hijackloader | 1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 19:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UTODYIBG.msi
Size 8.8MB
Sample260825-yft4msdr3x
SHA256 1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e
MD5 c46e2ae5a068439e70a857f942baa604
SHA1 e703e1b8c2da14ca54ed0343a8a8db80688f9057
SHA512 78823c7d6f99e47b7485ee30bfa8d2b39adb3cffb0534951e718fcceed33da6a5165a3a0b14ee3d812ca7e49be09b115fbbbed9de02f9eab362f89dc5f29723c
SSDEEP 196608:V9LuzXp14IgOL43JUeh9Ey/KnzAQZwYaaBIuLIUZkHfvOxDEsIf8BvM:VcjravUehT/KnzFuYDBzRLgf8K
TLSH
T19D9633B473605384E71FACF264681168A1E8CE667971505B6F0AB8B2F773E736910BF0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\TreigenAutomation
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4d9-39.dat	family_hijackloader

Executes dropped EXE 2 IoCs

pid	Process
4752	Encrypted-Injector.exe
4056	Encrypted-Injector.exe

Loads dropped DLL 10 IoCs

pid	Process
4752	Encrypted-Injector.exe
4752	Encrypted-Injector.exe
4752	Encrypted-Injector.exe
4752	Encrypted-Injector.exe
4056	Encrypted-Injector.exe
4056	Encrypted-Injector.exe
4056	Encrypted-Injector.exe
4056	Encrypted-Injector.exe
4984	SpectruArray.exe
792	memu.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4056 set thread context of 4984	4056	Encrypted-Injector.exe	99
PID 4056 set thread context of 792	4056	Encrypted-Injector.exe	100
PID 4984 set thread context of 1072	4984	SpectruArray.exe	105
PID 4984 set thread context of 3096	4984	SpectruArray.exe	128
PID 4984 set thread context of 1072	4984	SpectruArray.exe	105
PID 4984 set thread context of 1168	4984	SpectruArray.exe	140

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	SpectruArray.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	SpectruArray.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	SpectruArray.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	SpectruArray.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	SpectruArray.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	SpectruArray.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	SpectruArray.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	SpectruArray.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\MitronWire.job	memu.exe
File opened for modification	C:\Windows\Installer\e592b1d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF689676F589E636C8.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0128CEB9-4F12-4B57-9BCE-47EE84C09C63}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB1AB78EE0A03CE0E.TMP	msiexec.exe
File created	C:\Windows\Installer\e592b1d.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI303E.tmp	msiexec.exe
File created	C:\Windows\Installer\e592b1f.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF244E04840B7F2F69.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5E55ACA1E942C2DC.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2680	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Encrypted-Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Encrypted-Injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpectruArray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6036	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000508ea0cb0cbd3e300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801508ea0cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101508ea0cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3508ea0cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6508ea0cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321607408485411"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4984	SpectruArray.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3856	msiexec.exe
3856	msiexec.exe
4752	Encrypted-Injector.exe
4056	Encrypted-Injector.exe
4056	Encrypted-Injector.exe
4056	Encrypted-Injector.exe
4056	Encrypted-Injector.exe
4056	Encrypted-Injector.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
792	memu.exe
792	memu.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
1072	chrome.exe
1072	chrome.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
4984	SpectruArray.exe
1072	chrome.exe
1072	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4984	SpectruArray.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4056	Encrypted-Injector.exe
4056	Encrypted-Injector.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2680	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2680	msiexec.exe
Token: SeSecurityPrivilege	3856	msiexec.exe
Token: SeCreateTokenPrivilege	2680	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2680	msiexec.exe
Token: SeLockMemoryPrivilege	2680	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2680	msiexec.exe
Token: SeMachineAccountPrivilege	2680	msiexec.exe
Token: SeTcbPrivilege	2680	msiexec.exe
Token: SeSecurityPrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeLoadDriverPrivilege	2680	msiexec.exe
Token: SeSystemProfilePrivilege	2680	msiexec.exe
Token: SeSystemtimePrivilege	2680	msiexec.exe
Token: SeProfSingleProcessPrivilege	2680	msiexec.exe
Token: SeIncBasePriorityPrivilege	2680	msiexec.exe
Token: SeCreatePagefilePrivilege	2680	msiexec.exe
Token: SeCreatePermanentPrivilege	2680	msiexec.exe
Token: SeBackupPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeShutdownPrivilege	2680	msiexec.exe
Token: SeDebugPrivilege	2680	msiexec.exe
Token: SeAuditPrivilege	2680	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2680	msiexec.exe
Token: SeChangeNotifyPrivilege	2680	msiexec.exe
Token: SeRemoteShutdownPrivilege	2680	msiexec.exe
Token: SeUndockPrivilege	2680	msiexec.exe
Token: SeSyncAgentPrivilege	2680	msiexec.exe
Token: SeEnableDelegationPrivilege	2680	msiexec.exe
Token: SeManageVolumePrivilege	2680	msiexec.exe
Token: SeImpersonatePrivilege	2680	msiexec.exe
Token: SeCreateGlobalPrivilege	2680	msiexec.exe
Token: SeBackupPrivilege	4088	vssvc.exe
Token: SeRestorePrivilege	4088	vssvc.exe
Token: SeAuditPrivilege	4088	vssvc.exe
Token: SeBackupPrivilege	3856	msiexec.exe
Token: SeRestorePrivilege	3856	msiexec.exe
Token: SeRestorePrivilege	3856	msiexec.exe
Token: SeTakeOwnershipPrivilege	3856	msiexec.exe
Token: SeRestorePrivilege	3856	msiexec.exe
Token: SeTakeOwnershipPrivilege	3856	msiexec.exe
Token: SeRestorePrivilege	3856	msiexec.exe
Token: SeTakeOwnershipPrivilege	3856	msiexec.exe
Token: SeRestorePrivilege	3856	msiexec.exe
Token: SeTakeOwnershipPrivilege	3856	msiexec.exe
Token: SeRestorePrivilege	3856	msiexec.exe
Token: SeTakeOwnershipPrivilege	3856	msiexec.exe
Token: SeRestorePrivilege	3856	msiexec.exe
Token: SeTakeOwnershipPrivilege	3856	msiexec.exe
Token: SeRestorePrivilege	3856	msiexec.exe
Token: SeTakeOwnershipPrivilege	3856	msiexec.exe
Token: SeRestorePrivilege	3856	msiexec.exe
Token: SeTakeOwnershipPrivilege	3856	msiexec.exe
Token: SeRestorePrivilege	3856	msiexec.exe
Token: SeTakeOwnershipPrivilege	3856	msiexec.exe
Token: SeRestorePrivilege	3856	msiexec.exe
Token: SeTakeOwnershipPrivilege	3856	msiexec.exe
Token: SeRestorePrivilege	3856	msiexec.exe
Token: SeTakeOwnershipPrivilege	3856	msiexec.exe
Token: SeRestorePrivilege	3856	msiexec.exe
Token: SeTakeOwnershipPrivilege	3856	msiexec.exe
Token: SeRestorePrivilege	3856	msiexec.exe
Token: SeTakeOwnershipPrivilege	3856	msiexec.exe
Token: SeRestorePrivilege	3856	msiexec.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2680	msiexec.exe
2680	msiexec.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe
1072	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2680	msiexec.exe
3856	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 4896	3856	msiexec.exe	94
PID 3856 wrote to memory of 4752	3856	msiexec.exe	96
PID 4752 wrote to memory of 4056	4752	Encrypted-Injector.exe	98
PID 4056 wrote to memory of 4984	4056	Encrypted-Injector.exe	99
PID 4056 wrote to memory of 4984	4056	Encrypted-Injector.exe	99
PID 4056 wrote to memory of 792	4056	Encrypted-Injector.exe	100
PID 4056 wrote to memory of 792	4056	Encrypted-Injector.exe	100
PID 1072 wrote to memory of 5328	1072	chrome.exe	106
PID 1072 wrote to memory of 6036	1072	chrome.exe	107
PID 1072 wrote to memory of 2680	1072	chrome.exe	109
PID 1072 wrote to memory of 2680	1072	chrome.exe	109
PID 1072 wrote to memory of 3836	1072	chrome.exe	111
PID 1072 wrote to memory of 3836	1072	chrome.exe	111
PID 1072 wrote to memory of 124	1072	chrome.exe	112
PID 1072 wrote to memory of 124	1072	chrome.exe	112
PID 1072 wrote to memory of 4656	1072	chrome.exe	108
PID 1072 wrote to memory of 4656	1072	chrome.exe	108
PID 1072 wrote to memory of 2604	1072	chrome.exe	113
PID 1072 wrote to memory of 2604	1072	chrome.exe	113
PID 1072 wrote to memory of 6016	1072	chrome.exe	114
PID 1072 wrote to memory of 6016	1072	chrome.exe	114
PID 4984 wrote to memory of 1072	4984	SpectruArray.exe	105
PID 4984 wrote to memory of 1072	4984	SpectruArray.exe	105
PID 4984 wrote to memory of 1072	4984	SpectruArray.exe	105
PID 4984 wrote to memory of 1072	4984	SpectruArray.exe	105
PID 4984 wrote to memory of 1072	4984	SpectruArray.exe	105
PID 1072 wrote to memory of 4856	1072	chrome.exe	115
PID 1072 wrote to memory of 4904	1072	chrome.exe	117
PID 1072 wrote to memory of 980	1072	chrome.exe	118
PID 1072 wrote to memory of 4904	1072	chrome.exe	117
PID 1072 wrote to memory of 980	1072	chrome.exe	118
PID 1072 wrote to memory of 792	1072	chrome.exe	123
PID 1072 wrote to memory of 3268	1072	chrome.exe	122
PID 1072 wrote to memory of 792	1072	chrome.exe	123
PID 1072 wrote to memory of 3268	1072	chrome.exe	122
PID 1072 wrote to memory of 2392	1072	chrome.exe	124
PID 1072 wrote to memory of 2392	1072	chrome.exe	124
PID 1072 wrote to memory of 2560	1072	chrome.exe	125
PID 1072 wrote to memory of 6016	1072	chrome.exe	126
PID 1072 wrote to memory of 2560	1072	chrome.exe	125
PID 1072 wrote to memory of 6016	1072	chrome.exe	126
PID 1072 wrote to memory of 2916	1072	chrome.exe	127
PID 1072 wrote to memory of 2916	1072	chrome.exe	127
PID 4984 wrote to memory of 3096	4984	SpectruArray.exe	128
PID 4984 wrote to memory of 3096	4984	SpectruArray.exe	128
PID 4984 wrote to memory of 3096	4984	SpectruArray.exe	128
PID 4984 wrote to memory of 3096	4984	SpectruArray.exe	128
PID 4984 wrote to memory of 3096	4984	SpectruArray.exe	128
PID 4984 wrote to memory of 3096	4984	SpectruArray.exe	128
PID 1072 wrote to memory of 4856	1072	chrome.exe	130
PID 1072 wrote to memory of 4856	1072	chrome.exe	130
PID 1072 wrote to memory of 1240	1072	chrome.exe	131
PID 1072 wrote to memory of 1240	1072	chrome.exe	131
PID 1072 wrote to memory of 1096	1072	chrome.exe	132
PID 1072 wrote to memory of 1096	1072	chrome.exe	132
PID 1072 wrote to memory of 4276	1072	chrome.exe	133
PID 1072 wrote to memory of 3372	1072	chrome.exe	134
PID 1072 wrote to memory of 4276	1072	chrome.exe	133
PID 1072 wrote to memory of 3372	1072	chrome.exe	134
PID 4984 wrote to memory of 1072	4984	SpectruArray.exe	105
PID 4984 wrote to memory of 1072	4984	SpectruArray.exe	105
PID 4984 wrote to memory of 1072	4984	SpectruArray.exe	105
PID 4984 wrote to memory of 1072	4984	SpectruArray.exe	105
PID 4984 wrote to memory of 1072	4984	SpectruArray.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\UTODYIBG.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2680

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4896
- C:\Users\Admin\AppData\Local\Stoneboat\Encrypted-Injector.exe
  "C:\Users\Admin\AppData\Local\Stoneboat\Encrypted-Injector.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\ProgramData\TreigenAutomation\Encrypted-Injector.exe
    C:\ProgramData\TreigenAutomation\Encrypted-Injector.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\ProgramData\SpectruArray.exe
      C:\ProgramData\SpectruArray.exe
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:4984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3096
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1168
  - - C:\Users\Admin\AppData\Roaming\TreigenAutomation\memu.exe
      C:\Users\Admin\AppData\Roaming\TreigenAutomation\memu.exe
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:792

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:3188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa8,0x134,0x7ffa5249c728,0x7ffa5249c734,0x7ffa5249c740
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1400,i,13836436323295699384,5041295861470649114,524288 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,4105877782769605058,8133614962225041655,262144 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,16666564004580959933,3548883399771694611,524288 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
  2⤵
  PID:2680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,378780044134299355,1865812190298847837,2097152 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,17388674074218308361,8296542256831433330,2097152 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4596,i,6941871860597307854,11262020158404859115,2097152 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,12090650649824308167,12029150776949474600,524288 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,14100411478154355413,6213167699307558881,524288 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5584,i,2444371902334037765,10671505526585240298,2097152 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5608,i,13957950501333046393,9605854330572796265,2097152 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5576,i,2023869021516723832,13994163850945194509,2097152 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6208,i,5914425634144048563,4440204394788033793,2097152 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6268,i,14079201339788895890,5194363281248522696,2097152 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5512,i,15253742937386031734,10224615329151698879,2097152 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5784,i,12663264545150207297,18189577765577555353,2097152 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5668,i,4433583125996829871,13682254401619962332,2097152 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,15248978813996198168,7352726264785163953,524288 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6296,i,238484836433540755,5581210865036213487,524288 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5280,i,14357542729721976545,10970136448300173104,524288 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5768,i,5859421480130354938,5470418565074769186,2097152 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:9
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5776,i,8102916257488235850,3747100742314550051,2097152 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,4234266802746870480,767392706404572529,524288 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6344,i,14181808401493835033,17706008867474010474,524288 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,9620317653243678897,17682724469325780721,524288 --field-trial-handle=2060,i,1318259064592667908,10462020007076945401,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:2772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:8

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e592b1e.rbs

Path C:\Config.Msi\e592b1e.rbs
Size 9KB
SHA256 c04f6a56de5cfedc173de0f794e5ee3d6f6618786cb48133a3501105b6ac1e85
MD5 1046a408ce607109a609af55234ad071
SHA1 c2ca0a31e49a05e6a70c9c811ffefcf8f77a14df
SHA512 a395415a00993433fcd47d7fcdd9314e007ed2a8734de4b1489cf6902b2ca04c851232057dfe81c38a4fa89afb9327f3e91c8dc1b4ffdfec6ee5d7987c2fe1a3
SSDEEP 96:tObx01XtOuOrRZkhZWOmg4+VLIA0yCHy8VUcXZyBHCsThq08UcXZyBHC6jP0hPtF:tR/XCDuqqiI/qqij4NDX3p6
TLSH
T1EF124111B710C4E3F8A90B72C327272C3BE7D7D59660671F191E82A49F13B5ADB496C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpectruArray.exe

Path C:\ProgramData\SpectruArray.exe
Size 258KB
SHA256 3837645e4ccc1e6b60c984d9516030da3168aa8f2a9bf7d52ebab8017c3a9f24
MD5 7793c30e1ca6670a558fc38338cd7b76
SHA1 64fe73b543d62147c4b44db121a1cbb05285684d
SHA512 4969b0430cb97b8caf8d1ea7cad04b7fbffd0382895f93f8951924aa76b0f1d8635dfd8ebb168dc277d6da232e2f235b111e74a24904d25d8c2a40a5ad17e886
SSDEEP 3072:hENRC6vGYOvcY7we7UYuqnDz+1CxDistQNw+:hEycpYs2/hDiH
TLSH
T1D4445ADEA18B84E1D1C1FE34C2A3B303672A6E1F0AFF54562B977509F8BD29E3511606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 830c924ba79ed3ae1102d97e14b4d6e376d7d4f261a7257bec02969b6d586778
MD5 3085662676e19a8062a84bae67cff37f
SHA1 294f5c0a2a952b1021392f10cdd751d44bf25979
SHA512 af74aa8041a9e86c1090f99b359d038cb2cbc47a81c0261c7cfc0bd5d087bae9814325b58f8ca76c9f2a35847c31d58696b1a6a7f1fb331d9a4fe81a05fb0398
TLSH
T190E02B69C831ED3728FC172D90940B87E74113977A40994F3A3CD10D8FF123AD68A86C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9e9ab6035a4d507f8d41a5968727bbfae77e34805adbc0d034b82bcadc0d1aae
MD5 9ae59bf29cc115584512d5d8970a1e53
SHA1 566ce1969cc7ab0aadb532b1af5454130dce361f
SHA512 0778f365650ccdc77fa7155d0df3bab1b616c74dc93ae3ad2bb096c19a9ae730a030c4defa0798057d54ebdfe956f1c119f0bb7a8686ac90a9757ddcf7eec22c
SSDEEP 192:4RlP7wCv7+TAPRp2O9pHsb+WNnbI0OLZG+BcZSvVyIsnAUgR:4RlP8O3XtTwM0wJJR
TLSH
T16A32A52EA954793B6CCFD229FA627793E6F5102231A42E84E7FC892C14E79CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fb377604f2eff03c4677a647c8c94a33496bb6a03f2ca3b617f73d6d02079dca
MD5 c879080c9ba72d4bd02fa06950d0d4da
SHA1 51eeebb8e8d90b5930e9e2aca5c65a6a5e11bd40
SHA512 b3049b1fedf12cf8e69c46588916533fc10ffee805ef2066c1e5abada55bbd8178d890f43ff726bdcb387c44a2df1d11d1ba3d3d6ee4537f088d19751b4a55f8
SSDEEP 192:eLE4K6Xn7KxkXqK4I40pUZNCgVLHrKHfFKslEiTtXzKD/ML+ErUkKNxn50i4S+h:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLth
TLSH
T11532C727A48E9E7F4FD8E51CDC477F4B6CB502567378082896FB9C0403AA78A214A1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 74f8a7a503d2458d870a5570661e8ef666a85ee786c432a30056eaa49f33891b
MD5 d264c17c01e87494daa9ed7f11d64bac
SHA1 c786ee5e77919f40bafd64bfaab21dee01d1edd3
SHA512 f8fea72e698efbf2022dc4a26eb6ecc32ec75d15d743431519df7dc08ff6cb52d5016a4d57fe3fb6cfaa2b2d0331e495642250f8fe7432185b56880de9fd3fa5
TLSH
T10EA0021045C36C75CD1583B460B146433A71781E1951870B94B394549FBF1CA5115540
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 93fcdbf9a3b1fbba81f2c98eadb43a63d38f696ffdcabf4bc28d0e8c62762320
MD5 17c69103bd5e943d29bef5440e10b6a9
SHA1 306fe33b5c0b415875f36a097a7fae2ff0ea853d
SHA512 d400cd9cdf29c56ff283bbf30279487b7ee455a93b9269fbd8fb98b29323572c899b8a2ab42e8a0d29ea36f9d48aaf8280752387e8f8edee72b0ed1c902bc42a
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 ed91700bd106cdde1a330815c5108989e1428d44333561c01dc927c2f10104db
MD5 7408b9041da2c5dab255dcd36f20bdb3
SHA1 5ac37433142930cdc970bda20d4b79c58b7c1ec9
SHA512 59fa236ced35d4c75739f62682c86ca7362dd09aaaa3cde6bf7d9d9d9b19c6403af3611b1a8c4c4f67ae03de5daa4ca60add36487abb84631e958bd53802b505
SSDEEP 3072:knUXOxG9nuTy1heAuN95jxluGxqFZILHwL3i6:xPJuTkwD5jxluGxqFZILQLL
TLSH
T19DD312D2DF6D7DB758BFC91A71A72552CD84C803986D6E407AC40E4C628ACD3A726907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 630bfe0cdbef9231af197e5dba1ef43a198a75bd7e1a89760917679d7e4f45a7
MD5 4c74a8486fe033457e2cb3efedd80997
SHA1 2f7e9101c8398e783fb292d9b1d7f23125ef1bc8
SHA512 f13efe28c3361985331254fd320d1126322a2fd154adc22c79f43ad5acf3d9b43e78b111193e28f3a819b31a9b3775d22ab0a4ec6ff5a20bb9ee7faecbb2b725
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok58OVDuB6JGyvTNm6zj3+PEhiv4a:mC0Nr7OJRPrL9/EtDUD84O9Imgj3+shM
TLSH
T198A13932657E5CB759B78545F5563B03CFA4717B5A21BF40D9DD2B0C20A70EC1382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 e37b2df4d0845dc63748ae2a695bf8b19ea204c7cc25e3633e4beab925c6e0d4
MD5 e58c9e32bcdff83589873e7922154780
SHA1 c47c0ea5fda955e458e5e607ee92c4339e2d0b73
SHA512 756a1c63ece69d9aa077641b8cdac01886ccc4cf0eba266e36d24709f459c8aac424df7162c9d9f1148c5a99302ab7431f0865aa3764777781cb9e4eb242a777
SSDEEP 3072:PnUXOxG9nuTy1heAuN95jxluGxqFZILHwL3i6:MPJuTkwD5jxluGxqFZILQLL
TLSH
T17FD312D2DF6D7DB758BFC92A71A72552CDC4C803986D6E407AC40E4C728ACD3A726907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
MD5 6323cc327b22cd2420df109845ca78e9
SHA1 f2074121336d4247965376aa31c81a521651fced
SHA512 ad90ad4e32e51254dce054cf65f640b1270dcf91737c0303fd35ce5acff095b94bddca1b3fa81d6c8635dd30f5cde8d0750c3177db25325ec427d798f8d78df5
SSDEEP 24:TLiz+4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:T4/IHRH34kWqB1kQnjhHmr6ITmUrxY
TLSH
T18B23986E9A2CA9A1FEE40B3ED7D1D0127B35AA0EC2E4D5F2099B506746C440405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Encrypted-Injector.exe

Path C:\Users\Admin\AppData\Local\Stoneboat\Encrypted-Injector.exe
Size 480KB
SHA256 565a8a17e3c4c6ac8ace2bb3df5aae9b3bbde1e6889f04f031b564602f498b99
MD5 d937fc0dd514edf6d8c32e89afcc5588
SHA1 2c2725926beb60b043af56104fde11c88bf2ca88
SHA512 f1c1b8cdc1360d7556e21cf76475f1b5dff15bbb87571456b1607234d7569af8f7da2e564f730e964651b85864909161bb1b35102a9a0444e9df9c8dc87d6df9
SSDEEP 6144:YUutHVXYYRTUZabgJJ2ogelPiqNtibgqlAf0vj7uSO+un4kst:A9mst
TLSH
T18CA4404AABA5CC1DF6F70A3AEE7A445408BEBEC40E3E959E4640378D8535EC59C10B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR100.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\MSVCR100.dll
Size 755KB
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
SSDEEP 12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
TLSH
T1D3F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore4.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\QtCore4.dll
Size 2.6MB
SHA256 46f24b0b8a53e2502037c2f47e46efc04c111fce8ebc7b23c068a20a2ec35a00
MD5 52dd3ecdd390bfe88d488c7f3003b7c3
SHA1 9376bd43bbb5bb830f4140d27470b36c12a6d315
SHA512 7e8c9902cb56a25f0ce5c956035fb348999fb35b0ea1397bb4a782b2d520d7c4e8c916d067c18a492b79c1bd6bb5dd4e8cb7561cd08af1fbbfe482aff0339111
SSDEEP 49152:wpnyb0Z+zbpGbmiL465pJ6e6GJsv6tWKFdu9CFTSuPFMr:wNyxG1tXs+Jsv6tWKFdu9CH
TLSH
T15FC56D90BFEBC1F6EAD3A2B6446F921E41369A1647208ADBC10C6B074C756D17D3738B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtGui4.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\QtGui4.dll
Size 9.0MB
SHA256 1be9a3031f8e488cd5839a7b74641d6e758fbde4d28eb09bc4cf892e2edd0a38
MD5 886cefa51c9671be520a6a60544e4d7f
SHA1 a69731c6f635fc1ae50d6d21b360834b8ff67aa5
SHA512 b635a41b6957c07404b4ced039d5f0cf80bb344b9d006b8bf4abe7af61b83885d9dd53dac8c1cc0ecae4f4f6bd77dc9af9a35220d112d2b8dbc94266b0809b56
SSDEEP 98304:1xvQeZgQinV7IgyL9d/loEDLGDCNfG/9WJghBeZJ9xDKcrSF/n8CWyE5Vafed:1xlZFRlDKDCNfU9WJJHKc2wa
TLSH
T170968D12FFCEC1F1CE86B178145EAB1A466BF6C5CB108ED3E1895E5B78202D12CB9257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache-gen.so

Path C:\Users\Admin\AppData\Local\Stoneboat\cache-gen.so
Size 31KB
SHA256 7500d562fdeb021e3d282decd92bb2343abc70a404c85daf8ecbd22e090c49ef
MD5 041ed6e844bb5c948aa64069e06d6da1
SHA1 68177ccb010472eb1becd9f6d4216a4537318624
SHA512 40978c71c99575158c861753cd1127c6084ea62d83cd26a392ff51bdeb3a0162a0ba8db58dd1e0ddd08f2abed50da8b47142d8eefe4d53d64049a60ec737b330
SSDEEP 768:diyo2dsJ+U8b03QRyMoNt3G303ObtfsyiukT68NXEiY:diM5UFARBsGBg/dEr
TLSH
T1C9E28D5B866A5E62EC0E387F5C18E4D3C255F576794B08B2F2AA0D1F391ADACD420CD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp100.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\msvcp100.dll
Size 411KB
SHA256 b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
MD5 bc83108b18756547013ed443b8cdb31b
SHA1 79bcaad3714433e01c7f153b05b781f8d7cb318d
SHA512 6e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
SSDEEP 12288:Seb8zxr1aWPaHX7dGP5frhUgiW6QR7t5qv3Ooc8UHkC2e7wx:Seb8Fpa6aHX7dGP5Gv3Ooc8UHkC2ekx
TLSH
T1559428237A4649F5E1D223F46289932143F9FCA40721B3C3A2EFE1A99F583D56A33951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\msvcp_win.dll
Size 493KB
SHA256 9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
MD5 7762c51ea02eb943183d597ea0ee5530
SHA1 0b8c307eba01d0679a2669210862d0afa888c40f
SHA512 14c955e8acb03e86cd11cb992a69fa6681769b2bb7ebdd3a587b36a519f4084be3dd42825b3c91c0d4e325a2869e96acfc88c3ca05bc59352bf0657e7c4ec758
SSDEEP 12288:beMcMmVRYcFERWKn9g82vWirmibAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sub:beMKYXQKn9g82vtnbf03Ooc8dHkC2ecC
TLSH
T142B44C332A4509F1E48A23B4618D936283FDEC650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service-sys.lock

Path C:\Users\Admin\AppData\Local\Stoneboat\service-sys.lock
Size 4.3MB
SHA256 a53b6423631234feb7bfd2b88e367a72c87fa2c831d08eba0fda67b6c3c3f7bd
MD5 6c203c13b7375af9120e53ab674fae2c
SHA1 cf2f054f3f683ec621157c0458c793487f10f920
SHA512 f9a23afcb19da3bd36b195809718c3475f5358f86a0a425df7479686374a6fad6250bde58a9dbfc090795bf4cb50eb00b82904f624ed80c2cb3fe19e12dc2ba4
SSDEEP 98304:zcsJtPXT7QBatxxo/ZNmxlIEdUagLWdXqMFgOdEg3O7i:4KQBGo3mxlIEbgaXqEb3ai
TLSH
T1F026238EDC1D8A2E55E6873C1045588BF0B562DE3B67983E5F74E2F8063CB2A47D82C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Stoneboat\ucrtbase.dll
Size 1.1MB
SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
MD5 c4a25dce665733663284750666684703
SHA1 368f3c3497c1b0121409216282803bcf1b64f35f
SHA512 768af35c80d0423e72fdc8178b57d4be583569c1e96cac8c00808d07aed988bc614618f7b2077617498079b6ec0faa2d2d48cc314cc34faf11f56b6b7146201f
SSDEEP 24576:FQeBoON4h/4z/G1YknUkY3Ub6lymKmcvIZPoy4yuhpBR7j:qeBoONs42nUv3UbfjpBlj
TLSH
T1D2358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357CDD7.tmp

Path C:\Users\Admin\AppData\Local\Temp\357CDD7.tmp
Size 40B
SHA256 cb998c720382ae85e7a0c939bcc69b6fdaa759e839f465e2886a95270dfcf743
MD5 e0de0b19b397b6a4b339aa238f58c581
SHA1 6407ae21447956d0b7eb4a954dfd73a95a5ae069
SHA512 cb0b49d41eadf9d9d58a2e890106e6529854248d099d76e6c0ac1566dd356de70b8fec7afac38cca2302d1e7ecce6633694ad4a59f961bfaee8799a10ba5f53e
MD5 SHA1 SHA512

Submit Download

F04A08C.tmp

Path C:\Users\Admin\AppData\Local\Temp\F04A08C.tmp
Size 4.8MB
SHA256 2dd8ce126e4342f32bf56aa75d8a57eb62106c5ca482b70f2355947227aacb58
MD5 479d0988968d73b33bd7b5464f7a3c6a
SHA1 4036cc373fd34dc2e014c11903e31a10fc37d731
SHA512 67e28f3db3aa70ad04970e20c5848e86e97a88ceaf020502f9147a48e1dfa6c831f223873413a706d76e1007b25aa3bbec54ace602cc8e26c94fc70fcf75c33d
SSDEEP 98304:k4AKpvgehF3ldZbv5hPq80tNOmeMm/ViKDcbd3ZbSJSiSvFM6yodMy+k:k4AK1bpXv5hS8tMXJFS5q
TLSH
T1023633B8203F71F04822F561F72028357F4844E593A2EEF19DC6A42E656A913ACDF53B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F04A08C.tmp

Path C:\Users\Admin\AppData\Local\Temp\F04A08C.tmp
Size 4.8MB
SHA256 e0df8c0c8690e0e6956788db141549eacc8bfd4d527591972792271051df8f48
MD5 56d0e6e5e75c2dfb973aacecb10d42b0
SHA1 ef6ccd2d183c0d129bb4c098e01759b7759a7478
SHA512 f84f5ee7bb5b78d8a63dc3d012ced3ad38916a9b8a8188d85539f692d8dd53deaf1348bfda7bbb3e824af6c4707e23a6c5a83567168c18f80186961740445953
SSDEEP 98304:m4AWpvgehF3ldZbv5hPq80tNOmeMm/ViKDcbd3ZbSJSiSvFM6yodMy+k:m4AW1bpXv5hS8tMXJFS5q
TLSH
T1793633B8203F71F04822F561F72028357F4844E593A2EEF19DC6A42E656A913ACDF53B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NY3EstE.7z

Path C:\Users\Admin\AppData\Local\Temp\NY3EstE.7z
Size 17KB
SHA256 01bf41c1ccd1bd3851d04c500bcf2f09f39308a0a082d5f04f837d00e116007e
MD5 be97fa806863b747d8392a48a963c9cf
SHA1 4a7a2900880be1a10c24a80616d60b6e599435f8
SHA512 4d7f8ede20f6059ee1b8b67544fbbaf7f805df04ff401495636f00d99caa6921515a0871ed53068a60ac74eb6a1317a7411d0c18ec5b24540ed5573fd4454e28
SSDEEP 384:vAaqkmPvg7xOv000tzOCFUnmrIs0fxm9PtY2V/KwEtqV0gS9eXMF5Fi/:tqg/zOCFL0pABjEjgQeXMvF2
TLSH
T11E72D0C8A2B9360FDB96B78D1721F39DC68A61E3B33334A65115224BFC741B2D865610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1072_8938901\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memu.exe

Path C:\Users\Admin\AppData\Roaming\TreigenAutomation\memu.exe
Size 323KB
SHA256 6df5e87bfe261f38a5810313c8221c39b5b15206ce672e1a87167edcf82f43ba
MD5 22db418ed5bac1716f440c1e89e9216b
SHA1 d5b0a386edd880c6663fe1cbc0a70af04b1e830b
SHA512 5bcc3c25a46e8ef11383f2a1ac42ce60ddbf6efd7bd702d064dc01e7838b622e64916c01de7b1cab5aab6c10d56ffe9bdb5e37029ac8697d160fecffce08935f
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1zX0A:ntgZ4KS2L0q5UPcU1r7
TLSH
T166641BB2E9CC48A8DEA10EF9377CCDA0656ABA70CEB084DB630451751D2B7B0C571D9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e592b1d.msi

Path C:\Windows\Installer\e592b1d.msi
Size 8.8MB
SHA256 1f44284c85be477e6969685c02f302366f22fb8f2c2a3ac0b2dd9c99e1c4e67e
MD5 c46e2ae5a068439e70a857f942baa604
SHA1 e703e1b8c2da14ca54ed0343a8a8db80688f9057
SHA512 78823c7d6f99e47b7485ee30bfa8d2b39adb3cffb0534951e718fcceed33da6a5165a3a0b14ee3d812ca7e49be09b115fbbbed9de02f9eab362f89dc5f29723c
SSDEEP 196608:V9LuzXp14IgOL43JUeh9Ey/KnzAQZwYaaBIuLIUZkHfvOxDEsIf8BvM:VcjravUehT/KnzFuYDBzRLgf8K
TLSH
T19D9633B473605384E71FACF264681168A1E8CE667971505B6F0AB8B2F773E736910BF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 3a6ce915e49913c767710bb17ff38c503957a3045df7031a1f8e0d5ae42567b0
MD5 f053741178977b86c87fecaa99c99e2e
SHA1 2ef7dd0454d012435500bf1c668991ecf26ce485
SHA512 e2baadf6adad8a11a1a52bfe0fb857a36849d28dfe1329eec748b04b8d5defb1386611b64ef4795aa04c01a38fbefe55cff320a2160a71e9036b57e3ad8e872a
SSDEEP 24576:HFo3DMPrdoO/vvTL/yQqKC1gP7egB7tZUHMo93Uy8PE6JdrasIBm6jgb+OA:tH0
TLSH
T11D57A31437F92140E7B79E3CA8F06A234D397D5BAC19DE8D45411B4E0922FB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{849759f8-20e8-4c04-bb47-ed491b0173b8}_OnDiskSnapshotProp

Path \??\Volume{cba08e50-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{849759f8-20e8-4c04-bb47-ed491b0173b8}_OnDiskSnapshotProp
Size 6KB
SHA256 9eec2dd05aa4a2dd2f4f42583ba6b96b8553b72aabf130824353942098096f5e
MD5 c68cc6093dda6805d99b26e7c3cb9626
SHA1 e207ae440c468dc2ff80d7a79c44e1264ae16608
SHA512 2c3fafcdcee32ddaedd3b955815070f22d6b8514a8e93da936722a89c6b1da8f75032cc5d810f72a01990f1c17861e2d33803bb75f5c0d6c413c2ce1c6709113
SSDEEP 96:FN4mSAnavc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:k7b++uVmN
TLSH
T12FD188185AF54711E2B3AB3229F18557A877B911FF33CB8E0198238E2631910F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/792-116-0x0000000073B30000-0x0000000073C25000-memory.dmp

Download

memory/792-76-0x00007FFA78E60000-0x00007FFA790C3000-memory.dmp

Download

memory/4056-49-0x0000000073B30000-0x0000000073C25000-memory.dmp

Download

memory/4056-74-0x0000000000580000-0x00000000005F9000-memory.dmp

Download

memory/4056-60-0x0000000073B30000-0x0000000073C25000-memory.dmp

Download

memory/4056-52-0x0000000073B30000-0x0000000073C25000-memory.dmp

Download

memory/4056-50-0x00007FFA78E60000-0x00007FFA790C3000-memory.dmp

Download

memory/4752-41-0x00007FFA78E60000-0x00007FFA790C3000-memory.dmp

Download

memory/4752-40-0x0000000073B30000-0x0000000073C25000-memory.dmp

Download

memory/4984-83-0x0000000000C00000-0x0000000000FBB000-memory.dmp

Download

memory/4984-79-0x0000000000C00000-0x0000000000FBB000-memory.dmp

Download

memory/4984-78-0x0000000000C00000-0x0000000000FBB000-memory.dmp

Download

memory/4984-70-0x0000000000C00000-0x0000000000FBB000-memory.dmp

Download

memory/4984-67-0x00007FFA78E60000-0x00007FFA790C3000-memory.dmp

Download

memory/4984-62-0x0000000000C00000-0x0000000000FBB000-memory.dmp

Download