hijackloader | 1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e

Analysis

max time kernel
299s
max time network
299s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/08/2026, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UTODYIBG.msi
Size 8.8MB
Sample260825-x77ndadq6x
SHA256 1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e
MD5 c46e2ae5a068439e70a857f942baa604
SHA1 e703e1b8c2da14ca54ed0343a8a8db80688f9057
SHA512 78823c7d6f99e47b7485ee30bfa8d2b39adb3cffb0534951e718fcceed33da6a5165a3a0b14ee3d812ca7e49be09b115fbbbed9de02f9eab362f89dc5f29723c
SSDEEP 196608:V9LuzXp14IgOL43JUeh9Ey/KnzAQZwYaaBIuLIUZkHfvOxDEsIf8BvM:VcjravUehT/KnzFuYDBzRLgf8K
TLSH
T19D9633B473605384E71FACF264681168A1E8CE667971505B6F0AB8B2F773E736910BF0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\TreigenAutomation
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000028497-39.dat	family_hijackloader

Executes dropped EXE 2 IoCs

pid	Process
1604	Encrypted-Injector.exe
3008	Encrypted-Injector.exe

Loads dropped DLL 10 IoCs

pid	Process
1604	Encrypted-Injector.exe
1604	Encrypted-Injector.exe
1604	Encrypted-Injector.exe
1604	Encrypted-Injector.exe
3008	Encrypted-Injector.exe
3008	Encrypted-Injector.exe
3008	Encrypted-Injector.exe
3008	Encrypted-Injector.exe
2544	SpectruArray.exe
1692	memu.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3008 set thread context of 2544	3008	Encrypted-Injector.exe	102
PID 3008 set thread context of 1692	3008	Encrypted-Injector.exe	103
PID 2544 set thread context of 1012	2544	SpectruArray.exe	109
PID 2544 set thread context of 5776	2544	SpectruArray.exe	123
PID 2544 set thread context of 1012	2544	SpectruArray.exe	109
PID 2544 set thread context of 5172	2544	SpectruArray.exe	129

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	SpectruArray.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\NOTICE.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	SpectruArray.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	SpectruArray.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	SpectruArray.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	SpectruArray.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e589ae3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0128CEB9-4F12-4B57-9BCE-47EE84C09C63}	msiexec.exe
File created	C:\Windows\Installer\e589ae5.msi	msiexec.exe
File created	C:\Windows\Installer\e589ae3.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C6A.tmp	msiexec.exe
File created	C:\Windows\Tasks\MitronWire.job	memu.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2704	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Encrypted-Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Encrypted-Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpectruArray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1252	chrome.exe
5808	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b8895c73e21e84780000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff000000002701010000883801b8895c730000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e84101b8895c73000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6fb8895c7300000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea71b8895c7300000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321599871764429"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2544	SpectruArray.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
4124	msiexec.exe
4124	msiexec.exe
1604	Encrypted-Injector.exe
3008	Encrypted-Injector.exe
3008	Encrypted-Injector.exe
3008	Encrypted-Injector.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
1692	memu.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
1012	chrome.exe
1012	chrome.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
2544	SpectruArray.exe
1012	chrome.exe
1012	chrome.exe
5076	chrome.exe
5076	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2544	SpectruArray.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3008	Encrypted-Injector.exe
3008	Encrypted-Injector.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2704	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2704	msiexec.exe
Token: SeSecurityPrivilege	4124	msiexec.exe
Token: SeCreateTokenPrivilege	2704	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2704	msiexec.exe
Token: SeLockMemoryPrivilege	2704	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2704	msiexec.exe
Token: SeMachineAccountPrivilege	2704	msiexec.exe
Token: SeTcbPrivilege	2704	msiexec.exe
Token: SeSecurityPrivilege	2704	msiexec.exe
Token: SeTakeOwnershipPrivilege	2704	msiexec.exe
Token: SeLoadDriverPrivilege	2704	msiexec.exe
Token: SeSystemProfilePrivilege	2704	msiexec.exe
Token: SeSystemtimePrivilege	2704	msiexec.exe
Token: SeProfSingleProcessPrivilege	2704	msiexec.exe
Token: SeIncBasePriorityPrivilege	2704	msiexec.exe
Token: SeCreatePagefilePrivilege	2704	msiexec.exe
Token: SeCreatePermanentPrivilege	2704	msiexec.exe
Token: SeBackupPrivilege	2704	msiexec.exe
Token: SeRestorePrivilege	2704	msiexec.exe
Token: SeShutdownPrivilege	2704	msiexec.exe
Token: SeDebugPrivilege	2704	msiexec.exe
Token: SeAuditPrivilege	2704	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2704	msiexec.exe
Token: SeChangeNotifyPrivilege	2704	msiexec.exe
Token: SeRemoteShutdownPrivilege	2704	msiexec.exe
Token: SeUndockPrivilege	2704	msiexec.exe
Token: SeSyncAgentPrivilege	2704	msiexec.exe
Token: SeEnableDelegationPrivilege	2704	msiexec.exe
Token: SeManageVolumePrivilege	2704	msiexec.exe
Token: SeImpersonatePrivilege	2704	msiexec.exe
Token: SeCreateGlobalPrivilege	2704	msiexec.exe
Token: SeBackupPrivilege	3512	vssvc.exe
Token: SeRestorePrivilege	3512	vssvc.exe
Token: SeAuditPrivilege	3512	vssvc.exe
Token: SeBackupPrivilege	4124	msiexec.exe
Token: SeRestorePrivilege	4124	msiexec.exe
Token: SeRestorePrivilege	4124	msiexec.exe
Token: SeTakeOwnershipPrivilege	4124	msiexec.exe
Token: SeRestorePrivilege	4124	msiexec.exe
Token: SeTakeOwnershipPrivilege	4124	msiexec.exe
Token: SeRestorePrivilege	4124	msiexec.exe
Token: SeTakeOwnershipPrivilege	4124	msiexec.exe
Token: SeRestorePrivilege	4124	msiexec.exe
Token: SeTakeOwnershipPrivilege	4124	msiexec.exe
Token: SeRestorePrivilege	4124	msiexec.exe
Token: SeTakeOwnershipPrivilege	4124	msiexec.exe
Token: SeRestorePrivilege	4124	msiexec.exe
Token: SeTakeOwnershipPrivilege	4124	msiexec.exe
Token: SeRestorePrivilege	4124	msiexec.exe
Token: SeTakeOwnershipPrivilege	4124	msiexec.exe
Token: SeRestorePrivilege	4124	msiexec.exe
Token: SeTakeOwnershipPrivilege	4124	msiexec.exe
Token: SeRestorePrivilege	4124	msiexec.exe
Token: SeTakeOwnershipPrivilege	4124	msiexec.exe
Token: SeRestorePrivilege	4124	msiexec.exe
Token: SeTakeOwnershipPrivilege	4124	msiexec.exe
Token: SeRestorePrivilege	4124	msiexec.exe
Token: SeTakeOwnershipPrivilege	4124	msiexec.exe
Token: SeRestorePrivilege	4124	msiexec.exe
Token: SeTakeOwnershipPrivilege	4124	msiexec.exe
Token: SeRestorePrivilege	4124	msiexec.exe
Token: SeTakeOwnershipPrivilege	4124	msiexec.exe
Token: SeRestorePrivilege	4124	msiexec.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2704	msiexec.exe
2704	msiexec.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe
1012	chrome.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 1960	4124	msiexec.exe	90
PID 4124 wrote to memory of 1604	4124	msiexec.exe	92
PID 1604 wrote to memory of 3008	1604	Encrypted-Injector.exe	95
PID 3008 wrote to memory of 2544	3008	Encrypted-Injector.exe	102
PID 3008 wrote to memory of 2544	3008	Encrypted-Injector.exe	102
PID 3008 wrote to memory of 1692	3008	Encrypted-Injector.exe	103
PID 3008 wrote to memory of 1692	3008	Encrypted-Injector.exe	103
PID 1012 wrote to memory of 2128	1012	chrome.exe	110
PID 1012 wrote to memory of 1368	1012	chrome.exe	111
PID 1012 wrote to memory of 1368	1012	chrome.exe	111
PID 1012 wrote to memory of 1252	1012	chrome.exe	112
PID 1012 wrote to memory of 3744	1012	chrome.exe	113
PID 1012 wrote to memory of 3744	1012	chrome.exe	113
PID 1012 wrote to memory of 2624	1012	chrome.exe	115
PID 1012 wrote to memory of 2348	1012	chrome.exe	116
PID 1012 wrote to memory of 2624	1012	chrome.exe	115
PID 1012 wrote to memory of 2348	1012	chrome.exe	116
PID 1012 wrote to memory of 2120	1012	chrome.exe	117
PID 1012 wrote to memory of 2120	1012	chrome.exe	117
PID 1012 wrote to memory of 4924	1012	chrome.exe	118
PID 1012 wrote to memory of 4924	1012	chrome.exe	118
PID 1012 wrote to memory of 5308	1012	chrome.exe	119
PID 2544 wrote to memory of 1012	2544	SpectruArray.exe	109
PID 2544 wrote to memory of 1012	2544	SpectruArray.exe	109
PID 2544 wrote to memory of 1012	2544	SpectruArray.exe	109
PID 2544 wrote to memory of 1012	2544	SpectruArray.exe	109
PID 2544 wrote to memory of 1012	2544	SpectruArray.exe	109
PID 2544 wrote to memory of 5776	2544	SpectruArray.exe	123
PID 2544 wrote to memory of 5776	2544	SpectruArray.exe	123
PID 2544 wrote to memory of 5776	2544	SpectruArray.exe	123
PID 2544 wrote to memory of 5776	2544	SpectruArray.exe	123
PID 2544 wrote to memory of 5776	2544	SpectruArray.exe	123
PID 2544 wrote to memory of 5776	2544	SpectruArray.exe	123
PID 2544 wrote to memory of 1012	2544	SpectruArray.exe	109
PID 2544 wrote to memory of 1012	2544	SpectruArray.exe	109
PID 2544 wrote to memory of 1012	2544	SpectruArray.exe	109
PID 2544 wrote to memory of 1012	2544	SpectruArray.exe	109
PID 2544 wrote to memory of 1012	2544	SpectruArray.exe	109
PID 1012 wrote to memory of 5996	1012	chrome.exe	126
PID 1012 wrote to memory of 6004	1012	chrome.exe	127
PID 1012 wrote to memory of 6012	1012	chrome.exe	128
PID 2544 wrote to memory of 5172	2544	SpectruArray.exe	129
PID 2544 wrote to memory of 5172	2544	SpectruArray.exe	129
PID 2544 wrote to memory of 5172	2544	SpectruArray.exe	129
PID 2544 wrote to memory of 5172	2544	SpectruArray.exe	129
PID 2544 wrote to memory of 5172	2544	SpectruArray.exe	129
PID 2544 wrote to memory of 5172	2544	SpectruArray.exe	129
PID 1012 wrote to memory of 5808	1012	chrome.exe	131
PID 1012 wrote to memory of 5076	1012	chrome.exe	132
PID 1012 wrote to memory of 1780	1012	chrome.exe	133
PID 1012 wrote to memory of 1780	1012	chrome.exe	133

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\UTODYIBG.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2704

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1960
- C:\Users\Admin\AppData\Local\Stoneboat\Encrypted-Injector.exe
  "C:\Users\Admin\AppData\Local\Stoneboat\Encrypted-Injector.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\ProgramData\TreigenAutomation\Encrypted-Injector.exe
    C:\ProgramData\TreigenAutomation\Encrypted-Injector.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\ProgramData\SpectruArray.exe
      C:\ProgramData\SpectruArray.exe
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:2544
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5776
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Roaming\TreigenAutomation\memu.exe
      C:\Users\Admin\AppData\Roaming\TreigenAutomation\memu.exe
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1692

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:560

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7fffa132c728,0x7fffa132c734,0x7fffa132c740
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1780,i,17788557181015860508,15342969213399137289,262144 --field-trial-handle=2032,i,6472381182494718263,10255134128774549358,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,15950593624606084035,8310552932029116508,524288 --field-trial-handle=2032,i,6472381182494718263,10255134128774549358,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,18072135176146367371,10500155701119541896,524288 --field-trial-handle=2032,i,6472381182494718263,10255134128774549358,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2340 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,13818020866111838696,11406873643528490147,2097152 --field-trial-handle=2032,i,6472381182494718263,10255134128774549358,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,11481203562920035878,4695549016595982379,2097152 --field-trial-handle=2032,i,6472381182494718263,10255134128774549358,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3956,i,6365624545644320352,6518976372172306287,2097152 --field-trial-handle=2032,i,6472381182494718263,10255134128774549358,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4644,i,11613539722997834804,3104592693252976879,2097152 --field-trial-handle=2032,i,6472381182494718263,10255134128774549358,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,5139144297879464904,14935730284815211704,524288 --field-trial-handle=2032,i,6472381182494718263,10255134128774549358,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,4671426779214536513,7785473383159203773,524288 --field-trial-handle=2032,i,6472381182494718263,10255134128774549358,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,7165031761728388230,15907754484878257045,524288 --field-trial-handle=2032,i,6472381182494718263,10255134128774549358,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,3972483538876174813,11821697514056873803,524288 --field-trial-handle=2032,i,6472381182494718263,10255134128774549358,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,5690703249915078825,8029292474137632928,524288 --field-trial-handle=2032,i,6472381182494718263,10255134128774549358,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4552,i,15820490204030691038,14292797067239300782,262144 --field-trial-handle=2032,i,6472381182494718263,10255134128774549358,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4592,i,17129065418827419073,7212890299449580420,524288 --field-trial-handle=2032,i,6472381182494718263,10255134128774549358,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:1780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e589ae4.rbs

Path C:\Config.Msi\e589ae4.rbs
Size 9KB
SHA256 33e3784b48554ee8eab7b5594ed1e84c802f9d6fe0af02adb1cc916774467531
MD5 f6ba7d69415863266024b248402b692c
SHA1 d73efcf310992870e15ce8abe8857c7be382e1e9
SHA512 bfbb4d626bcc8a593a753a83b86edbf377162e69f7afaf8b6cc7b3f5b14f81e4da80b68e363e6b46be193bc88c89059ec73769839a94248bcfad1500dd07ff57
SSDEEP 192:FM/QeXQ4QZuqqiI/qqi0QlQ2zQonQXDfQ/QgQKQaQW3p/QsQ0Q+QJQaQDQSQsQq:FM/LNqqtqqNSVpnCDfwnnxRrhJCv+DB1
TLSH
T1DF123010F2A0C4E7F8E507718B5B1B8837AB96C6D761771B1A6EC170DF133A9C6496C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpectruArray.exe

Path C:\ProgramData\SpectruArray.exe
Size 258KB
SHA256 3837645e4ccc1e6b60c984d9516030da3168aa8f2a9bf7d52ebab8017c3a9f24
MD5 7793c30e1ca6670a558fc38338cd7b76
SHA1 64fe73b543d62147c4b44db121a1cbb05285684d
SHA512 4969b0430cb97b8caf8d1ea7cad04b7fbffd0382895f93f8951924aa76b0f1d8635dfd8ebb168dc277d6da232e2f235b111e74a24904d25d8c2a40a5ad17e886
SSDEEP 3072:hENRC6vGYOvcY7we7UYuqnDz+1CxDistQNw+:hEycpYs2/hDiH
TLSH
T1D4445ADEA18B84E1D1C1FE34C2A3B303672A6E1F0AFF54562B977509F8BD29E3511606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 02d5c8d51c7daa54c20140ba0cecb972c4b2e61b48beb5e911766e5d84a1b5c9
MD5 a91035db529a9e53e0474ee66b6c88f6
SHA1 b4318f07add6914d3b9662a49057a4c97dfbe8e2
SHA512 e0ed3f571ec777a5544ae94e2556ce049362bd5a40d8fe1685deb22c0d313c0d2016087e6bab2709f30f78292e9901c708b33d3afc18120ec1815344c59f6316
TLSH
T1FEE02BB6C821ED370DFD0B2891784A87F79113072691454F7A3CC11CCFB5A3A058789C
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 8KB
SHA256 467f00739dfcc5818e3ed19d09488ae1b8bd6c33ef4c0c7199676e236ea640cc
MD5 dae299246ace48ef58874367f7bc46cd
SHA1 80cb7ac3d5e433a0d6b613974e609bea71b2a629
SHA512 d8355121f83bb0b0a513c948c5ade73ac3380158151d024da52af0e8bd96fcb6a12e3c4c80ac0b235f6cb92afde84aa8f548855c02bd7cf5bd0c91770325f6b7
SSDEEP 3:OlH/lN5sxEq7XNMCsxzhl/jy1XabO/BjxisBDbb/2qK1caa+:KhsxE+OCsxzhlLcThxPbc
TLSH
T162028C5BCD840811C2C6DF3FC72961C0630B6A8A0336CE009B096AE07A222380FF4C80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 f866b0d9d173b0a1ee309d553200c1840c80e07b2ebbd882a2702638ec289f4e
MD5 413a4a31a90ed471b6146b526873c58f
SHA1 8164c4a3ae6d33bd60db7b9e0d832b8e19d8702d
SHA512 4b4186f87184a54c3531392771745bb2aeba6b04415deab5b098c6de86419b87c36105fc7ee06e8ff8f4053a2fff3ca63ff6aae3b6baa0bf7414f16e9c3c25b3
TLSH
T1A1E0864C2489C2ADA8D5C66393E9670CCFE17809B7C8B8173B099885329194475D1771
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 2KB
SHA256 be9c12198673ca89d46bd76f1a2f2e9ae52a3c5b036f405dd27ac22a0676006b
MD5 c858661093775f230b5706e920df53d8
SHA1 0a2e8564072e904aa8f36b4d59f3c8196901ddaf
SHA512 5a05ebbe18379eeccb8c3569dbcc2e67d378422ffa426e8d37e24a6e9f6899903411e48d1301fafd794d84154c77b9c9e8bb7438329e731ebc9aa268d2f47ae8
TLSH
T1CC510EB43781B747D67A9CFABCA993233B72E45004D6CC6743E478A50CD6A142E1A0CB
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 308B
SHA256 d5b5ffe4e5a38c7704cbcff7d2122c33e7f64e00f3f19bf83cd9fd899b73b4af
MD5 f38b53426981a0d4b026339b2cdc2a0f
SHA1 61ec4bec0967cdc7aa2687429437f729bce38bcf
SHA512 2c6c0474a3b468ba253d39cc128502777f1ff46cadf5de5d38c6ea25a1ba97bcf6ff9f509df7f3f59227fd04a091e8adb7d3d3d322acf292ff328404058137e7
TLSH
T198E0CD8535D9C3BE58C582A352F1F30DC6D87D0CE7DD9C9297085850B286C0CA1D4271
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1f1571b853a7e35d7db0d6a7b69e901d62a9a5da68b53846e3ce5212d399302a
MD5 90c573b9f7feb34e3f3a2bab3758b7e4
SHA1 8e2892502ba7b47a039de22be41590149a3e91d8
SHA512 be7b7bc09f67745a7c94bc0c649ee0b742c68a6b094c3f2826b97db02e2e3d61142e1418be7676e83ef05bb328f1fb04af2234f2f2268aedd4822e80b97f71d0
TLSH
T166518BF7D3E4C57D851156F4AA256E2FCD2D0A24032C3C6688E4AF5F57E2972D20068F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f581b30fa75f2a746a560b0d8ee8251965e585a20ff31f5933fc0a175c5f8eec
MD5 fed969f2ea0beed4768a37c80102eeef
SHA1 84809fb29dfa9e2cf0b6c67278a952eacbef783d
SHA512 5fccad27b1d40679bcbb0996f94b3a0e2a0d0e4e65951b9472a92048e328673eabb82f55b4378bbd8a496492225ba855e5d4ed151bab47e1c2c8f4ec03198d08
TLSH
T1385189F7D3E4C67D851192E49A256E2FCE2D0A24032C3C6688E4AF5B47E2972D20178F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 22620f3212da0a8b4e6f4a1625ca43fefccf9920af303a7becced32dd32a7bea
MD5 7fef7dcf6b920cca1e034b7421ceaf25
SHA1 2020a0fe06917fc420e2759da1fd87fde9beb0a7
SHA512 da9cecdc4b1561960100b698573972d0dd7df55c1ca95b947e91667697f46fbd70f0b283aa51af10c3936b9ea549815ef7f9d67fe10d67a73fa65eba54120a98
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBoOD:OIEumQv8m1ccnvS6i1G
TLSH
T1D1F2E2FF07197601C0E49674D6810ECFFD6D051D4B97BEC0AAAC05F3AB865B39538259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0b6deccd34e1d622dcbd3db2e3f8fc0ff99ad7c72c066ef568f40459c470cf7f
MD5 abd96d648449218b79ebb4c77196852e
SHA1 5372c71692bb21d9bae689d87df6c7cc9e2afe11
SHA512 4dbcb06ee7ec9cb1c76e84127d677dc9158e7592ec3370b94e106d004d2da228ec0344732c6eb2d285363db16b9c55e04536547dd7a98c43eb02916c165bec11
SSDEEP 192:eRCb++5z5cZApuAmtaV9bHv7SVpAPRp2q9fHsb+WNnlb0aW+72etl0kwwVyIsnA4:eRCbDfZMUX5xwx0h+72et2U8
TLSH
T17842E96EB910B67B9CDBC629FA117753D7FA202221812E88EAFCCE6C15D75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0882678b6ebe8be993d52e97494ebcef920463343293d77d73c3983c5757bfc2
MD5 3899c4fa4372d3eb9dfd193149af27fe
SHA1 15cc85ce955fbb5533200e9e8506b9ae71ffeb98
SHA512 2c7d25d89c33ec5cbeec990d0c825ad3b12a865c5aa76e5b7289d8dc05ab37e310e85c6dca22394e656f72d1847d82ee3f53a607acc9771469c861a909285d30
SSDEEP 192:eRCbK+5z5cZApuAmtaV9bHv7SVpg0PRppPq9fHsb+WNnlb07W+72etl0kwkVyIsB:eRCbvfZMTXoxwx0S+72et2Ae
TLSH
T1D352E86EB910A67B9CDBC629FA117B53D7F5202221902F88EAFCCE2C15E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 12c953d824d37f2911dece87103645968222d9440f29f0d4f503a292fc62cc14
MD5 8d40a55c044a409a3488213d4c91c2a9
SHA1 cf6f49fbb3de63cba584e9bd584a420697544d48
SHA512 0f7d83d8ad6d49266f4904431223e6c856416b39fdc32115a3205c68931e62ac858d782bb72c771b682f49270200b3d3a976793f052b5bc6798b7c7c5568d410
SSDEEP 384:Zfjd07KxkXqKf/pUZNCgVLH2Hfgsl/X7pLuLcSjrGXODd8+ErU3HYHGt64PH:Zrd07KxkXqKf/pUZNCgVLH2HfgspX7ps
TLSH
T1D372F8676C4C9E3B4FD4C98CD8267B4FADB5014B25D9C86883FA982503D5BDF11062EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e61f8f7cf2d61db120f178db1337155aa40b3c0b0aefadd61175264f3afa94e7
MD5 93f6c7d958e46604096dffd1d4e21d77
SHA1 5222a4774c1e0d9d796623149678dbef922ad84c
SHA512 e756b56b7e36fce4f366893f8e19969b30cd58418bb4a19c464fd39f70912ed440967e1f599f5d357cf4f6afe05174dd6e9bf4a2bae378dd040cf328a4b41160
TLSH
T1A4B01200C8025102C04206B4165218A9731C9F279B0A2B4163E06922CC256718018050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59dc1e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59dc1e.TMP
Size 96B
SHA256 5b887deb4bab2ab3156d179ad9bfa780eafd4b2a6383244904666161b62365ee
MD5 b426baeb825dcd0aa06726754518af5a
SHA1 b4d9c5fa6a17729de66a1efb2fd8150241a9b85f
SHA512 f43be3cb402f8cae0e70937c1a3fe0fd3b4443f78fcd61102521f12a7a42a2e1df8f7fd384f033e68441f1e820ea12d24b918b1b4b237b1f4a4cb57a09f22ada
TLSH
T1C8B02200C8232203C00203B820808BC83220CF20CE03032283E00AB2CC30B3202200B0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 270B
SHA256 3530055a62ddc24a89dd97751ac9db187d009eb8193a29a3636cae2567d4a4cd
MD5 70ef71dd0fed6c14b2b6e149267a2c2a
SHA1 b8829ea9631cd5e0aba87d81e71047ef5fa92f24
SHA512 2ed43127bcd5443c4cd04a01f70de06c50fcef1f284ee4dfec07e605133aa5cd6a1e197dbc0c6e73679af491b976a7304e8d38d58c948cb55471399978470241
TLSH
T1F3D002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 317B
SHA256 d9a2d0ebddc990d0df30bd5b60c2a0feeb8bbf4fc97d022b977983f53d6a296d
MD5 2aece1e2131b425815c6878757dd304a
SHA1 9c62381b16a739b6965b0104342877b062a752ed
SHA512 d33336f8b9188312d1a5e9a950ad4653502e96d7859ca2eed39b79fe97e9c5541cc008d7950001e3b1eb0b4313f08bb505da669f45b338bae1858279389c947f
TLSH
T147E086642489C3AE58D6C22B13E5730D8AE03804F7ECE8526B02DD487785805F6D16F0
MD5 SHA1 SHA512 TLSH

Submit Download

Session_13432159986359329

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13432159986359329
Size 2KB
SHA256 12cc1f70517cdcb30068e0f5dc83d2fd227b0e93c5ad91115fe8a6b640b530d8
MD5 32cae577b15a74f240602aa54d158428
SHA1 b9339af85ed3b99fa22868a34e5ff1e7176aaa64
SHA512 ecbf8688ce56ab70a4591533f9726e01c4e002cc6edd041e4ec76bc1b91d259ea3e9167ef5d25909fd4d1ced466ebed6eb053af1b4a35d763b1a6f4f993ac061
TLSH
T18B517B62A5E5103EE17F81358D7612E37B31BA6038878D1F51B292040D63E432EA9DEB
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 30fd43c27b38279ab7b3746491469c534fb43048981a5335e57f2c9e2321d774
MD5 327247406dc2b52c35aa3b7e6f0a4dea
SHA1 ee1b7045a8a63109e9b3095557cc147ef1df8100
SHA512 047ba708790eb95ab3dd025b7b480fac29798fde10292debd4fc187ac74687eeb220bcc470c471b8af97578d7bb344370c9a770e72cc9e7799456bd99d28f792
TLSH
T1B5E0206039D9CB6F94C6431B62D1F34CC5E2B805F7DD94215F05E450B385C04B183270
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 3d32ccf03d50acc825fdc15e3add1790e0013f31720ac393cb8f136af45e26c8
MD5 d2314f1d7c9557f7f89a258eb261da87
SHA1 5c340d5a484494762354754b4c4de56d4d14c402
SHA512 efae1c3e87522632dd948bc7c074619832d352b7babf63729b4d32a78cab180fdc22d771df4fe237a23bf2bb2f2293a1839f68c8051168c1c7b61fbd45b27c5f
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2Od2MVum9Bnq:1nbZeMrv/hGtd24nq
TLSH
T1B3D3A74B3A743102EDE69A725CE050BB4E3CB16D4F1595D428B620688EF6923B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 22KB
SHA256 113f694c549ad59e3c6e56b15e5c7834dc16053a7c99c143fd5588f939c0b960
MD5 f7b4d4622be76eb871254b843de21c51
SHA1 262d4623e32ff41b28960e6d665cd14257d12f2a
SHA512 15ad6e2aacd0a18e8e960de3d9871ba57750309fb7db364773d8f66654af849dc2709067135c8686a81c7ddfa094f5863c13d4c2a81c86c74299ee5159add53d
SSDEEP 384:QSVb6sdG0wbQ2IIIBb5MIMIBXLh83sdGKnfAAsdGfXGMSsdGjdGY5i3x:JwbQs872yx
TLSH
T1A2A2B756B3702B89DCCFD7FBA95DCE7B1772FC89445900036C929ABA2823E17494138E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 317B
SHA256 c6c6c09b55b634b5f4e0b4d7a52b949a416936a03902674b0dd4743b96b5a474
MD5 7e5622f75d97665bdd5f6e90d40d84a0
SHA1 609436a6a7eab2b11e018fffe14188061fa122d5
SHA512 4d3108405b6a4c1ff21ce811b7c55158884a9d843f382e9c8b8ead6949139549e596cd3a890ea8dcf562e2eae9bd6d333121458959172ff7afdbb18dbb09cbb8
TLSH
T108E0260078C8C6AFB8D4D20721F1630CDBC53D0AFBDC940A4F00D8C47688C0869A1670
MD5 SHA1 SHA512 TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 9fe8478066d9d67acc9381a3912821dbb2ff73dbae9bb8cac937d2329045e662
MD5 8d1b32e7a7f67c65822e82f945203b27
SHA1 fce15e65f0e8f29f5278045658722e626e4244d4
SHA512 4fa2bea61923c5b875003055936e09108a4dd3b5ad902684050755b0bcaace6a5e41c9d0ec913af87ce999c119f435dc3509f42c879b29577f1c6c0a68deaf9f
SSDEEP 6144:6ULf8dcrHLFygCAXvrd3LfqBZqenbyyVEd1cB1S:6ULkdCPJfrFLCVDuenS
TLSH
T1FF341271E8B37EB9136C1729740F23166AE2C8B7809AA7CC58542F5DA6DA3C4EF0CC55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 d3351580ecb89ef49c4dc013c5cee007b4848bd4aad55ee71ee4667b09984e7a
MD5 a06b7d3090e72318fdb716e38f0971a9
SHA1 db1789bf0348483f9afc941c8b3694c4a6945da1
SHA512 f9c7aaf17b8d6cedf3dea79c24a06ba7efd0107b45e0202a4b12af4e14395a267a911a34af0187e8972b85da50810cb4a00bb43bc19d0b436924fd31bd1278f5
SSDEEP 6144:3ULf8dcrHLFygCAXvrd3LfqBZqenbyyVEd1cB1S:3ULkdCPJfrFLCVDuenS
TLSH
T127341271E8B37EB9136C1729740F23166AE2C8B7809AA7CC58542F5DA6DA3C4EF0CC55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 0922d3840e1a3a2f1114e93a9fad84ef4f326caa2cc95866ff89a5e7dfa30b97
MD5 d076eecdde48d0aaa8c7edfcf4edbf61
SHA1 2b78a10971a6003998200ac6094aa81fe6975a8c
SHA512 8af5f6acf98e16ecbcfd630f11606de9f209228646dc41e15e21a636aa3461489aaf3bceff1652a8b63c0d8a16dc0583e52dea74e7de7985c09830dde2e6b07f
SSDEEP 6144:YuLf8dcrHLFygCAXvrd3LfqBZqenbyyVEd1cB1S:LLkdCPJfrFLCVDuenS
TLSH
T1F5342372E8B37EB913281A19740F23162DE5C8BB849AB7CC58543F5DA59A384EF0CC65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 5457ea07ee48ab7a636abdeb2bb628eacba870eb07d3aa50c81705a2fbe42dd7
MD5 981b3b0ba0e65cbea378c1cf68ea6581
SHA1 1301e6c91f440d4bae306769996b75aa1f8eedc3
SHA512 f57f7390c9db4427a643fb55ebcb7fe061d06e1ed6b1266128baed563ef30b1f1385b8648e46a952daa979a8292dd174c068ef4132e324822f908222c0127496
SSDEEP 1536:M0bSwZlAmf1mWUYZchNBoXUF1F8Mh9azKCW3iw9xODQ7B6wQtLPyedtK0XMBg/QW:mw3LffUnBKU/F8enCW3iyVEXGey0cB1W
TLSH
T1C0B31231E5A6FF7B6369562AB50F93191CE149FB44E1B788443C2F19E0CA388EF98C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 ec65396255ddd48d04a54def60e3c6dd685c972ee0009f924b112487450c788d
MD5 e2e347ead50979f86966082dbeb34c46
SHA1 cd8fbfd3255b08fb11ac5f01aca0fbbf86c8d3e6
SHA512 985a0edc0b3bbcfb22866470582217ed4c006eeef326e7bf829ee283ed5df9f3526419d787685f0e45b4184043d71858ee057b5c72429ca468304b7a83245396
SSDEEP 6144:guLf8dcrHLFygCAXvrd3LfqBZqenbyyVEd1cB1S:zLkdCPJfrFLCVDuenS
TLSH
T175342372E8B77EB913281A19340F23172DE5C8BB849AB7CC58543F5D659A384EF0CC65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Encrypted-Injector.exe

Path C:\Users\Admin\AppData\Local\Stoneboat\Encrypted-Injector.exe
Size 480KB
SHA256 565a8a17e3c4c6ac8ace2bb3df5aae9b3bbde1e6889f04f031b564602f498b99
MD5 d937fc0dd514edf6d8c32e89afcc5588
SHA1 2c2725926beb60b043af56104fde11c88bf2ca88
SHA512 f1c1b8cdc1360d7556e21cf76475f1b5dff15bbb87571456b1607234d7569af8f7da2e564f730e964651b85864909161bb1b35102a9a0444e9df9c8dc87d6df9
SSDEEP 6144:YUutHVXYYRTUZabgJJ2ogelPiqNtibgqlAf0vj7uSO+un4kst:A9mst
TLSH
T18CA4404AABA5CC1DF6F70A3AEE7A445408BEBEC40E3E959E4640378D8535EC59C10B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP100.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\MSVCP100.dll
Size 411KB
SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
MD5 bc83108b18756547013ed443b8cdb31b
SHA1 79bcaad3714433e01c7f153b05b781f8d7cb318d
SHA512 6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
SSDEEP 12288:Seb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7wx:Seb8Fpa6aHX7dGP5Gv3Ooc8UHkC2ekx
TLSH
T1559428237A4649F5E1D223F46289932143F9FCA40721B3C3A2EFE1A99F583D56A33951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore4.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\QtCore4.dll
Size 2.6MB
SHA256 46f24b0b8a53e2502037c2f47e46efc04c111fce8ebc7b23c068a20a2ec35a00
MD5 52dd3ecdd390bfe88d488c7f3003b7c3
SHA1 9376bd43bbb5bb830f4140d27470b36c12a6d315
SHA512 7e8c9902cb56a25f0ce5c956035fb348999fb35b0ea1397bb4a782b2d520d7c4e8c916d067c18a492b79c1bd6bb5dd4e8cb7561cd08af1fbbfe482aff0339111
SSDEEP 49152:wpnyb0Z+zbpGbmiL465pJ6e6GJsv6tWKFdu9CFTSuPFMr:wNyxG1tXs+Jsv6tWKFdu9CH
TLSH
T15FC56D90BFEBC1F6EAD3A2B6446F921E41369A1647208ADBC10C6B074C756D17D3738B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtGui4.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\QtGui4.dll
Size 9.0MB
SHA256 1be9a3031f8e488cd5839a7b74641d6e758fbde4d28eb09bc4cf892e2edd0a38
MD5 886cefa51c9671be520a6a60544e4d7f
SHA1 a69731c6f635fc1ae50d6d21b360834b8ff67aa5
SHA512 b635a41b6957c07404b4ced039d5f0cf80bb344b9d006b8bf4abe7af61b83885d9dd53dac8c1cc0ecae4f4f6bd77dc9af9a35220d112d2b8dbc94266b0809b56
SSDEEP 98304:1xvQeZgQinV7IgyL9d/loEDLGDCNfG/9WJghBeZJ9xDKcrSF/n8CWyE5Vafed:1xlZFRlDKDCNfU9WJJHKc2wa
TLSH
T170968D12FFCEC1F1CE86B178145EAB1A466BF6C5CB108ED3E1895E5B78202D12CB9257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache-gen.so

Path C:\Users\Admin\AppData\Local\Stoneboat\cache-gen.so
Size 31KB
SHA256 7500d562fdeb021e3d282decd92bb2343abc70a404c85daf8ecbd22e090c49ef
MD5 041ed6e844bb5c948aa64069e06d6da1
SHA1 68177ccb010472eb1becd9f6d4216a4537318624
SHA512 40978c71c99575158c861753cd1127c6084ea62d83cd26a392ff51bdeb3a0162a0ba8db58dd1e0ddd08f2abed50da8b47142d8eefe4d53d64049a60ec737b330
SSDEEP 768:diyo2dsJ+U8b03QRyMoNt3G303ObtfsyiukT68NXEiY:diM5UFARBsGBg/dEr
TLSH
T1C9E28D5B866A5E62EC0E387F5C18E4D3C255F576794B08B2F2AA0D1F391ADACD420CD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\msvcp_win.dll
Size 493KB
SHA256 9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
MD5 7762c51ea02eb943183d597ea0ee5530
SHA1 0b8c307eba01d0679a2669210862d0afa888c40f
SHA512 14c955e8acb03e86cd11cb992a69fa6681769b2bb7ebdd3a587b36a519f4084be3dd42825b3c91c0d4e325a2869e96acfc88c3ca05bc59352bf0657e7c4ec758
SSDEEP 12288:beMcMmVRYcFERWKn9g82vWirmibAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sub:beMKYXQKn9g82vtnbf03Ooc8dHkC2ecC
TLSH
T142B44C332A4509F1E48A23B4618D936283FDEC650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\msvcr100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service-sys.lock

Path C:\Users\Admin\AppData\Local\Stoneboat\service-sys.lock
Size 4.3MB
SHA256 a53b6423631234feb7bfd2b88e367a72c87fa2c831d08eba0fda67b6c3c3f7bd
MD5 6c203c13b7375af9120e53ab674fae2c
SHA1 cf2f054f3f683ec621157c0458c793487f10f920
SHA512 f9a23afcb19da3bd36b195809718c3475f5358f86a0a425df7479686374a6fad6250bde58a9dbfc090795bf4cb50eb00b82904f624ed80c2cb3fe19e12dc2ba4
SSDEEP 98304:zcsJtPXT7QBatxxo/ZNmxlIEdUagLWdXqMFgOdEg3O7i:4KQBGo3mxlIEbgaXqEb3ai
TLSH
T1F026238EDC1D8A2E55E6873C1045588BF0B562DE3B67983E5F74E2F8063CB2A47D82C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\ucrtbase.dll
Size 1.1MB
SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
MD5 c4a25dce665733663284750666684703
SHA1 368f3c3497c1b0121409216282803bcf1b64f35f
SHA512 768af35c80d0423e72fdc8178b57d4be583569c1e96cac8c00808d07aed988bc614618f7b2077617498079b6ec0faa2d2d48cc314cc34faf11f56b6b7146201f
SSDEEP 24576:FQeBoON4h/4z/G1YknUkY3Ub6lymKmcvIZPoy4yuhpBR7j:qeBoONs42nUv3UbfjpBlj
TLSH
T1D2358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3E8FFF6.tmp

Path C:\Users\Admin\AppData\Local\Temp\3E8FFF6.tmp
Size 4.8MB
SHA256 8e56db0c9ecea8b4a44455bb8b3a5e7a15bb60d0f6801f644c7390b448111132
MD5 dd29bf72060fcd91f463d23b287623c4
SHA1 3b62b7a5e534b4cdcb7e846b2f8d0631e7040932
SHA512 ad9e037d7e670d680703924eede2b1fc4fcd79e7ef58934980f8f2e424c0a181240354728543c1abf33156b4cf72d0e985425d09efb21c16eb34afef704f984b
SSDEEP 98304:u6M49ywrWFlR1o9OUCONL/Z2T1cXLR2+EY8J1CfLKB+2uGerGcz:u65yFROZCOHhLY+T8J1uLE9/AG8
TLSH
T1F4363366E427FB6D073B5940F3A4DEADC3E4FB9137281B43D549E028651B382A3EA5C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3E8FFF6.tmp

Path C:\Users\Admin\AppData\Local\Temp\3E8FFF6.tmp
Size 4.8MB
SHA256 2c2d13b7fa95d8d834bd13887c4f0e67729e317ea40efe7ed2f589f29b2b018a
MD5 5eb3b2bc8181012a37c61ff6e9574590
SHA1 b71f70e9ff61d12c9a13722dc7c1925f01c7aa48
SHA512 3ebef04f2d4edecbc2d89368d4cfdde42209656f3b5f2d4eaee87c8cba8c422321bd41d85a7e220fbc6a50b7b87d4ef10b4b04777a014b573526a0162dcce060
SSDEEP 98304:E6M49ywmWFlR1o9OUCONL/Z2T1cXLR2+EY8J1CfLKB+2uGerGcz:E65y6ROZCOHhLY+T8J1uLE9/AG8
TLSH
T129363366E427FB6D073B5940F3A4DEADC3E4FB9137281B43D549E028651B382A3EA5C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8012AF0.tmp

Path C:\Users\Admin\AppData\Local\Temp\8012AF0.tmp
Size 40B
SHA256 c54eb3df5ed5fd1df6db78b9128be9519f747fcf6d8c3079d7e2167a72824b76
MD5 56a4d872070e93f1759827e0c293ac31
SHA1 593aff7a7c28e3958776d14032df791ccf248e07
SHA512 255144881178efb32878c9f60ad0a2207c53816054e79d680a792ad36d50044aa0ffa66daef28388614a9a94d095a0b8295e4fb0f313746e395d7f4256cec1ee
MD5 SHA1 SHA512

Submit Download

D13M.7z

Path C:\Users\Admin\AppData\Local\Temp\D13M.7z
Size 17KB
SHA256 6896b869e923ec3b5304abb14cea0895b662772a2e6c804ad0da168ee2e4b83d
MD5 2d84d0f825c90cd0d00926d29588727e
SHA1 93a4863cc03887e605bbbd750fa34d8da0521a8d
SHA512 6343a1875a53a366da943a238003c2f1a25d502605cc18a097775892aac82da229f361f43020225e1dc7b61cef5876fae76ca639c2c452e6c664ec6ad19e5f37
SSDEEP 384:0Mph6hHNv5AV2bhkzZJptR2pCHMdwnmopmSLlG4GH7ABt7b9ief:0MTINv5AVEmn/sdwnnY3W7b9t
TLSH
T16282D0BDDA9BE0459E0C43CFDB8E58BDDC6A3461AA8508D2A15158D47FCF0E492AFE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memu.exe

Path C:\Users\Admin\AppData\Roaming\TreigenAutomation\memu.exe
Size 323KB
SHA256 6df5e87bfe261f38a5810313c8221c39b5b15206ce672e1a87167edcf82f43ba
MD5 22db418ed5bac1716f440c1e89e9216b
SHA1 d5b0a386edd880c6663fe1cbc0a70af04b1e830b
SHA512 5bcc3c25a46e8ef11383f2a1ac42ce60ddbf6efd7bd702d064dc01e7838b622e64916c01de7b1cab5aab6c10d56ffe9bdb5e37029ac8697d160fecffce08935f
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1zX0A:ntgZ4KS2L0q5UPcU1r7
TLSH
T166641BB2E9CC48A8DEA10EF9377CCDA0656ABA70CEB084DB630451751D2B7B0C571D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e589ae3.msi

Path C:\Windows\Installer\e589ae3.msi
Size 8.8MB
SHA256 1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e
MD5 c46e2ae5a068439e70a857f942baa604
SHA1 e703e1b8c2da14ca54ed0343a8a8db80688f9057
SHA512 78823c7d6f99e47b7485ee30bfa8d2b39adb3cffb0534951e718fcceed33da6a5165a3a0b14ee3d812ca7e49be09b115fbbbed9de02f9eab362f89dc5f29723c
SSDEEP 196608:V9LuzXp14IgOL43JUeh9Ey/KnzAQZwYaaBIuLIUZkHfvOxDEsIf8BvM:VcjravUehT/KnzFuYDBzRLgf8K
TLSH
T19D9633B473605384E71FACF264681168A1E8CE667971505B6F0AB8B2F773E736910BF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 0022de8a6602395f431d7ad7af83be949ba199fc7197bfb4fe01f79a3ee8f52e
MD5 67b58f26e007fc0cec2cbd2f17b60f72
SHA1 e91170cdb533f75c12f1a21d2a3d67d765c58967
SHA512 2351c3bf07bf22fd91d21a4b7aeb9626cfede6b4120029081f15d6876cb007abc023c39b0e08947819a0114803c0b591b043f2028bf7818bf6a7fd0cee179dc0
SSDEEP 24576:9Epmg3M3doO/vvTLzvN+XpmT187hAlCbRN4tLjxfc46DRmjdIoe2ohhGDu:xA
TLSH
T1B647D12436FD2210E7F39E3CA8F16A23493A7D5B9C15DE8D45411B4E0862F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{dacf16d7-ea2f-46b7-b9da-7a9bf84124fe}_OnDiskSnapshotProp

Path \??\Volume{735c89b8-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{dacf16d7-ea2f-46b7-b9da-7a9bf84124fe}_OnDiskSnapshotProp
Size 6KB
SHA256 08c079fd3a7910b9998efa3c53db03b7751644892c9b5fb0e5eaf36144cb89d6
MD5 5223c8f1e5a19bc7a5cccc51450d4fcc
SHA1 f3cf8c38a12428563f22a49746eb9b37fd3eedf2
SHA512 7b8e2d68f9e0cd359ce8f42af3c78dfe451f313fb8ab4adb1bb3f621eef1560ce016dfa42cbc2b811bc07b3828a262e4ac34b0d95fd99f4995daafd9c4c5acb8
SSDEEP 96:FsTdM6vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:eTDb++ZVmN
TLSH
T117D198085AF54711E2B3AB3228F14557A877B812EF33CB8E0198238E6670910F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1604-41-0x00007FFFC0D50000-0x00007FFFC0F48000-memory.dmp

Download

memory/1604-40-0x0000000074210000-0x00000000742F0000-memory.dmp

Download

memory/1692-78-0x00007FFFC0D50000-0x00007FFFC0F48000-memory.dmp

Download

memory/1692-123-0x0000000074570000-0x0000000074650000-memory.dmp

Download

memory/2544-66-0x00007FFFC0D50000-0x00007FFFC0F48000-memory.dmp

Download

memory/2544-72-0x0000000000450000-0x000000000080B000-memory.dmp

Download

memory/2544-87-0x0000000000450000-0x000000000080B000-memory.dmp

Download

memory/2544-81-0x0000000000450000-0x000000000080B000-memory.dmp

Download

memory/2544-80-0x0000000000450000-0x000000000080B000-memory.dmp

Download

memory/2544-58-0x0000000000450000-0x000000000080B000-memory.dmp

Download

memory/2544-60-0x0000000000450000-0x000000000080B000-memory.dmp

Download

memory/3008-70-0x0000000000760000-0x00000000007D9000-memory.dmp

Download

memory/3008-49-0x0000000074570000-0x0000000074650000-memory.dmp

Download

memory/3008-50-0x00007FFFC0D50000-0x00007FFFC0F48000-memory.dmp

Download

memory/3008-52-0x0000000074570000-0x0000000074650000-memory.dmp

Download

memory/3008-56-0x0000000074570000-0x0000000074650000-memory.dmp

Download