229FB557B57E7F5103125D41E88EAFC893C05E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 2aa5dd805204fd24148b7011b156a88b0dbcb0ba2eb0754c7252423bfed58138
MD5 e26075a7bb55c50d56bb3dc69a9c2d75
SHA1 da11dc3eabcf845a0bd2b07c86314fe5e431ce8a
SHA512 ba09acccde1bbf289917ab6bb7607337d4f9ec1340ff5d148daae5e6a3e558cbf9458ac03eb8648b4be2649300d1c3c120505a4cbdc82ae1b139d36cb9f047d6
SSDEEP 192:tR2nvzQDK7N4dvxv7Hp2PRpUZ+q9DHsb+WN0SLBXgTdN+P1IMkLYykwfn8yIsnAq:tR2v0D2Sdvhj+XY5wZtgfgIlLYy/Me
TLSH
T16252F92EA9106A3B5CDAE229FA15BB57E7F5203165D41EC8EAFC892C05D75CC221301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2e6b5f3ac46b9389aebd0b0c201ec949ee6f6f86c73aae19089d230efd8c08dd
MD5 8ecf6b75e4f53eae8bad8fb0f00e4c15
SHA1 b1e246385fb2e55541e8b3982c8aac8048272b50
SHA512 8def82ca545b933f267d4d8c452d30c7a14649719aa8cdea515ee32969efc757f676d24d50c15a8cfbaaafb3b73265be756df9b9e12d015aed8df40006f84a38
TLSH
T1BFB012808001A147C41707F81586188871189F229A1A270943E0A922882A650C0180D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5943c6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5943c6.TMP
Size 96B
SHA256 bfe536134343022640eaaa8a9824ce422198baca76b8d8885734447bc7fe48fd
MD5 3d5dbeca55d7400deb9bf54d4fdd9e92
SHA1 9f7e43ad8edc063fa8d9f1e194576223b9980ca5
SHA512 b806fac6430354192dbf9c72773cab554c6f77b7c4da0ade44a634add66175e505de54b08deaee4651cf973ac253f335ed7dc77d97acad29606534512658537f
TLSH
T12DB002A9C1026B22C24603B4399595D87274DF25C713971A92F01E6EDC356E44935564
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 ea8433cbf9c0e40c5c9a98a58b3c42a17ca82e77be14e0ef94196e765ed4ff5f
MD5 867665f1e7653a7ee5bd94d2fb7c58d1
SHA1 b339d3d0cd947d0de6a9172eae8a6f4c253807b4
SHA512 e2a00ab1c15130c16634685d12d7548c7815c72c6c91e8096e07f119aaa3ce6832c91d3865f7215c969860496e45e29e0f01300aa0adff05b92d090160df0468
SSDEEP 6144:Ya5PoycD6S3l/31Xksp91x2m7Rkm1tYpBeh2BAoD:zhoy5s1Xke1X9oBGcAoD
TLSH
T11E3412362C78EA7E4E6BE75C804F180F0CF28887CD24BD7A8EE5AF8461D65D90716671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e01cb6dfee712cbfae90d94a01978b05db06e95a023010ab0411763ee7e25308
MD5 76b94ee6e7ef6b44a42ef21bfe72e26d
SHA1 bfaec17d677aa738b5f065f96cdfb6ec9809e353
SHA512 ba3bd7fe291ec5150e47f3c8a391bf6137604d55fcb9a2dda5c0c086b3595d3b993af30a51058f38a7cb29737c180152cbfa73e8d395ddbbd7e713ef55e77d40
SSDEEP 3072:QGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:bm7Rkm1tYpBeh2BAo+
TLSH
T19CC3122B5D71A93658B9B70EB04D0B1F1EF14DA6C930DE82C8D86B0477F66CD0905A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 6aa08d5ebcc65c0ec2858d3b4976f3a3e1bea366e04cf7a33787d7992732eb3b
MD5 ae24e277bb1bfe43abe93aeeff5aebd3
SHA1 bb3f837017ab81c765f7dcea000bdc9812110252
SHA512 0fedf030d1c381c479df00f22c754701c9f3d787aee36c0d8018451493ad35741ebd417ecf2bb0ef889f2dfbcd431979c4dc8af6619174e3760702f9691f7902
SSDEEP 6144:75PoycD6S3l/31Xksp91x2m7Rkm1tYpBeh2BAoD:7hoy5s1Xke1X9oBGcAoD
TLSH
T14C3423162C78EA3E4E6BE71D804F080F49F38892CD24FDBA8ED5AF4472E65D90716671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 92319ccd2567641ea6aaa5554dd5d96597e4ead5c5ca1109e16e0805c1361a1c
MD5 4fa8812b16f337de28c091880bbbb3e0
SHA1 809191bb44c7e08aad15a4a0a3262ccb26491ef7
SHA512 e629fbce1a441e61ca5d277aad789ac492806f13beb97ec64a7494bfa2367272bbe22020dc15a4ce7a4f27f0ef3de4d99bd268801eb34318189b46008dba5d62
SSDEEP 6144:ga5PoycD6S3l/31Xksp91x2m7Rkm1tYpBeh2BAoD:Lhoy5s1Xke1X9oBGcAoD
TLSH
T1433412362C78EA7E4E6BE758804F180F0CF28887CE24FD7A8ED5AF8461D65D90716671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d776726b-ff25-4d87-b385-d32fa6cc6785.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d776726b-ff25-4d87-b385-d32fa6cc6785.tmp
Size 240KB
SHA256 dcc9c0634fa640e7c385be6429ee51c1563bce8ba59aa50cff528116dc99dc3b
MD5 4ef536edfc84237cb6cf8a14b6a89060
SHA1 2bf59c299c13f1b025df2142cee064f3a500bf83
SHA512 f1217cf7d83880a8cb076ebe3461c6a79cae34f96b81e5a71e7c4a74ec197d7caafba2e9afb08f7bd3408c955d3942b992b4dbd6752f8516736ddc2b9739ff4c
SSDEEP 6144:C5PoycD6S3l/31Xksp91x2m7Rkm1tYpBeh2BAoD:Choy5s1Xke1X9oBGcAoD
TLSH
T1A83423162C78EA3E4F6BE71D804F080F49F38892CD24FDBA8ED5AE4472E65D90716671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mczejmyj.ywo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mczejmyj.ywo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/3232-12-0x000001A2FBD50000-0x000001A2FBD60000-memory.dmp

Download

memory/3232-11-0x000001A2FBD50000-0x000001A2FBD60000-memory.dmp

Download

memory/3232-10-0x000001A2FEC00000-0x000001A2FEC46000-memory.dmp

Download

memory/3232-9-0x000001A2FBD50000-0x000001A2FBD60000-memory.dmp

Download

memory/3232-1-0x000001A2FBD50000-0x000001A2FBD60000-memory.dmp

Download

memory/3232-4-0x000001A2FBD00000-0x000001A2FBD22000-memory.dmp

Download

memory/3232-0-0x000001A2FBD50000-0x000001A2FBD60000-memory.dmp

Download