287a6f098c5591903a9ffd26a2e08f8d30ff1c4f18dacd9afeb0ddd01a0a04ea

Analysis

user interaction
yes
max time kernel
91s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/09/2026, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 823.6MB
Sample260926-vexatsywgx
SHA256 287a6f098c5591903a9ffd26a2e08f8d30ff1c4f18dacd9afeb0ddd01a0a04ea
MD5 7cbe4579b642361ddf0eafb6f718f20d
SHA1 27c40a8f8d38a093e1adb192fd45795131e8c606
SHA512 59281e5bd617c3d99ca781a7c606553daeafba47442e015b9520ee5d3b01381cf4e2c31c2c6af4ae14470f30ebdcd2e1a52e770a2ccbf13f9da153aa23bae03c
SSDEEP 393216:AUdsDgMEH5L1WSW3C4j2dO/rmWvdHIYzXjBm4En4BZfcAm:s3ER8SWy4j2QKEdHIYDjBvEn4HT
TLSH
T1F799AD12B7D84075E2FB2634257EA736567EBD700FA082CB6750A6AE2C707C19E3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3300 set thread context of 2008	3300	Explorer.EXE	87
PID 3300 set thread context of 2008	3300	Explorer.EXE	87

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\cosily\youvaeght.inf	file.exe
File opened for modification	C:\Program Files\rationally\blaordseauck	file.exe
File opened for modification	C:\Program Files\Mozilla Firefox\dwaishuink.dat	file.exe
File opened for modification	C:\Program Files\accommodations\bruontoty.dat	file.exe
File opened for modification	C:\Program Files\PowerShell\schmeialteah.inf	file.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4824	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
2008	chrome.exe
2008	chrome.exe
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
3300	Explorer.EXE
2008	chrome.exe
2008	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3300	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe
Token: SeShutdownPrivilege	2008	chrome.exe
Token: SeCreatePagefilePrivilege	2008	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4112	file.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe
2008	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 3300	4112	file.exe	56
PID 2008 wrote to memory of 4408	2008	chrome.exe	88
PID 2008 wrote to memory of 3492	2008	chrome.exe	91
PID 2008 wrote to memory of 3492	2008	chrome.exe	91
PID 2008 wrote to memory of 4824	2008	chrome.exe	92
PID 2008 wrote to memory of 3284	2008	chrome.exe	93
PID 2008 wrote to memory of 3284	2008	chrome.exe	93
PID 2008 wrote to memory of 976	2008	chrome.exe	95
PID 2008 wrote to memory of 976	2008	chrome.exe	95
PID 2008 wrote to memory of 4028	2008	chrome.exe	96
PID 2008 wrote to memory of 4028	2008	chrome.exe	96
PID 2008 wrote to memory of 3536	2008	chrome.exe	97
PID 2008 wrote to memory of 3536	2008	chrome.exe	97
PID 2008 wrote to memory of 380	2008	chrome.exe	98
PID 2008 wrote to memory of 380	2008	chrome.exe	98
PID 2008 wrote to memory of 3144	2008	chrome.exe	103
PID 2008 wrote to memory of 4260	2008	chrome.exe	106
PID 2008 wrote to memory of 4260	2008	chrome.exe	106
PID 2008 wrote to memory of 3400	2008	chrome.exe	108
PID 2008 wrote to memory of 3400	2008	chrome.exe	108
PID 2008 wrote to memory of 3656	2008	chrome.exe	109
PID 2008 wrote to memory of 3656	2008	chrome.exe	109
PID 2008 wrote to memory of 204	2008	chrome.exe	110
PID 2008 wrote to memory of 4420	2008	chrome.exe	111
PID 2008 wrote to memory of 204	2008	chrome.exe	110
PID 2008 wrote to memory of 4420	2008	chrome.exe	111
PID 2008 wrote to memory of 3620	2008	chrome.exe	117
PID 2008 wrote to memory of 4808	2008	chrome.exe	118
PID 2008 wrote to memory of 3672	2008	chrome.exe	119

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3300
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb83cac728,0x7ffb83cac734,0x7ffb83cac740
    3⤵
    PID:4408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,8654181358378866829,17874169334561968179,262144 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1980 /prefetch:2
    3⤵
    PID:3492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,10170108781600004271,737983252079817533,524288 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,14227227059049460447,10385249799805865785,524288 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2544 /prefetch:8
    3⤵
    PID:3284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,965682627892355659,5451738531782784660,2097152 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,1685329673526629595,17013516741123764777,2097152 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:4028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,3608166571506725397,1457841360220671898,2097152 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4452 /prefetch:1
    3⤵
    PID:3536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4424,i,3355385251776441230,12451070029598142376,524288 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4612 /prefetch:8
    3⤵
    PID:380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,1915565418708791101,16778792750092043688,524288 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    PID:3144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,5357288167683634426,1491411002294184124,524288 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5340 /prefetch:8
    3⤵
    PID:4260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,11452285540013021245,15545203369967890342,524288 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    PID:3400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,8232261846540456217,10226342682191793970,524288 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5372 /prefetch:8
    3⤵
    PID:3656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5624,i,13045678534984671323,3515826263546252109,2097152 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5640 /prefetch:2
    3⤵
    PID:204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5580,i,16250664468938408443,108305754353075467,2097152 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5604 /prefetch:1
    3⤵
    PID:4420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,517457436246300029,6112553901901156108,524288 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4604 /prefetch:8
    3⤵
    PID:3620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,13349336579877915275,58972694882318998,524288 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:4808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,9066999049619959917,6902798051778803639,524288 --field-trial-handle=1984,i,15210943421464812604,2672866776717306170,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5316 /prefetch:8
    3⤵
    PID:3672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:64

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 0705360f60716c11c22d260fd36399e4c8ad476ebcb8da12bc33fc253cde7ed9
MD5 90a900714d9ef1a73cd36c208aec8103
SHA1 977249ad497e8e13486a56c76d7ad1e331e0da13
SHA512 6bf72048fd23e82fee2441fa367473497d191fda9b53063b363a23a976a845e27699a17e94ca5fa3b30b0586d3a823d9f4016274c257a8e7b88bef2300b62bba
TLSH
T1ABF0F4BACC31EC6B18FC5B2920A44B46FB9013572681995F3B3C820D8FB563B868691C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 66c011f03e10f2a0b3207bc15670e494c13d063e9c32678b3628ab8c62110cb7
MD5 96bd3cfa9c33c6c879ca989a6c9abd6d
SHA1 8f71f650ac529cd62c5c9e4aad95a50fd8c66c54
SHA512 0f610811c6705aa3e7ed8d335557c8493f3e5157e912d4ac2f636f7040bb71ff64c7188e737b3db5e8e0e3315fce2a4c18b52bb467fce6da683a3d2c54a9d1f2
TLSH
T1F3519CB7C3D48A7DC81556F49B21AE1FCD3D0A28522C3C56D8E8AE5F53E2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c2bae543a803a7b20904f38117e34ad2673fc32e97f1f7722bca1f12b1291f9c
MD5 608ab036dba90fd1ba8b762a989b3f94
SHA1 0ecc3cf706b32012138f746daa0ded36dccd4d30
SHA512 9c7c2aa2ca499cc481cb7b803ac43c2c0edeeb1001401dea62c5d43a5fa3bbc681e12f9a421d2f5b9b9f75fc24b0a3959cea0211d62f44a7cdc962c5d380ab53
SSDEEP 192:RRGSDi5qv71vAPRp2Z9IHsb+WNncE0EiQkwstq+VyIsnAUge:RRGSMm56X62w/0uMk2e
TLSH
T10E32812DAD10753B5CDBD22AFA61BA57D7F9102231983E84E6FD893D14EB5CC2227807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0bee408018d78b798cc30b6b06b89385ada93d8495ec4120e93ccd949dc518f1
MD5 b92ff9df1a87e1c99d16ee31d3754ce3
SHA1 c6a4d2f365489746528e327931f0298ca0d12227
SHA512 f7166751b5194e810fcf92b6c43df4a28611e8f4a256846b8cbcf3904bf3b8d74d6f9b16e4eb2744e64eb73f54c913adea21e5a4b985d32cd9de7118810870af
SSDEEP 192:RRGSDi5Qv71vAPRp2Z9IHsb+WNncE0giQkwstN+VyIsnAUgE:RRGSMM56X62w/0SMn2E
TLSH
T16632922DAD10753B5CDBD22AFA61BB57D7F9102231982E84E6FD893D14EB9CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d4f05776a0b75e95b8f512c321b6ac3c30c064e038a517ecea66385bf41c7731
MD5 2225758332884b172343e40cd68a4567
SHA1 cf81ef3c3a8110bee2bbff897963015e9df0727b
SHA512 aba865d3ed44496f990475dfc2b1fb07b76b8d28e45a9fd15f4ee5c419ebddafd71c05be414370f2caab36599f1baae397718789b2b2425f9592b76305c709d2
SSDEEP 192:RRGSDi5uv71vmPRp8Z9IHsb+WNncE0miQkwstZ+VyIsnAUgE:RRGSMK5wXE2w/0wMj2E
TLSH
T16942932EAD10353B5CDBD22AF961BB57D7F9102221983E84E6FD893D14EB5CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 55f59d7b7ec55b64b48772110af045648bc9c7edeea19caab4be78f8a531adc4
MD5 58564ef70d483a4f24de2ff12d554ed6
SHA1 fadbb733d8661c07020d396e16d8ac797849846c
SHA512 c5f105c91b33966fd94a33778e7bfd505f0b0f4ee964992e3c1a39c507753f72dc3d2d9aa4ad577469b0cf158e19936097d5632ec1bf6a6bce47012ae6abdd1c
SSDEEP 384:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLXODYj+ErU3YLHGoVt7Sh91:cqY/7KxkXqKf/pUZNCgVLH2HfgsqTOEI
TLSH
T1DA520A27684C9A3F0FD8C64DCC16AF4FADF501576678092453FB9C18039A7CA114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e8c8eeb557e4856865c08606e73d209d87433450eb89b1c6ceae6632901f07fd
MD5 d1c1a941d7301edbe9397d0062b9a48d
SHA1 cc9dc89e9508bc5b36b4fb56ba0e8975fdde32c0
SHA512 b7b4b7d4280e1d06794db23b7a08606def30629c46fd421dfce54bd3c6d98592c6af58b62786fa402ae0e436411937af167d3503e81786a19b70b9c277f9a0c1
TLSH
T17CA0021845C02816ED105771A06909C12695C86D3EE1CB5374914A48C96B1D083CE645
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595f4d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe595f4d.TMP
Size 48B
SHA256 eabd207e1ac51910f0ccf27fe1ffb115d965b82990b44a7127a6c8201a3dbe48
MD5 4b278b3c60e01f67f7117774cc64f2cb
SHA1 4e3529e011eb6cce2f476b514d8e386d35c15e52
SHA512 9ec73e2c8fba06b02818a3aa2786ee29eb1fe319d3df8414522848cfe02241b8a87ffb587eb1200ec4d5e66c40d75bd768e3921b9a6765241ddc4b74b876f602
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\index
Size 256KB
SHA256 eb05ae48b748f9ee2bc0f1757f25fcb24c9d7a8afedd176165eb3c90a98ede27
MD5 ef5484d15f7bac3520f52202cb5c19d9
SHA1 731caff6bcbc8ee9bddf6823f2e3a4854b109985
SHA512 2c84d252e2b5aaedfa759d723fd573072697ac383b1b725c6d2a90371857199667f559ae7f0e6f6cc76028fc79548d55253d04ae8a4f4849885a70404e53ed8a
SSDEEP 3:LstlNllkll/lNZAq:LsX3lEtPA
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 ad5b6a282a4b954024f6b0e904b23d16377d6d57f102a859053acc5db074048d
MD5 33697915d2f43c26a96b2f271b5af1c5
SHA1 d65a8bb80566b44fdf6d1a6bf0df316a30ba1561
SHA512 6a55e43d71faf83bdcb0b9bc1915891cc4414a165f5a749cff83682c41dc8263348a60f6abb3977ed78f18a1bdddd87ad76ee940ab3d6242c3eaf5dd7d0cdaee
SSDEEP 6144:KYuiJ4pq+zni7cwTl5oFJUO0xp2dh7+hFD+7t56OD9ZfSApprw:KYJA6cwcXU5xp2dh7yFSXD9ZfS4S
TLSH
T14D4422B3F9A5CCABD6F96245B0CE1604CDF279E781DE1B0E805A5E46A44ADD80273F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 7e3aad48400e2b296e9b70e37d8152495934a5a6f97fcc8fd08827615ac65c08
MD5 77f693195f00e7b218be1f7e2844701c
SHA1 3fcb1955ca85e02d6ef6f72555e03cdf0d33a4a0
SHA512 983520088ca5b9068e49b705dfc9ca348b9959bc4d1db05d0d3b020cff5c25a2ca9d50f92495b4cd76e823e868d2e5275d2e17b61d806a684be1a937fc50d2e4
SSDEEP 3072:d50+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:d50+hFD+7t56OD9ZfSApprr
TLSH
T1AED31232AA91D8BBC9FC6541B157A304DE666CED41DE3A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 7fcf7efa519771a6e9207ceb331df5a7698fef2b8c3e755ce7d20ccdc548af7b
MD5 e4d433c07e5b9f63f3ef45f66cb7228a
SHA1 ea5f2a39e8c5be9397fa8a0f3da0b0754b140ab5
SHA512 f71f19ee2ef7e293b920cb34453e72e7fb92f1fef30afacdc86769c54d97069757eb2c2c0f584f6ada04584d0a7cd01cbc9880356d99fe52065dc1b113a0287b
SSDEEP 6144:RU+J4pq+zni7cwTl5oFJUO0xp2dh7+hFD+7t56OD9ZfSApprw:RUIA6cwcXU5xp2dh7yFSXD9ZfS4S
TLSH
T15A4422A3F9A4CDBBD6FD5140B0CE16048DF278E681DE1B1E805B5E86944AED50273F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 95ec52411e2a3647da839b41934d41674989331677d37ca0ca45027a1781bd36
MD5 7ac224274a763304bead765706c2125f
SHA1 ec80edfe633888c362ed667435230068984c38c9
SHA512 b9320ab3f95ce25323700a96b63ac93e9944b4e3b5cc28dde0ba161805443c4d0a1630cc5dde6fe4a1b1a047dbd16821a46e43dfd74c98cdde0926ca44604acd
SSDEEP 6144:KU+J4pq+zni7cwTl5oFJUO0xp2dh7+hFD+7t56OD9ZfSApprw:KUIA6cwcXU5xp2dh7yFSXD9ZfS4S
TLSH
T11F4422A3F9A4CDBBD6FD5140B0CE16048DF278E681DE1B1E805B5E8A944AED50273F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

775c1d97-3f12-4da4-9901-b85cb522b56f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2008_1853083111\775c1d97-3f12-4da4-9901-b85cb522b56f.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2008_1853083111\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3300-60-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-38-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-1-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-26-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-7-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-8-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-10-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-13-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-12-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-14-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-6-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-18-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-9-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-11-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-16-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-22-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-23-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-25-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-21-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-19-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-17-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-5-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-4-0x0000000003310000-0x0000000003388000-memory.dmp

Download

memory/3300-2-0x0000000003310000-0x0000000003388000-memory.dmp

Download